Consent to recording the consultation: a template to fill in
Recording a consultation in order to produce a documentation draft needs two things: the agreement of every person who speaks to the recording itself, and explicit consent to processing health data. This page carries a template that brings both together in one declaration, names the fields every practice has to fill in itself, and gives the provision each building block comes from. As far as we can tell there is no official model declaration for audio recording in a German practice.
Reviewed editorially against product behaviour and the stated primary sources; not individual medical or legal advice.
This overview is general information and not legal advice. Every practice has to check the legal basis, the information given, the consent process and its data protection measures for its own use with its legal or data protection advice.
What the template is made of
Under Art. 4(11) GDPR, consent is a freely given, specific, informed and unambiguous indication of wishes. From that definition and from Art. 7 GDPR follow the four properties on which a template can fail: it has to be intelligible, it has to be clearly distinguishable from other declarations, it has to announce the right to withdraw before it is signed, and the practice has to be able to demonstrate later that it was given.
Because a consultation involves health data, Art. 9(2)(a) GDPR is added: consent has to be explicit. A pre-ticked box, silence or simply reading on does not do it; that is why the template carries its own box to tick and sign.
The recording itself is a second question, and not a data protection one. § 201 of the German criminal code makes it an offence to record the non-public spoken word of another person without authorisation. "Without authorisation" falls away with the agreement of the person recorded — and everyone who speaks is recorded.
The template
The text below is meant to be taken over. Everything in square brackets is a field the practice replaces; none of it may be left standing. The heading belongs to it: the declaration has to be recognisable as its own sheet or a clearly separated section, and not disappear into the treatment contract. The German page carries the wording to use with German-speaking patients.
Consent to the audio recording of the conversation and to the processing of the health data arising from it
The controller is [name of the practice], [address], [telephone], [email]. [If there is one: our data protection officer can be reached at …]
Purpose: the conversation is recorded in order to produce a draft for the treatment record. The draft is reviewed before it is taken into the patient record and is the responsibility of the treating physician. The recording replaces no medical judgement.
Legal basis: Art. 6(1)(a) and Art. 9(2)(a) GDPR — your explicit consent. The recording itself additionally requires your agreement under § 201 of the German criminal code; you give that with this declaration too.
Who receives the data: [describe the actual path here. Example: the recording stays on a computer in the practice and is not transmitted. The text of the conversation is transmitted to [name of the provider], with whom a processing agreement under Art. 28 GDPR is in place.] [If there is a transfer to a third country: name the country and the safeguard under Art. 44 et seq. GDPR. If there is none, say so.]
How long it is kept: [name two periods: one for the recording and one for the text. Example: the recording is deleted as soon as the documentation is confirmed; the text is deleted after ….] The treatment record itself is subject to the statutory retention periods regardless of this.
Voluntariness: this consent is voluntary. If you do not give it, or withdraw it later, the conversation is not recorded and is documented as before. Your treatment does not change because of it.
Withdrawal: you can withdraw this consent at any time and without giving reasons, informally, towards the practice. Withdrawing is as easy as giving it. The lawfulness of the processing up to that point is unaffected. After a withdrawal, any recording still held is deleted.
Your rights: you have the right of access, rectification, erasure, restriction of processing, objection and data portability. You may also lodge a complaint with a supervisory authority; the one responsible for us is [name and address of the competent supervisory authority].
Other people present: if an accompanying person takes part in the conversation, their voice is recorded as well. Their agreement is therefore obtained separately.
I explicitly consent to the conversation being recorded as audio and processed to produce a documentation draft as described above. ☐
[Name], [place, date], [signature of the patient]
[Name of the accompanying person], [place, date], [signature] — only to be filled in if an accompanying person takes part.
Information given by: [name of the treating person], [date], [signature]
The six fields no template can fill
These are specific to each practice. A template that already contained them would simply be wrong for the practice that adopts it — and consent with wrong information is not informed consent.
- The controller with address and contact, and, if there is one, the data protection officer.
- The recipients: which provider receives which data, and on what contractual basis.
- Whether there is a transfer to a third country, and if so, to which one and under what safeguard.
- Two retention periods: one for the recording, one for the text. They are rarely the same.
- The supervisory authority responsible for the practice, with name and address.
- What happens if the patient declines — and that the practice then actually handles it that way.
How the declaration fits into the workflow
Consent is obtained before recording starts, not afterwards. That sounds obvious and is the most common mistake: a device already running while the declaration is being explained has already recorded the explanation.
The practice has to be able to demonstrate later that consent was given. The signed sheet in the patient record is the simplest evidence; § 630f of the German civil code requires consents and information given to be recorded there anyway, and in immediate temporal connection with the treatment.
Withdrawal has to be as easy as giving consent. In practice that means: one sentence at the front desk is enough, and the practice needs a procedure for it — who takes it, where it is noted and who deletes the recording that exists.
The guide on consent to audio recording explains the legal frame in more detail; this page is the template that goes with it.
What this template is not
It is not legal advice and not a reviewed model. We found no official model declaration for audio recording in a medical practice at the German data protection conference or at the state authorities; what exists covers other purposes. Anyone adopting this template should have it read by their own legal or data protection advice, like any other declaration patients sign.
It is also not tailored to a particular product. The paragraph on recipients is the only one that describes what happens technically — and it is deliberately written as a field, because the answer differs completely from tool to tool. The comparison of data paths shows which three answers occur there at all.
And it does not replace a data protection impact assessment. Whether one is required follows from Art. 35 GDPR and the list of the competent supervisory authority, not from the consent form.
Frequently asked questions
Is spoken consent enough?
The GDPR prescribes no written form, but Art. 7(1) requires the practice to be able to demonstrate consent. Spoken agreement is therefore possible but hard to evidence. A signed sheet in the record is the simpler route, and it satisfies the documentation duty under § 630f of the German civil code at the same time.
Does the accompanying person need their own consent?
For the recording, yes. § 201 of the German criminal code protects the spoken word of every person, not only the patient's. Whoever speaks in the room is recorded and has to agree. That is why the template has a second signature line.
Does the consent cover all future appointments?
Only if the declaration says so and the patient understands it. Consent is given "for a specific case". A standing declaration is possible but has to name the period — and withdrawal has to stay just as easy.
What if someone declines?
Then nothing is recorded and the visit is documented as before. That has to be in the declaration and has to be how the practice actually works. Consent without which there is no treatment is not freely given, and therefore not consent.
Can we simply adopt the template?
Adopt yes, unchanged no. Six fields are specific to each practice and are listed above; without them the declaration is incomplete. After that it belongs in front of your own legal or data protection advice, before it is put in front of patients.