Does a new digital-health law make electronic records mandatory?

Every few years a legislature passes a digital-health law, and within a month the software market has translated it into a deadline. The claim reaches you as settled fact: as of such-and-such a date, paper is no longer legal and your practice must keep an electronic record. Three questions usually dispose of it, and you can run them yourself on the text. Does the instrument use the legal name of the record — the term of art your jurisdiction’s existing record rule already defines? Is the operative verb one of obligation, and is its subject you? And does a transitional provision set a date by which anyone in private practice must have done something? A statute that intends to mandate adoption does all three, because that is how mandates are drafted. This is documentation and practice management, not legal advice.

Mexico’s January 2026 reform of its General Health Law is a clean worked example, because it fails all three tests in an unusually visible way — and because, while everyone argued about the obligation that is not in it, the same decree quietly changed something that is.

Test one: is the record even named?

The decree published in Mexico’s official gazette on 15 January 2026 runs twenty-six pages and twelve transitional articles. The Spanish word expediente — “record”, the noun that carries the entire Mexican clinical-record framework — appears in it zero times. Not expediente clínico, not expediente electrónico, not expediente clínico electrónico. We counted it in the PDF of the reform and confirmed it independently in the Word file the Chamber of Deputies publishes alongside it, because a zero-count claim is only worth making if it survives a second source.

This is the test that does most of the work, and it travels. Legal systems name their instruments. If a new law is going to make a defined artefact compulsory, it says the artefact’s name. When a text reaches instead for a generic, international-sounding phrase, that is usually a sign it is describing a policy field rather than imposing a duty.

Test two: what is the verb, and who is the subject?

The decree does mention electronic records — twice, in identical wording. Once in article 7, fraction VIII Bis, which lists what the Ministry of Health is responsible for as coordinator of the National Health System:

«Promover la incorporación, uso y aprovechamiento de las tecnologías de la información y de las comunicaciones en los servicios de salud, como es el caso, entre otros, de la telesalud, la telemedicina, la salud móvil, los registros médicos o de salud electrónicos y dispositivos portátiles;»

To promote the incorporation, use and uptake of information and communication technologies in health services, such as, among others, telehealth, telemedicine, mobile health, electronic medical or health records, and wearable devices.

And once in the new article 71 Bis, which opens a chapter titled “Digital Health” and is a definition: digital health “refers to” the application of those technologies, followed by the same list.

So the verb is promote, the subject is the ministry, and the second instance has no obligation verb at all. Neither sentence is addressed to a clinician. Note also which term the drafters chose — “electronic medical or health records”, a phrase with no legal definition in Mexican law — when the term of art was available to them and they did not use it.

Test three: does any transitional provision set a date?

We read all twelve. Six impose deadlines, and they can be listed in full: 180 days for the ministry to assemble a national infrastructure master plan; 90 days for guidelines under article 60 Octies; 15 working days to resolve pending facility certificates; 180 days for the medical arbitration commission’s internal rules; 30 working days for one public insurer to amend a contract; and 180 days deferring the reclassification of ten controlled substances, which is the only one of the twelve that reaches a private practitioner and has its own consequences. None mentions records, information systems, or the private sector’s adoption of anything.

That matters because the version circulating in the market has three dates in it — digitise in 2026, interoperate in 2027, a national system in 2028. None of the three is in the decree, in any transitional article, or anywhere else in the text.

Where the electronic record actually lives — and it is fourteen years old

The useful follow-up question, once a new law turns out not to create the duty, is where the duty would live if it existed. In Mexico the answer is a single article the 2026 decree did not touch: article 109 Bis, added in January 2012.

«Corresponde a la Secretaría de Salud emitir la normatividad a que deberán sujetarse los sistemas de información de registro electrónico que utilicen las instituciones del Sistema Nacional de Salud, a fin de garantizar la interoperabilidad, procesamiento, interpretación y seguridad de la información contenida en los expedientes clínicos electrónicos.»

The ministry is to issue the rules governing the electronic-record systems that institutions use. That relative clause is the whole answer: the obligation is conditional on adoption. Its product is a technical standard, NOM-024-SSA3-2012, whose scope clause repeats the same condition — it binds establishments that adopt an electronic health-record system, and, in the same sentence, the companies that own and commercialise those systems.

This conditional design is close to universal

It is worth seeing that Mexico is not unusual here, because it tells you what to expect when you run these tests at home. Regulators overwhelmingly regulate the record you have rather than ordering you to have a particular kind. The United States drafts the same shape in the HIPAA Security Rule, at 45 CFR § 164.306(a)(1):

“Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits.”

The duty attaches to electronic health information once it exists. Nothing in it tells a solo practitioner to create any. Where a government has genuinely pushed clinicians onto electronic systems, the lever has usually been money rather than a prohibition on paper — and the eligibility lists attached to that money are narrower than people assume. The US Medicare electronic-record incentive programme defined its “eligible professional” at 42 CFR § 495.100 as “a physician as defined in section 1861(r) of the Act”, and then closed the list to five: doctors of medicine or osteopathy, of dental surgery or medicine, of podiatric medicine, of optometry, and chiropractors. A clinical psychologist is not on it. The programme that drove a generation of adoption never reached them, and nothing replaced it with an order to go electronic. Check your own jurisdiction rather than assuming either way; what travels is the drafting pattern, not any one country’s list.

What the same decree did change, and nobody mentioned

Here is the part worth your attention. The 15 January 2026 reform amended fraction I of article 396 of the General Health Law — the provision defining how health-authority oversight is carried out, untouched since June 1991.

	Before	In force since 16 January 2026
General Health Law, art. 396, fr. I	Inspection visits by expressly authorised personnel to carry out physical verification of compliance with the law	Inspection visits by expressly authorised personnel to carry out physical, documentary, or by any electronic means verification of compliance with the law

Four new words, in the article that governs how the state checks you. And what is checked is broad: article 393 assigns the authorities oversight of compliance with “this Law and the other provisions issued on the basis of it” — a formula that includes the official standards, the clinical-record standard among them.

Read the limits too. The fraction is still headed “inspection visits” and still requires “expressly authorised personnel”: the electronic mode describes how those people may verify, not a new species of remote audit conducted by nobody in particular. Anyone reading it as “they can now audit you over the internet whenever they like” is reading past the text.

The honest reading, separated from the inference

The text says the authority may now verify documentarily or electronically, and not only by turning up. The inference — flagged as an inference — is that a documentary review is far cheaper to run at scale than a site visit, so amendments of this kind tend to precede written requests rather than inspectors at the door.

What did not change is the underlying exposure, and it should not be inflated. When we worked through the Mexican record standard we looked for, and could not locate, public evidence of routine health inspections of psychology practices or any published decision sanctioning a psychologist over a record defect. That was a best-effort search rather than a verified negative, and we have not repeated it for this piece: the amendment changes the means by which a verification may be conducted, not the evidence that they are conducted. The realistic scenario is not an inspector: it is a complaint, a lawsuit, or a request in which your record is the evidence.

The practical consequence is small and worth having anyway. If what can be requested is documentary, the useful question is not “do I have software” but how long it would take you today to produce, for one named client, the history, the dated and signed session notes, the consent form, and evidence that you have retained all of it. If the answer is measured in days of searching through notebooks, that was a problem before the decree and remains one after it.

Your record duties did not move

None of this disturbs the two instruments that actually set documentation obligations in Mexico, and neither changed in January.

The clinical-record standard NOM-004-SSA3-2012 defines what the record contains, how each entry is signed, and how long it is kept — a minimum of five years from the last clinical act. It also settles the format question outright, in numeral 5.12, and the first two words do the work: «De manera optativa, se podrán utilizar medios electrónicos, magnéticos, electromagnéticos, ópticos, magneto-ópticos o de cualquier otra tecnología en la integración de un expediente clínico» — optionally, electronic, magnetic, electromagnetic, optical, magneto-optical or any other technological media may be used in assembling a clinical record. Optional since 2012, and still optional: an amended statute does not repeal a technical standard by implication, and nothing in the decree contradicts that numeral. The rest of the standard is walked through in Mexico’s clinical-record standard for psychologists.

The second is the 2025 federal data-protection statute, which governs consent for sensitive data, security measures scaled to that sensitivity, and the deadlines that run when a client asks for their record. If reading a digital-health law left you worried you were non-compliant, the gap is far more likely to be in your privacy notice than in your lack of an electronic record.

The telehealth half, in one paragraph

One provision of the new chapter does reach a private practice directly, and it is the only one that does: article 71 Septies sets four conditions for all telehealth services — trained designated personnel, secure systems, informed consent obtained at a distance, and adequate documentation of the encounters — without distinguishing public from private, unlike the two neighbouring articles that are addressed to public institutions only. It is set out fraction by fraction in the teletherapy guide. The other half of the decree that touches private practice — the national health-information base and what it asked of state governments — is covered in must therapists report patient data to the State.

Wherever you practise, the method is the portable part: get the instrument itself, search it for the name of the record, read the verb and its subject, and read the transitional articles for a date. If all three come back empty, the deadline you were sold does not exist.