There are three main types of digital signature with full legal force in Italy: the graphometric signature, the OTP signature and the qualified digital signature. Each type has its own characteristics, requirements and uses in medical and business settings.
What the types of digital signature are
The digital signature is a cryptographic mechanism that guarantees the authenticity, integrity and non-repudiation of a document. In Italy, the eIDAS regulation and the CAD (Digital Administration Code) recognise three main categories of signature with legal value equivalent to the handwritten signature.
The graphometric signature and the OTP signature are both forms of advanced electronic signature (FEA). The DPCM (Italian Prime Ministerial Decree) of 22 February 2013 and the AgID guidelines set the security and legal validity criteria for each type.
The choice of signature type depends on the context, the security required, the infrastructure available and the organisation’s operational needs.
Graphometric Signature: Biometric Security via Tablet
Looking for a digital signature with full legal value for your practice?
BeebeeDoc is the cloud medical practice management software that combines graphometric and OTP signatures so you can sign consent forms and documents in seconds. Free 15-day trial, no card required.
The graphometric signature is a form of Advanced Electronic Signature that captures the biometric data of your signature through a digital device, typically a tablet or touchscreen.
How the graphometric signature works
When you sign on a device, the system records three key biometric components: the speed of your hand as you write, the pressure you apply to the screen, and the tilt of the pen relative to the surface.
These biometric parameters are encoded and stored in the document itself. Every signature is unique and cannot be repeated by the same person, exactly like a traditional handwritten signature.
The signed document becomes an electronic object containing the biometric data, the document hash, the time of signing and the signatory's identity, in line with the specifications of the DPCM of 22 February 2013.
Benefits of the graphometric signature
The graphometric signature is considered the most secure form of digital signature after the qualified signature. It offers biometric protection that is almost impossible to forge.
In a medical setting the graphometric signature is ideal for collecting informed consents, critical clinical records and documents that require the highest level of legal security.
The evidential value is extremely high: in the event of a dispute, the biometric parameters provide almost incontestable proof of the authenticity of the signature and of the signatory's identity.
The graphometric signature does not require complex digital certificates or PKI infrastructure. It is immediate to use for the end user.
Limitations of the graphometric signature
The graphometric signature requires a physical device with a pressure-sensitive touchscreen: a tablet, a digital pen or a specialised terminal.
Remote signing is not possible without the device. If the patient is at home or at a branch with no tablet, they cannot sign graphometrically.
Adoption requires an investment in hardware for every signing station, which raises the initial cost compared with software-only solutions.
Some elderly patients, or those with fine motor difficulties, may find it hard to sign on a touch device.
Medical uses of the graphometric signature
The graphometric signature is ideal for critical documents such as surgical consent forms, declarations of intent, clinical records and specialist medical reports.
In medical practices, it is used at reception when the patient comes in person: the doctor or the administrative staff place the tablet in front of the patient, who signs the informed consent form or the clinical documentation.
Medical prescriptions carrying a graphometric signature have full legal value, even if the patient later disputes the authenticity of the signature.
OTP Signature: Remote Authentication via SMS and Email
The OTP (One-Time Password) signature is a form of Advanced Electronic Signature that uses a single-use code sent by SMS or email. It is the ideal solution for signing digitally from a distance without specialised hardware.
How OTP signing works
The user opens the document to be signed through a web or mobile application. They click the "Firma con OTP" (sign with OTP) button and the system sends a one-time code to the registered phone number or email address.
The user receives the code, enters it in the interface, and the document is signed. The code is valid only for that signature and at that specific moment.
The system records the time of the signature, the phone number or email used, the signatory's IP address and the OTP transaction. All this data is tracked so that authenticity can be verified in the event of a dispute.
The OTP signature fully meets the requirements for an advanced electronic signature under eIDAS, the CAD and the DPCM of 22 February 2013. It has full legal value in every Italian court.
The benefits of OTP signing
The OTP signature works from any device: smartphone, tablet, computer. It needs no specialised hardware or locally installed software.
It is ideal for remote patients. If a patient is at home, travelling, or at a branch without a tablet, they can receive the document link by email and sign it straight away by entering the OTP received by SMS or email.
Costs are minimal: there is no need to buy touch devices. The solution is entirely cloud-based and scalable.
It is also accessible for elderly users or those with motor disabilities. It requires no complex gestures, only entering a numeric code.
The OTP signature is very fast: the code arrives within seconds and signing is complete in under a minute in total.
Limitations of the OTP signature
The OTP signature is less secure than the graphometric signature from a biometric point of view. It does not capture unique physiological features such as the speed, pressure or slant of the signature.
If the telephone number or email address is compromised, the OTP code could be intercepted by an attacker. This risk is mitigated, however, by the very short validity of the code (usually 5-10 minutes).
It is not suitable for highly critical documents where the highest level of biometric security is essential (such as some medico-legal contracts).
It depends on whether a phone number or email address is available. If the patient cannot access these channels at the time, they cannot sign.
Medical applications of the OTP signature
The OTP signature is ideal for simple informed consents, processing authorisations, medical leave requests and administrative documents that do not need the highest level of biometric security.
It is ideal for telemedicine. If the patient is in a teleconsultation with the doctor, they receive the consent link during the video call, sign with an OTP in real time, and the document is immediately available in the electronic clinical file.
For hospital wards where patients are inpatients but there is no dedicated tablet, OTP signing by SMS is quick and practical. The nurse hands over the printed document or shows the link on the patient's mobile phone, and they sign in a few seconds.
The OTP signature is used heavily for post-discharge follow-up documents, medical reports sent by email, and test bookings that need a signed confirmation from the patient.
Graphometric Signature versus OTP
Both are forms of Advanced Electronic Signature (FEA) with full legal value. The main difference is the level of biometric security and operational flexibility.
The graphometric signature offers greater security thanks to biometric data. The OTP signature offers convenience and access from any device and any place.
The choice depends on the context: critical documents signed at the practice call for a graphometric signature. Remote documents and distant patients call for OTP.
Many modern medical practice management systems, such as BeebeeDoc, include both solutions. The medical staff choose the type of signature according to the specific case and the security needs of the document.
Legal and regulatory compliance
Both the graphometric signature and the OTP signature fully comply with the European Union's eIDAS Regulation. They have full legal value in Italy and throughout Europe.
The Digital Administration Code (CAD) formally recognises the Advanced Electronic Signature as equivalent to a handwritten signature for evidential purposes.
The DPCM of 22 February 2013 sets out the technical security criteria that digital signature providers must meet. AgID publishes guidelines and recommendations periodically to ensure compliance.
In healthcare, advanced digital signatures (graphometric and OTP) comply with the GDPR for handling patients' biometric and personal data.
Implementation in a medical practice
To use graphometric signing: buy a tablet with a pressure-sensitive touchscreen, install the signing software (built into platforms such as BeebeeDoc), and train staff to hand the device to patients.
To use OTP signing: no special hardware is required. The system needs access to an SMS gateway or a reliable email service. The patient must have a registered phone number or email address.
The ideal strategy is to implement both. Graphometric for patients in the practice. OTP for remote consultations, patients at a distance, and workflows that need speed and accessibility.
BeebeeDoc provides both types of signature fully integrated into the cloud medical practice management software. No separate installation or complex certificate management is required.
Conclusion: which digital signature to choose
The graphometric signature is the best choice for critical documents, surgical consent, and situations where the patient is physically present at the practice.
The OTP signature is the best choice for telemedicine, remote patients, quick authorisations, and documents that do not require maximum biometric security.
Both are Advanced Electronic Signatures with full legal value in Italy and Europe. Both comply with eIDAS, CAD, DPCM, AgID and GDPR.
The best approach is to use both in your workflow. That gives you maximum flexibility and security for every type of medical document.
