Practical Guide to Comply with NOM-024 for Electronic Health Records
NOM-024-SSA3-2012 establishes the requirements that an electronic health record system must meet in Mexico. It's not optional: if you use an electronic system to record patient information, this standard applies to you.
This guide summarizes the main requirements and what you need to verify in your current system.
Requirement 1: Interoperability
Your system must be able to exchange clinical information with other health systems. This doesn't mean you must share data with everyone — it means your system must have the technical capability to do so when necessary (specialist referrals, secondary care, emergencies).
The reference standard is HL7 (Health Level 7), an international protocol for clinical data exchange. Your system doesn't need to be permanently connected to others, but it must be able to export and import data in compatible formats.
Requirement 2: Standardized catalogs
Diagnoses must be recorded using the International Classification of Diseases (ICD-10, transitioning to ICD-11). Procedures must use recognized catalogs. Medications must reference institutional catalogs or applicable formularies.
This means your system cannot have free-text fields for diagnoses. It needs a catalog from which the physician can select or search for the corresponding code.
Requirement 3: Access control
Each system user must have a profile with specific permissions. The physician views and edits clinical notes. The nurse records vital signs and medication. Administrative staff sees identification data but not the clinical history.
Additionally, every action must be logged: who accessed it, when, what information, and what they modified.
Requirement 4: Integrity and non-repudiation
Clinical records must not be modifiable without a trace. If a physician corrects a note, the original note must be preserved with the correction overlaid, not overwritten.
Ideally, the system should use electronic signatures or equivalent mechanisms to guarantee that each record was created by who claims to have created it.
Requirement 5: Backup and recovery
The system must have automatic backups at a defined frequency and a documented disaster recovery plan. You must be able to demonstrate that you can recover data in case of hardware failure, cyberattack, or natural disaster.
What to do now
Review your current system against these five requirements. If any is not met, you have a regulatory vulnerability that should be resolved before COFEPRIS or the corresponding health authority finds it for you.
Medicus was designed from scratch to comply with NOM-004 and NOM-024. Electronic health record with ICD-11, role-based access control, and all data on your server. Contact Leeuwwolk.