Remote Authentication of Medical Records: NMC Guide

On 13 October 2026, the National Medical Commission’s Ethics and Medical Registration Board issued a public notice that settles a long-running grey area: remote authentication of medical records through digital or electronic signatures. A registered doctor can now review and sign off lab reports, radiology interpretations and discharge summaries without being physically present at the facility, provided the signature is legally recognised and the doctor has actually reviewed the case.

The permission comes with conditions on clinical review, credential control and audit trails. This guide explains what the NMC said and what clinics should check in their own systems.

What the NMC advisory on remote authentication of medical records says

The notice, numbered R-19022/25/2026/Ethics and signed by NMC Secretary Dr Raghav Langer, is published on the NMC website as a public notice with an annexed advisory.

The NMC gives two reasons: establishments had developed divergent practices that left remote sign-off uncertain, and the High-Level Committee on Non-Financial Regulatory Reforms had recommended easier use of digital and electronic signatures in medical practice, in line with the Information Technology Act, 2000.

The core clarification is short. Nothing in the NMC Act, 2019, its regulations or the Telemedicine Practice Guidelines, 2020 prohibits a Registered Medical Practitioner (RMP) from remotely reviewing and authenticating:

• laboratory and pathology reports
• radiology reports and diagnostic interpretations
• discharge summaries
• other electronic clinical documents

The signature must be a digital signature, electronic signature or electronic authentication technique recognised under the IT Act, 2000 and its rules. The advisory names the systems it has in mind: hospital information systems, EMR and EHR platforms, laboratory and radiology information systems, PACS and telemedicine platforms. Medical Dialogues reported the notice on 13 October 2026, the day it was issued.

The conditions: review first, sign second

Review is mandatory. Clause B says remote authentication may happen only after the doctor has reviewed the clinical information, records and investigations needed to form a professional opinion. If the information is not enough, the doctor must hold off until further review or verification is done. Rising Kashmir’s 24 October report summarised this as authentication not being a routine or mechanical exercise.

A signature does not shift responsibility. Clause C states that the signature is only the mode of authentication. It does not reduce the doctor’s professional, ethical or legal responsibility, and it does not absolve the organisation of its own obligations.

Credentials belong to the doctor alone. Clause J says signature-creation data, authentication credentials and access tokens must stay under the control of the doctor concerned. They must not be shared, delegated or transferred, and any suspected compromise must be reported promptly.

Only within a real professional relationship. Under clause E, a doctor may remotely sign reports from an establishment where they are appointed, empanelled, contracted or otherwise professionally associated, and only with lawful access to the records. The advisory creates no independent right to practise.

Foreign opinions are input, not certification. Under clause F, a foreign expert’s documented second opinion does not certify an Indian medical record. Clause I adds that the advisory is clarificatory and relaxes no existing requirement.

What healthcare establishments must now maintain

Clause D is aimed at hospitals, clinics, labs and imaging centres. Establishments must keep electronic records with appropriate security measures, audit trails, authentication logs, and date and time stamps, so that authenticated records remain intact, confidential and traceable. Records and their authentication and audit logs must be retained for the period prescribed under applicable law.

The same clause also requires compliance with data protection, privacy, information security and cybersecurity rules for personal health information. That links this advisory to the Digital Personal Data Protection framework. The dpdprules.org commencement tracker lists the Consent Manager provisions for 13 November 2026 and the main obligations for 13 May 2027. It marks both as computed dates still awaiting official confirmation.

In plain terms, a clinic that lets doctors sign remotely should be able to answer three questions for any report: who signed it, when, and from what review of which records.

What counts as a recognised signature

The advisory does not name a product or method. It points back to the IT Act. Two familiar routes exist in India. The first is a Digital Signature Certificate (DSC) from a Certifying Authority licensed by the Controller of Certifying Authorities, with the key traditionally held on a hardware token. The second is eSign. According to the Controller of Certifying Authorities’ eSign page, the signer authenticates through e-KYC, only the document’s hash is sent for signing, the signature is created on a hardware security module, and the one-time key is destroyed after use, with an audit trail kept.

A scanned image of a signature pasted onto a PDF is neither of these. Clinics using image signatures should check with their vendor and legal adviser whether their method meets the IT Act requirement.

Why it matters for patients beyond the metros

Industry bodies see this as an access measure as much as a technical one. VOH Network reported on 22 October 2026 that NATHEALTH welcomed the advisory. Its president, Dr Sangita Reddy, said it could improve access and efficiency while protecting clinical judgement and patient safety. Its treasurer, Shankha Banerjee of Dr Lal PathLabs, said it resolves long-standing uncertainty and could shorten report turnaround and widen diagnostics where specialists are scarce.

The InstaDataHelp blog has covered teleconsultation and verified prescriptions before. This advisory extends the same digital-first logic to diagnostic and discharge documents.

A checklist for clinics and diagnostic centres

Before you allow remote sign-off, work through these points with your doctors and IT team:

• Confirm the signature method is a DSC, eSign or another technique recognised under the IT Act, not a scanned image.
• Give every doctor individual credentials. No shared logins, no front-desk staff signing “on behalf of” a doctor, and no signature tokens left in a common drawer.
• Make full records visible before signing. The remote doctor should see the images, values and history needed to form an opinion, not just a summary.
• Turn on audit trails that record who accessed and authenticated each record, with date and time stamps, and keep them for the legally required period.
• Document the professional relationship with every remote signatory: appointment, empanelment or contract.
• Write an incident procedure for lost tokens or suspected credential misuse.
• Record foreign second opinions in the patient record as opinions, never as certification.
• Review your data-protection posture, especially if records or AI tools are hosted outside your own systems.

How InstaPraxis supports accountable digital records

InstaPraxis is a unified clinic OS for Indian doctors and clinics, covering booking, video consultation, AI scribe, prescriptions, pharmacy and billing. It is not a laboratory or radiology reporting system, and it does not replace a DSC or eSign. Its QR verification is a tamper-evidence check, not an IT Act signature in itself. What it offers is a consultation workflow built around the same principles the NMC emphasises:

• Verified doctors. Doctor onboarding requires degree, ID, signature and photo uploads, which go to an admin approval queue.
• Review before finalising. The AI scribe drafts the note, and each line is matched to the consultation transcript. Examination findings that the transcript does not support must be confirmed by the doctor or removed before the prescription can be finalised. The scribe supports 22 Indian languages plus English, with Hindi, English and Hinglish tested most.
• Locked, verifiable prescriptions. Prescriptions move from draft to finalised (locked) to revised. Every page carries a QR code linked to a content hash and a public verification page, and the PDF states whether the consultation was in person or by video.
• Audit logging and account safety. Clinical record reads, account changes and doctor access to patient scans are audit-logged. Passwords are hashed, login limits apply per account, and a warning appears if another browser tab signs in as a different user.
• AI that proposes, humans decide. Three AI assistants, one each in the patient, doctor and clinic dashboards (the clinic one also covers pharmacy), see only what their user may see and ask for confirmation before changing data. None of them writes prescriptions. The 10 AI health scans are wellness and screening aids, not diagnosis, and the camera vital scan measures heart rate, HRV and breathing rate only.
• Data handling. Patient records stay on InstaDataHelp servers, and text sent to generative AI is masked first.

ABDM integration is on the InstaPraxis roadmap. Pricing is ₹399 per doctor per month.

Frequently Asked Questions

What did the NMC clarify on 13 October 2026?

The NMC’s Ethics and Medical Registration Board clarified that nothing in the NMC Act, its regulations or the Telemedicine Practice Guidelines, 2020 prohibits a registered doctor from remotely reviewing and authenticating lab, pathology and radiology reports, diagnostic interpretations, discharge summaries and other electronic clinical documents, using a signature recognised under the IT Act, 2000.

Can a doctor sign reports remotely without reviewing them?

No. The advisory requires the doctor to review the relevant clinical information and exercise independent judgement first, and to withhold authentication if the information is inadequate. The signature does not reduce the doctor’s professional, ethical or legal responsibility.

What must clinics and hospitals do under the advisory?

Establishments must keep electronic records with security measures, audit trails, authentication logs and date and time stamps, retain records and logs for the period required by law, and comply with data-protection and cybersecurity requirements. Signature credentials must stay under each doctor’s sole control.

Does InstaPraxis provide digital signatures under the IT Act?

InstaPraxis does not replace a Digital Signature Certificate or eSign. It verifies doctors at onboarding, requires review before a prescription is finalised, locks finalised prescriptions with a QR code and public verification page, and audit-logs clinical record access.

Sources

• National Medical Commission: public notice and advisory on remote authentication of medical records (13 October 2026)
• Medical Dialogues: NMC issues advisory for doctors on remote authentication of medical records via digital signatures (13 October 2026)
• Rising Kashmir: NMC clears remote authentication of medical records (24 October 2026)
• VOH Network: NATHEALTH welcomes NMC’s move on remote authentication of medical records (22 October 2026)
• Controller of Certifying Authorities: how the eSign online electronic signature service works
• dpdprules.org: DPDP Act and Rules commencement timeline

The NMC has made remote sign-off legitimate, but only for clinics that can show who reviewed what, and when. To see how InstaPraxis keeps consultations, prescriptions and records accountable for ₹399 per doctor per month, write to info@instadatahelp.com.