What is Mexico's NOM-004 and how do you comply with an electronic health record?
· PROMPTO Médico
Short answer
NOM-004-SSA3-2012 is the Mexican Official Standard that defines what the clinical record must contain and how to manage it. An electronic record complies when it captures the required information, uses a signature (handwritten or electronic), codes diagnoses with ICD-10, safeguards informed consents and keeps a log of who accesses or changes each piece of data.
If you run a practice or clinic in Mexico, the clinical record isn't optional or just good practice: it's regulated by NOM-004-SSA3-2012. Complying protects your clinic and your patients legally. Here's the short version of what it requires and how to meet it when the record is digital.
What is NOM-004-SSA3-2012?
It's the standard that sets the criteria to create, integrate, use and preserve the clinical record, for both public institutions and private practices. It applies to all health staff who generate clinical information about the patient.
What must the record contain?
NOM-004 defines the minimum documents that make up the record. The most common in a practice are:
- Clinical history: identification, background, current condition, physical exam and diagnosis.
- Progress notes for each visit, with the patient's status and plan.
- Referral, interconsultation and discharge notes where applicable.
- Signed informed consents, especially for procedures.
- Test results and nursing notes depending on the level of care.
Is an electronic record valid?
Yes. The record can be electronic and is complemented by NOM-024-SSA3-2012, which regulates electronic health record systems. The key is that the system guarantees integrity, confidentiality, availability and traceability, and that notes are signed by the responsible clinician.
Key requirements to comply digitally
| NOM requirement | How it's met electronically |
|---|---|
| Signature of the responsible clinician | Digitized handwritten signature or electronic signature per note. |
| Coded diagnoses | ICD-10 catalog built into diagnosis capture. |
| Informed consent | Form signed by the patient; for procedures, with two witnesses. |
| Integrity / no tampering | Audit log recording accesses and changes (ideally immutable). |
| Retention | Kept for at least 5 years from the last medical act, with backup. |
Common mistakes that break compliance
- Unsigned notes or notes editable without a trace of who changed what.
- Paper consents that get lost or can't be linked to the record.
- Free-text diagnoses without ICD-10.
- No control over who accesses patient data.
In short: complying with NOM-004 digitally comes down to a complete record + signature + ICD-10 + safeguarded consents + an audit log. If your system doesn't do those five things, compliance is at risk.
How PROMPTO handles it
PROMPTO's record is built on NOM-004: electronically signed notes, ICD-10 diagnoses, digital consents with signature and two witnesses where the standard requires it, and a hash-chained audit log that records every action on patient data. Everything is backed up and isolated per clinic.
See PROMPTO working for your clinic.