Differences Between NOM-004 and NOM-024: What Your Medical Record Must Comply With
If you have a medical practice, clinic, or hospital in Mexico, you need to comply with two standards that regulate how you handle patient information: NOM-004-SSA3-2012 and NOM-024-SSA3-2012. They sound similar, but they regulate different things.
NOM-004: the clinical history
NOM-004 establishes the minimum requirements that any patient's medical record must contain: medical history, physical examination, diagnoses, treatments, progress notes, consultation notes, and informed consent forms.
It applies to every healthcare provider — public or private — and was originally designed for paper records. It defines what information must be recorded, how it should be organized, who can access it, and how long it must be preserved (minimum 5 years after the last consultation).
The key point: NOM-004 defines content. Whether your record is a physical folder or an electronic system, the data it must contain is the same.
NOM-024: the electronic record
NOM-024 goes a step further. It doesn't just require recording patient information — it establishes how an electronic health record system must function.
Additional requirements include interoperability (your system must be able to exchange information with other health systems using standards like HL7), standardized catalogs (diagnoses in ICD-10/ICD-11, procedures in CPT, medications in institutional catalogs), role-based access control (who can see what), data integrity (no one can modify a record without a trace), and backup and recovery capabilities.
The common confusion
Many practices install an electronic system and assume they comply with both standards. That's not the case.
You can have software that records clinical notes (complying with NOM-004) but lacks interoperability, doesn't use ICD catalogs, doesn't handle role-based access control, and doesn't have verifiable backup mechanisms. That system complies with NOM-004 but violates NOM-024.
The reverse also happens: a technically sophisticated system that meets NOM-024 but where physicians don't record the minimum information required by NOM-004.
How to comply with both?
The solution is an electronic health record that meets NOM-004's content requirements (what data to record) and NOM-024's technical requirements (how to store, protect, and exchange it).
This means your system needs structured fields for all information required by NOM-004, ICD-11 coding for diagnoses, role-based access control (physician, nurse, administrative staff), change audit logging, automatic backup with verifiable recovery, and the ability to export data in interoperable formats.
At Leeuwwolk we developed Medicus, an electronic health record designed to comply with both standards. No external APIs — patient data never leaves your server.