NMC Issues New Advisory on Digital Signatures for Medical Records

Regulatory update: National Medical Commission (NMC), Ethics and Medical Registration Board (EMRB), public notice dated October 13, 2026.

The National Medical Commission (NMC) has clarified when registered medical practitioners can remotely review and authenticate medical records using digital or electronic signatures. The advisory, issued by the Ethics and Medical Registration Board (EMRB) on October 13, 2026, addresses uncertainty over remote report approval, professional accountability and the security of electronic clinical records.

The clarification is relevant to doctors, hospitals, pathology laboratories, radiology centres, telemedicine providers and healthcare technology teams using Electronic Medical Records (EMR), Electronic Health Records (EHR), Laboratory Information Systems (LIS) and Radiology Information Systems (RIS).

The central point is that a doctor may authenticate eligible medical records remotely, but must first review the information needed to form a professional opinion. The doctor must retain control over signing credentials, and the healthcare establishment must maintain appropriate security, traceability and record-retention safeguards.

Read the original notice: NMC public notice dated October 13, 2026 (PDF).

What Does the NMC Advisory Say?

The NMC observed that healthcare establishments had adopted differing practices for remote review and authentication of medical records. This created uncertainty about whether a doctor could approve clinical documents while working away from the hospital or diagnostic facility.

The notice also refers to a recommendation by the High-Level Committee on Non-Financial Regulatory Reforms to facilitate digital and electronic signatures in medical practice in accordance with the Information Technology Act, 2000.

The advisory clarifies that there is no prohibition under the National Medical Commission Act, 2019, its regulations or the Telemedicine Practice Guidelines, 2020, against remote review and authentication of specified clinical documents by an authorised Registered Medical Practitioner (RMP), provided the applicable legal and professional requirements are met.

The documents covered include:

• Laboratory and pathology reports.
• Radiology reports and diagnostic interpretations.
• Discharge summaries.
• Other electronic clinical documents.

The advisory is clarificatory. It does not create a new statutory right to practise medicine or remove existing registration, licensing and professional obligations.

Key Rules for Doctors and Registered Medical Practitioners

1. Review the clinical information before signing

An RMP must review the relevant clinical information, records, investigations and other material reasonably necessary to form a professional opinion. The doctor must exercise independent professional judgment before deciding whether a report or other clinical document is appropriate for authentication.

If the available information is inadequate, the doctor must refrain from signing until the necessary additional information, examination, verification or professional review has been completed.

Example: A radiologist working remotely receives an imaging report for authentication but cannot access the relevant images or necessary clinical history. The appropriate response is to request the missing information and complete the required review, rather than sign simply to clear the pending report.

2. Keep digital signature credentials under personal control

The advisory requires digital signatures, electronic signatures, signature creation data, authentication credentials, access tokens and other signing mechanisms to remain under the control of the concerned RMP.

These credentials must not be shared, disclosed, delegated, transferred or knowingly made available to another person. Doctors must also take reasonable care to prevent unauthorised access or use. Suspected compromise or unauthorised use must be reported promptly under applicable institutional and legal requirements.

An assistant may prepare a report, organise records or route a document through a hospital workflow. However, the assistant must not authenticate the report by using the doctor's signing credentials.

3. Authenticate records only within a lawful professional engagement

An RMP authorised to practise under the National Medical Commission Act, 2019, may remotely authenticate reports generated by a healthcare establishment with which the practitioner is duly appointed, empanelled, contracted or otherwise professionally associated.

The authentication must take place during the doctor's lawful professional engagement, and the doctor must have lawful access to the relevant clinical records.

This means that a hospital or diagnostic centre should maintain appropriate documentation of the doctor's appointment, contract, empanelment or other professional association. Remote access alone does not establish authority to authenticate every report.

4. Professional responsibility remains unchanged

A digital or electronic signature is a method of authenticating a record. It does not reduce the doctor's professional, ethical or legal responsibilities, nor does it remove the healthcare establishment's responsibilities under applicable law.

Authentication also cannot replace an examination, verification, clinical review or other procedure required by law or professional standards.

For example, a doctor cannot justify signing an inadequately reviewed report merely because the hospital's software allows the document to be approved electronically.

Legal Framework: IT Act, 2000 and Telemedicine Guidelines

Information Technology Act, 2000

The Information Technology Act, 2000 recognises electronic records and electronic signatures subject to applicable legal requirements. Section 3 addresses authentication by digital signature, while Section 3A addresses electronic signatures and specified electronic authentication techniques.

A digital signature is a specific form of electronic authentication. The terms should not be treated as interchangeable in every legal or technical context.

A scanned image of a handwritten signature, a typed name or a simple approval click does not automatically satisfy the legal requirements for every document. Healthcare establishments should select an appropriate authentication method based on the applicable law, the document and the intended use.

Official reference: Ministry of Electronics and Information Technology.

Telemedicine Practice Guidelines, 2020

The Telemedicine Practice Guidelines, 2020 recognise the use of information and communication technologies in healthcare, subject to applicable professional and regulatory requirements.

The NMC advisory clarifies the position on remote authentication of medical records within this existing framework. It does not remove the doctor's duties relating to appropriate clinical assessment, documentation, patient safety or professional conduct.

Other applicable laws also remain relevant, including the NMC Act, 2019, the Bharatiya Nyaya Sanhita, 2023, the Bharatiya Sakshya Adhiniyam, 2023, the Digital Personal Data Protection Act and applicable clinical establishment requirements.

What Hospitals, Pathology Labs and Radiology Centres Must Do

The advisory requires healthcare establishments to maintain electronic records with appropriate safeguards for integrity, confidentiality and traceability. This includes audit trails, authentication logs, date and time stamps, data protection and cybersecurity measures.

Essential system safeguards

Review EMR, EHR, LIS and RIS workflows

Healthcare technology teams should distinguish between document preparation, clinical review, approval and final authentication. The system should not allow administrative staff to authenticate records using a doctor's credentials.

Facilities should also define how incomplete reports are returned for review, how corrections are documented and how suspected credential misuse is reported. Where remote consultants are engaged, their professional association and authorised access should be documented.

Can Foreign Medical Experts Sign Indian Medical Records?

The advisory distinguishes between receiving a foreign medical expert's opinion and authorising that expert to practise medicine or certify an Indian medical record.

A foreign expert's remote consultation or second opinion may be considered by the Indian treating team in accordance with applicable law. Where relevant, the patient's medical record should document:

• The expert's identity and professional qualifications.
• Professional registration or licensure, as applicable.
• The date and nature of the consultation.
• The professional opinion provided.

The foreign expert's opinion does not, by itself, authorise that expert to certify an Indian medical record or confer a right to practise medicine in India. The advisory does not recognise foreign medical registration as a substitute for the authorisation required under Indian law.

How the Advisory Affects Telemedicine and Remote Diagnostics

Pathology and laboratory reporting

A suitably associated pathologist may review and remotely authenticate laboratory or pathology reports where the necessary information is available and the applicable legal requirements are satisfied. The doctor remains responsible for the professional judgment represented by the authentication.

Radiology and diagnostic interpretation

Remote review can support reporting arrangements in which specialists work across locations. The advisory clarifies that physical absence from the facility does not, by itself, prohibit authentication. The doctor must still have the information necessary to make the relevant professional assessment.

Telemedicine and discharge documentation

Electronic authentication can support remote workflows for discharge summaries and other clinical documents. It does not replace any examination, consultation, verification or documentation required by applicable rules or professional standards.

Paperless healthcare operations

Appropriate electronic authentication may reduce avoidable printing, physical document movement and administrative delays. However, a faster workflow is not necessarily a safer one. Hospitals must ensure that records are complete, access is properly controlled and doctors have sufficient time and information to review documents before signing.

Practical Compliance Checklist

For doctors

• Review the clinical information and investigations required to form a professional opinion.
• Do not authenticate a document when the available information is inadequate.
• Keep signing credentials and authentication tokens under personal control.
• Never allow another person to sign using your credentials.
• Authenticate records only within a lawful professional engagement.
• Report suspected credential compromise or unauthorised use promptly.

For hospitals and diagnostic facilities

• Verify RMP registration and maintain appointment, contract or empanelment records.
• Review remote authentication workflows across EMR, EHR, LIS, RIS and PACS systems.
• Maintain appropriate audit trails, authentication logs and date and time stamps.
• Implement role-based access controls and cybersecurity safeguards.
• Protect the confidentiality and integrity of patient information.
• Retain medical records and associated logs for the period prescribed by applicable law.
• Establish procedures for incomplete reports, corrections and suspected credential misuse.
• Document foreign expert opinions appropriately and ensure they are not treated as independent certification by an unauthorised practitioner.
• Train clinical, administrative and IT teams on their respective responsibilities.

Frequently Asked Questions

1. Can a doctor sign a medical report while working from home?

Yes, remote authentication is not prohibited merely because the doctor is working away from the facility. The RMP must be authorised, professionally associated with the establishment as required, have lawful access to the records and review the information necessary to form a professional opinion.

2. Can a hospital assistant use a doctor's digital signature?

No. The NMC advisory requires the doctor's signing credentials and authentication mechanisms to remain under the doctor's control. They must not be shared, delegated or transferred to another person.

3. Can a doctor sign a report without reviewing the underlying clinical information?

No. The doctor must review the relevant information, records and investigations reasonably necessary to form a professional opinion. If information is inadequate, authentication must wait until the necessary review or verification has been completed.

4. Is a scanned signature legally the same as a digital signature?

Not automatically. The Information Technology Act distinguishes digital signatures from electronic signatures and sets requirements for legally recognised authentication. A scanned image of a handwritten signature should not be assumed to meet those requirements in every situation.

5. Can an RMP authenticate reports from any hospital or laboratory?

No. The advisory addresses reports from establishments with which the RMP is duly appointed, empanelled, contracted or otherwise professionally associated, subject to lawful professional engagement and access to the relevant records.

6. Can a foreign doctor independently certify a medical report in India?

A foreign medical expert may provide a remote consultation or second opinion that the Indian treating team considers in accordance with applicable law. The opinion does not itself authorise the foreign expert to certify an Indian medical record or practise medicine in India.

7. What happens if a digital signing credential is compromised?

The concerned RMP should promptly report suspected compromise or unauthorised use under applicable institutional and legal requirements. Appropriate corrective measures should follow, including securing the affected credentials and investigating relevant authentication events.

8. How long must hospitals retain digitally authenticated records?

The advisory requires healthcare establishments to retain electronically authenticated records and related authentication and audit logs for the period prescribed under applicable law. The specific retention period should be determined according to the laws and requirements applicable to the facility and record type.

9. Does the NMC advisory replace the Telemedicine Practice Guidelines, 2020?

No. The advisory clarifies remote authentication within the existing legal framework. The Telemedicine Practice Guidelines, 2020 and other applicable laws continue to apply.

10. Does the advisory make all electronic signatures valid for every medical document?

No. The authentication method must be recognised under the applicable legal framework, and all relevant requirements must be satisfied. The advisory does not mean that every electronic approval, typed name or scanned signature automatically qualifies as a legally recognised digital or electronic signature.

Conclusion

The NMC's October 13, 2026 advisory clarifies that authorised registered medical practitioners can remotely review and authenticate eligible medical records using recognised digital or electronic signatures. The clarification supports electronic healthcare workflows while retaining the safeguards required for patient safety and professional accountability.

For doctors, the essential requirements are adequate clinical review, independent professional judgment, secure signing credentials and a lawful professional association with the healthcare establishment. For hospitals and diagnostic facilities, the priorities are secure records, traceable authentication, appropriate access controls and compliance with record-retention and data-protection requirements.

Remote authentication should be treated as a clinical governance responsibility, not merely a software feature. Its benefits depend on the quality of the review, the security of the signing process and the accountability of everyone involved.

Primary source: National Medical Commission, Public Notice No. R-19022/25/2026/Ethics, dated October 13, 2026 (PDF).

Disclaimer: This article is for general information and does not constitute legal advice. Healthcare establishments should assess their obligations under the laws applicable to their operations.