The Legal Position of Health Tourism Intermediaries in Türkiye: Authorisation and Allocation of Responsibility

A health tourism intermediary and the clinic it works with are licensed by two different authorities, and their responsibilities are divided by function rather than shared. Under Article 5/1 of the International Health Tourism and Tourist Health Regulation, published in the Official Gazette of 26 April 2025, No. 32882, an authorisation certificate is compulsory for both, but it is issued by the Ministry of Health for a health facility and by USHAŞ for an intermediary organisation. Article 6/3 then allocates responsibility between them “according to the type of service supplied”. Everything the regulation does not settle — recourse, indemnity, data roles, what happens when a certificate is suspended — falls back on the Turkish Code of Obligations and on whatever the parties wrote down.

That is a narrower framework than most commercial parties expect, and the gap is not academic. This is the layer of health tourism that sits underneath the patient-facing questions covered in the legal guide to medical tourism in Türkiye: not what a patient can do, but how two businesses divide a regulated activity between themselves.

Two certificates, two authorities

The 2025 regulation repealed the 2017 instrument outright (Article 17) and rebuilt the authorisation architecture around a split. The Ministry route for a facility runs through the provincial or district health directorate and the EKİP platform; the intermediary route runs to USHAŞ directly, with its own application annex and its own on-site inspection.

USHAŞ’s role is not that of a private certification body. It was established by Additional Article 2 of Decree-Law No. 663, which lists “issuing authorisation certificates to organisations carrying on intermediary activity in the field of international health services” as its first stated object, and Additional Article 2/5 vests all of its shares in the Ministry of Treasury and Finance while placing the voting, management, representation and audit rights with the Ministry of Health. When a commercial counterparty asks who supervises the intermediary, the honest answer is a state-owned company acting under a statutory mandate.

The perimeter around the activity is drawn by Law No. 3359. Additional Article 11/1, as amended in February 2024, provides that all acts and transactions relating to the supply of health services are supervised by the Ministry of Health and adds, in a sentence written for this sector, that the provision covers the activities of every kind of organisation within the scope of international health tourism. Additional Article 11/2 then makes those who supply or cause to be supplied health services without a licence or authority liable to imprisonment of one to three years and a judicial fine — an offence from which the paragraph carves out only emergency care given in extraordinary circumstances by practitioners entitled to practise, until emergency services arrive — wording broad enough that any arrangement pushing an intermediary towards clinical decision-making deserves careful review rather than optimism. The administrative fine figures written into the statute are the nominal amounts in force when it was enacted; the amount actually applied comes from the annual revaluation communiqué, which is where the current figure has to be checked.

Nor is an authorisation certificate a document obtained once and filed away. Articles 9/1 and 9/2 subject both kinds of organisation to a performance evaluation against the criteria in Annex 2, carried out by USHAŞ at least once a year; an organisation assessed as partly adequate or inadequate is re-checked within three months, and if the shortfall persists the certificate is suspended for three months in the case of partial adequacy and six months in the case of inadequacy, with cancellation if a second check within three months of the end of the suspension also fails. Article 16 adds independent grounds: six months’ suspension for records not properly kept, cancellation if the same act is repeated within a year, and cancellation of the certificate of an organisation that has not carried on health tourism activity for a year. A counterparty whose certificate is valid today is not a counterparty whose certificate is valid for the life of the contract.

What Article 6/3 actually allocates — and what it leaves open

Article 6/3 is the pivot of the whole framework, and it is one sentence long plus a rider (translated from the Turkish text):

The health facility and the intermediary organisation are responsible, according to the type of service supplied, for the health services and intermediary services the international health tourist receives during their stay in our country. Complications and adverse medical practice that may arise following the health service supplied are also within the scope of this responsibility.

Three things follow. First, the criterion is functional: what each party supplied, not who signed the patient up. Second, the rider extends the allocation past discharge, so a schedule of services that stops at the airport transfer is incomplete. Third — and this is what parties most often miss — Article 6/3 says nothing at all about recourse between the clinic and the intermediary. It faces outward. The inward-facing question of who ultimately bears a loss is contract law, and the drafting of that allocation belongs with the wider discipline of commercial contracts.

Two operational provisions sit alongside it and shift risk in a way that surprises clinics. Article 6/1(e) prohibits a health facility from procuring, from persons or organisations without an authorisation certificate, any service that an intermediary organisation is required to perform. That converts the counterparty’s regulatory status into the clinic’s own compliance problem, which is why certificate verification belongs in the contract as a continuing warranty rather than a one-off document check. And Article 6/2(c) provides that personnel assigned to international health tourism services may not work for more than two intermediary organisations at once — a staffing constraint with obvious implications for exclusivity and confidentiality drafting.

Where the general law fills the gap

Because the regulation is silent on recourse, the Code of Obligations No. 6098 does the work. The intermediary’s undertaking is a work-performance obligation, and Article 502/2 applies the mandate provisions, so far as their nature permits, to work-performance contracts not separately regulated in the Code. From there:

• Personal performance and sub-delegation. Article 506/1 requires a mandatary to perform personally unless authorised, or unless necessity or usage permits delegation. Article 506/2 and 506/3 impose loyalty and care measured against the standard of a prudent mandatary undertaking similar work — a standard reinforced in a commercial setting by Article 18/2 of the Commercial Code No. 6102, which requires every merchant to act as a prudent businessperson in all its trading activity.
• The sub-contract chain. Article 507 draws a sharp line. A mandatary who delegates outside its authority answers for the sub-contractor’s act as if it were its own; one who is authorised to delegate answers only for care in selecting and instructing. Whether the contract authorises delegation is therefore not boilerplate.
• Auxiliaries. Article 116/1 makes a debtor answerable for damage its auxiliaries cause the other party in the course of the work. Article 116/2 permits that liability to be excluded wholly or partly by prior agreement — and then Article 116/3 voids such an exclusion absolutely where the service or profession may only be carried on under a permission granted by law or by the competent authorities. Reading the first paragraph without the third produces confident advice and an unenforceable clause.
• Burden of proof. Article 112 makes a debtor liable for the loss caused by non-performance or defective performance unless it proves that no fault is attributable to it. That presumption of fault favours whichever party can document how performance actually ran, which turns the recording of service steps, instructions and handover points into an evidential choice rather than an administrative one.
• Termination. Article 512 lets either party end a mandate at any time, but makes the party who ends it at an inopportune time liable for the loss that causes. A clause providing for notice-free termination does not displace that.

There is also a classification question worth confronting early. If an intermediary continuously brokers contracts for a particular clinic in a defined territory, the arrangement may edge towards the agency definition in Article 102/1 of the Commercial Code — with the consequence that the portfolio indemnity in Article 122 becomes arguable on termination, a right that Article 122/4 says cannot be waived in advance and must be asserted within one year. Article 102/3 expressly reserves special rules for tourism, so nothing here is automatic; the classification depends on the actual terms. But it is precisely the risk mapped out for distribution networks in the analysis of termination and portfolio indemnity under Article 122, and a health tourism contract drafted without reference to it is drafted blind.

Promotion: the narrowest constraint in the framework

Article 13/1 of the 2025 regulation applies the Regulation on Promotion and Information Activities in Health Services to facilities and intermediaries alike. That reference has moved: the 29 July 2023 instrument it names was repealed by Article 13/1 of the new Regulation on Promotion and Information Activities in Health Services (Official Gazette of 12 November 2025, No. 33075), which came into force on publication and provides that references to the repealed text are deemed made to it. Article 2/1 of the new instrument names international health tourism intermediary organisations in its scope alongside health professionals and private health establishments.

Three rules matter commercially. The chapeau of Article 5/1 prohibits covert and open advertising in the supply of health services — both carrying it out and causing it to be carried out, so outsourcing does not cure it. Article 5/1(f) prohibits promotion whose content steers the patient, directly or indirectly, to a health professional or health institution, and Article 5/1(g) prohibits steering to a named health professional or facility through publication and communication channels for reasons such as consultancy or information provision. Article 5/2 makes those who share non-compliant content equally responsible with those who produce it, which places ordinary social-media activity squarely inside the risk.

Article 8 then carves out a distinct regime for the health tourism sector, and it is more permissive than the general rules rather than less. Sponsored promotion in official languages other than Turkish is allowed on a separate outward-facing site or social channel; the authorisation certificate must be published on that channel; targeting people living in Türkiye is forbidden and automatic audience definitions must be switched off; and discount, campaign and competitive-price announcements are permitted under Article 8/3 for facilities and intermediaries acting within Article 8/1(a) and (g). For the intermediary specifically, Article 8/1(g) allows sponsored promotion provided it stays within the intermediary services defined in the legislation and does not suggest the supply of health services or give the impression of being a health facility, and Article 8/1(ğ) allows it to share the service it brokers, the names of the facilities and their official websites for information purposes, provided it states that the service is supplied by the facility and that it is not itself a facility. Article 8/1(h) requires the intermediary’s URL to carry its trade name, business name or an abbreviation of them.

Sanctions are in Article 12. For facilities and international health tourism intermediaries, the administrative sanctions in the Promotion and Information Activities Administrative Sanction Form at Annex 2 are applied under Article 12/1(a), on the basis of Additional Article 11(5) of Law No. 3359; Article 12/1(d) adds a referral to the Advertising Board and a criminal complaint where the promotion is traced to unauthorised, unpermitted or unlicensed supply of health services.

Data, records and the paperwork that follows the patient

An intermediary handles identity documents, treatment plans and correspondence, all of which are health data. Under Article 6/1 of Law No. 6698 that is special category personal data; Article 6/3 makes processing prohibited except on the listed grounds, and Article 6/4 requires the adequate measures determined by the Board in addition. The provision that decides the commercial allocation is Article 12/2: where data is processed on the controller’s behalf by another person, the controller is jointly responsible with that person for the security measures. Contracts that leave the controller/processor question implicit are leaving a joint responsibility unallocated.

The regulation’s own record duties run in parallel. Article 8/4 requires both parties to join the HealthTürkiye Portal and enter data completely, accurately and currently; Article 8/5 requires all service units established for health tourism purposes, in Türkiye or abroad, to be notified through the Portal; and Article 8/6 requires the intermediary to register on the Portal every member of staff assigned to international health tourism services, at least one of whom is designated as the responsible person. On the invoicing side, Article 12/1(b)(1) obliges the intermediary to provide, at no charge on request, an itemised breakdown of the fees charged for accommodation, transport, transfer, interpreting and consultancy. Pricing is only partly free: Article 11/1 provides that the price of the health service supplied within international health tourism is set by the Ministry, and Article 11/2 obliges the facility to comply with that tariff, so a contract that lets the intermediary quote an all-in figure needs to keep the two components distinguishable.

Finally, the travel leg. Article 6/2(a) requires accommodation, transport and transfer to be delivered through travel agencies authorised under Law No. 1618 — whose Article 4 makes an operating certificate from the Ministry of Culture and Tourism compulsory for travel agency activity, and whose Article 3 groups agencies, with group (A) covering the full range of services. The following sentence supplies the alternative: the intermediary may perform those services itself if it is an authorised agency. Which of the two routes applies is a fact to be recorded, with evidence, in the contract.

Where these threads meet is the point of the exercise. The regulation licenses two parties separately, divides their responsibility by function, and leaves the commercial consequences to them. Reviewing such an arrangement means reading a schedule of services as a liability map, checking a certificate as a continuing condition, and drafting for the day one of the two certificates is suspended — work that sits at the intersection of health law and ordinary commercial contracting, and which is far harder to do after the arrangement has started running than before.

The authorisation and contracting questions above sit inside the framework described under health tourism regulatory compliance.