Informed consent in clinics: when it must be in writing and how to sign it on a tablet

3 October 2026 · 5 min read

Informed consent usually causes trouble on the day it is needed: a complaint arrives months later and the paper cannot be found, turns up undated, or turns up signed on a template that is no longer the one in use. Moving it to a tablet solves half the problem. The other half is knowing what has to be recorded for that signature to be worth anything.

What the law says

The reference rule in Spain is Law 41/2002 on patient autonomy. Its basic rules:

• Before any procedure, the patient must give their voluntary consent, without pressure, after receiving adequate information (art. 8.1).
• As a general rule it is verbal, but it must be in writing for surgical procedures, invasive diagnostic and therapeutic procedures and, in general, procedures that involve risks or drawbacks with a notable and foreseeable negative impact on health (art. 8.2). In a dental or aesthetic medicine clinic, that is a good part of what is done every day.
• Before asking for the signature, the patient must be told about the relevant consequences of the procedure, the risks related to their circumstances, the probable risks under normal conditions and the contraindications (art. 10.1).
• The patient can withdraw it in writing at any time (art. 8.5).
• It is part of the medical record (art. 15) and must be kept for at least five years from discharge for each episode of care (art. 17.1).

For minors, the law itself sets out who consents and when the patient must be heard (art. 9). If you treat minors, the form must also collect the details of the legal representative. And check the rules of your autonomous community: several have their own regulations on clinical documentation.

Is a signature on a tablet valid?

Law 41/2002 asks for consent in writing, not on paper. And the European eIDAS Regulation states that an electronic signature shall not be denied legal effect or admissibility as evidence in legal proceedings solely on the grounds that it is in electronic form (art. 25.1).

What must be clear is what kind of signature it is. Signing with a finger on a screen is a simple electronic signature: on its own it presumes nothing. If someone challenges it, it is proven with what comes with it. That is why what matters is not the stroke but what is recorded around it.

What has to be recorded

With these six elements, a tablet signature holds up:

1. The exact text that was signed, frozen. If the consent template changes next month, this patient's consent must still say what they read. A cryptographic fingerprint of the text (SHA-256) proves it has not been touched.
2. Who signed. Their name and ID number, checked by the patient before signing. And, better still, a code by SMS to their mobile: typing it in proves the phone is theirs.
3. That they read it: the full text on screen and a box such as “I have read and understood the consent and I accept it”, without which it cannot be signed.
4. When: the date and time of the signature.
5. The signature, stored together with everything above.
6. A copy for the patient, who has a right to it. An SMS with the link to their receipt, or an email with the PDF, solves it without printing anything.

If in some case you need more than that —a treatment that often ends in a complaint, for example— you can add a certified communication with an evidence certificate and a qualified time stamp.

How it works at reception

1. Reception registers the patient —mobile, name and, if they have them, their ID number and date of birth— and chooses the consent: implant, root canal, whitening, botulinum toxin… Each one is prepared once and used for every patient.
2. The signature appears on the reception tablet or is opened with a QR code. The patient checks their details, reads the text, ticks the box and signs with a finger.
3. The tablet stays on “Signed”, with no data, no downloads and no going back: the next patient sees nothing of the previous one.
4. The clinic keeps the PDF receipt, with the text, the date, the details, the signature and its fingerprint, to file in the patient's record.

If the patient prefers to read it calmly at home —a good idea for long or expensive treatments— the link is sent by SMS and they sign from their own mobile, with the same process.

Health data: three precautions

• Nothing clinical in the SMS. The title of the consent travels in the messages and shows on the phone's lock screen: “Informed consent”, not “Dental implant consent”. The same goes for appointment reminders.
• Data processing agreement. Whoever stores the consents for you is processing health data, which the GDPR protects specially (art. 9): they must sign a data processing agreement with the clinic (art. 28) and say where the data is and how it is protected.
• Encryption and expiry. The data and the PDFs should be encrypted on disk too, each patient's link should be personal and expire, and each clinic should see only its own.

The mistakes that keep happening

• A single generic consent for everything. The information has to be that of the specific procedure (art. 10): one template per treatment.
• Signing without being able to read. A signing screen with the text in a separate link invites people to sign without opening it. The full text, on the same screen as the signature.
• Losing which version was signed. If the PDF is generated when someone asks for it rather than at signing, what you show a year later is that day's template, not the one the patient signed.
• The tablet still showing the previous patient's details. A form left open with a name and ID number is a health data breach at the front desk.
• Not giving a copy. Without a copy, the patient cannot check what they signed, and will say so on the day of the complaint.

What it costs to do it this way

At SMSverifica there is no monthly fee, no licence per tablet and no charge per user: each signed consent is €0.10 and each SMS to a Spanish mobile is €0.039 (before VAT). If the patient does not sign, the signature is not charged.

Everything a clinic asks before getting started —validity, data protection and price compared with other solutions— is on the page on informed consent signing for clinics (in Spanish), and the step-by-step setup, with a dental clinic example, in document signing on a tablet.

← All articles