NMC Remote Authentication Advisory 2026: What It Means for a Solo OPD Clinic

On 13 October 2026, the National Medical Commission's Ethics and Medical Registration Board issued Public Notice No. R-19022/25/2026/Ethics, titled "Clarification regarding Remote Authentication of Medical Records through Digital/Electronic Signatures". News coverage since 13 October has put it in front of many doctors.

Most of the talk is about labs, radiology and large hospitals. This guide asks a smaller question: if you run a one doctor OPD, what does the advisory change for you, and is it a good moment to move your notes and prescriptions off paper?

This is a general guide, not legal advice. Points marked "our reading" are our interpretation and are awaiting a legal read. Dr. Sayan Pandit is reviewing this page, and it has not been signed off yet.

What the NMC advisory says, in plain words#

The core line is clause A of the advisory:

"It is clarified that there is no prohibition under the National Medical Commission Act, 2019, the Regulations framed thereunder or the Telemedicine Practice Guidelines, 2020 of EMRB, NMC against the remote review and authentication of laboratory reports, pathology reports, radiology reports, diagnostic interpretations, discharge summaries and other electronic clinical documents by a Registered Medical Practitioner (RMP) through a Digital Signature or other Electronic Signature or electronic authentication technique recognised under the Information Technology Act, 2000 and the rules made thereunder, as applicable."

The rest of the advisory sets the conditions around that line:

• Review first (clause B). Authentication should happen only after the doctor has reviewed the relevant clinical information and used independent professional judgment. If the information is inadequate, the doctor "shall refrain from authentication" until more is available.
• Responsibility stays with you (clause C). The signature is "only the mode of authentication" and does not reduce the doctor's professional, ethical or legal responsibility.
• Records need safeguards (clause D). Healthcare establishments should keep "audit trails, authentication logs, date and time stamps" and retain records and logs for the period the law prescribes, along with data protection and cybersecurity requirements.
• A real professional link (clause E). The doctor should be appointed, empanelled, contracted or otherwise professionally associated with the establishment and have lawful access to the records.
• Foreign experts (clauses F and G). A foreign expert's opinion can be considered by the treating team, but this gives no right to practise in India.
• Other laws still apply (clauses H and I). The advisory names, among others, the IT Act, the DPDP Act and the Clinical Establishment Act, and says it creates no new statutory right.
• Your credentials are yours alone (clause J). Signatures, credentials and access tokens "shall not be shared, disclosed, delegated, transferred".

The doctor reviews the record, finalises it with their own credentials, and a time stamp and log are kept.

What it means for a solo OPD: our reading#

It is a clarification, not a new duty. Nothing in the notice tells a small clinic to buy software or go paperless by a date. If your paper register works for you today, the advisory does not change that.

The list does not name prescriptions or OPD notes. Clause A lists lab, pathology and radiology reports, diagnostic interpretations, discharge summaries and "other electronic clinical documents". Whether a prescription or a consultation note sits in that last group is not stated. Our reading is that it is a broad phrase, but a legal read is needed before treating it as covering prescriptions.

The habits it describes are good OPD habits anyway. Review before you sign. Do not let anyone else use your login. Keep a record of when a note was finalised. These matter whether you sign on paper, on a screen in your chamber, or remotely.

If you report for a lab or diagnostic centre, clauses B, E and J are the ones to read closely. Many OPD doctors also read ECGs or reports for a nearby centre, and the advisory speaks directly to that work.

If you sign reports for a lab or diagnostic centre (our reading)#

Many OPD doctors also read ECGs, X-rays or lab reports for a centre nearby, often from home in the evening. That is the work the advisory speaks to most directly. Before you sign the next one remotely, these are the questions it raises:

• Is there a written arrangement? Clause E expects you to be appointed, empanelled, contracted or otherwise professionally associated with the establishment, with lawful access to the records. A WhatsApp group with the lab owner is not the same as a letter of empanelment. Ask for one.
• Did you see enough to decide? Clause B says you should authenticate only after reviewing the relevant clinical information and using your own professional judgment. If an ECG arrives without age, symptoms or a usable tracing, the advisory says you "shall refrain from authentication" until more is available.
• Whose credentials are on the report? Clause J says signatures, credentials and access tokens shall not be shared, delegated or transferred. If a technician signs in as you to release reports faster, that is the practice the clause rules out.
• Who keeps the log? Clause D puts audit trails, authentication logs and date and time stamps on the healthcare establishment. Ask the centre how it records which report you signed and when, and how long it keeps that record.
• Is your responsibility any smaller? No. Clause C says the signature is only the mode of authentication, so a remotely signed report carries the same responsibility as one signed at the centre.

None of this needs new software on your side. It needs a short conversation with the centre, and a copy of the arrangement on file.

Five first steps to move notes and prescriptions off paper#

None of these needs a big switch. Each is a small change you can try in one OPD session.

1. Start with the prescription. It is the document patients carry and come back with. A printed or PDF prescription that shows your name, qualification and registration number is easier to read and easier to keep a copy of. Our guide on how to create a digital prescription walks through the format, and its signing section already covers this advisory.
2. Keep one record per patient, not per visit. Whatever tool you use, make sure the next visit opens with the last one in view. Our post on maintaining patient history digitally covers this.
3. Give every person their own login. If a receptionist helps with entry, give them their own account. This lines up with the spirit of clause J and keeps it clear who did what.
4. Check that your registration details are correct. Your registration number on the prescription should match the register. See how to verify a doctor registration number and how to get your NMR ID.
5. Ask your software how records are kept. Ask whether it records when a note was finalised and by whom, how long records are kept, and how you can export them. The DPDP Act guide for clinics lists more questions worth asking.

If you are still weighing paper against a screen, our comparison of paper vs digital medical records sets out the trade-offs.

A note on "signing" in clinic software#

Many clinic apps, including Medabha's prescription software, let you finalise a visit and place a drawn image of your signature on the prescription. Our reading is that this is not the same as a digital signature or an electronic authentication technique recognised under the IT Act, which is what the advisory refers to. If you need IT Act authentication for reports, ask your provider exactly which method it uses, and get a legal view on whether it fits your case. The digital prescription guide sets out the difference between a pen signature, a drawn image and a Digital Signature Certificate.

A real Medabha printed prescription, made for a demo patient and a demo doctor. It carries the doctor's registration number and council, and the body chart marked during the visit. Finalising the visit is what produced it; that step is not an IT Act digital signature.

Related reading#

• NMC advertising guidelines 2026 for clinics
• HPR registration for doctors
• How doctors can digitise their clinic

Source: NMC Public Notice No. R-19022/25/2026/Ethics, dated 13 October 2026, PDF, read in full on 20 October 2026.