Must therapists report patient data to the State?

Most countries run a national health-information system, and most were designed around hospitals. Whether the duty to feed them reaches an independent psychotherapy practice is a question almost nobody answers cleanly, and the wrong belief in either direction is costly. Mexico is an instructive worked example: a provision that looks alarming, a statute that genuinely reaches private practitioners, and a mechanism that does not. What follows is documentation and practice management, not legal advice; verify the rules where you practise.

The clause that looks alarming

Mexico’s Reglamento Interior de la Secretaría de Salud — the health ministry’s internal-organisation regulation — was published in the federal gazette on 27 February 2025, repealing the 2004 text. Its article 7, fraction XXII, provides for:

“Integrar y administrar una Base Nacional de Información en Salud, alimentada de manera obligatoria por los prestadores de servicios de atención a la salud, tanto públicos como privados, con información nominal de la prestación de sus servicios […]”

A National Health Information Database, fed compulsorily by health-service providers, public and private, with named — not anonymised — service data.

Read the heading

The line immediately above it is the one nobody quotes:

“Artículo 7. La persona titular de la Secretaría tiene las facultades indelegables siguientes:”

Article 7 is not a list of citizens’ duties: it lists the powers the Minister of Health may not delegate. The neighbouring fractions are pure policy verbs — conducting actions, setting national policy — and article 1 states the object: to establish the ministry’s organisation and functioning and determine the powers of its administrative units.

That explains what the clause lacks: no deadline, no format, no channel, no reference number, no consequence for a private party filing nothing. The unit that would run such a flow — the Dirección General de Información en Salud (DGIS, the health-information directorate) — does get a broad power: to establish coordination and control mechanisms with private medical establishments, “para la generación y acopio de la información estadística y nominal en salud” — to generate and collect statistical and nominal health information (article 26, fraction X). Broad, but internal: a regulation distributes competence, it does not create the duty or its procedure. Mexico’s data-protection statute does not close the point either. Its article 36 allows transfers without consent in seven alternative cases: fraction I requires the transfer to be provided for in a Ley o Tratado — a statute or treaty, which an internal regulation is not — but fraction II covers the management of health services, and fraction V public-interest safeguarding. Which is one reason a privacy notice for a therapy practice should describe real transfers, not absolute promises.

The statute does reach private practitioners

It would be dishonest to stop there. Mexico’s General Health Law has for decades imposed an information duty reaching the private sector. Article 106 requires the “personas físicas y morales de los sectores social y privado” — social and private-sector persons, natural and legal — generating the information described in article 104 to supply it to the ministry on the terms and with the periodicity it specifies. Article 107 goes further and names health professionals, technicians and auxiliaries.

Does that include a psychologist? On paper, yes: article 5o. builds the national health system to include private individuals providing health services, and article 79 lists psychology among the regulated professions. The same breadth that makes Mexico’s clinical-record standard apply to an independent practice puts it inside articles 106 and 107. Two things narrow it. Article 104’s list is statistical — natality, mortality, morbidity, disability, available resources — but it is introduced as what the information covers “fundamentalmente”, leaving the list open, even though nothing in the article reaches the content of your notes. And both are conditioned on terms the ministry has to specify. Without those terms, the duty has no executable content.

What changed on 15 January 2026

A reform published that day added article 7o., fraction X, lifting the national database into statute. The wording is telling: it describes a database of service, infrastructure and equipment information and omits the phrase “both public and private, with nominal information”. The formula did not disappear: the same reform amended article 13, section B, fraction V, addressed to state governments:

“Integrar una base de datos con información estadística local alimentada por los prestadores de servicios de atención a la salud, tanto públicos como privados, con información nominal de la prestación de sus servicios…”

So the “public and private, nominal” formula is now in statute at state level: it obliges the state government, not you, but it is where a real demand would appear first — and article 107 already names a counterparty: health professionals must supply their information to the ministry and to state governments. Nor did the federal level let go of the nominal element: fraction IX Bis of the same article 7o., renumbered by that reform, defines SINBA and the national health-information system as mechanisms for reporting and collecting “información estadística y nominal” generated by members of the national health system — and article 5o. counts you among them.

The implementing norm

Mexico’s health-information norm, NOM-035-SSA3-2012, is broad enough to include you: it binds all members of the national health system providing care in fixed or mobile establishments (numeral 1.2), and defines a consultorio to include one dedicated to independent professional practice (numeral 3.25). It also describes what reporting would look like: DGIS and the state health services set channel and formats (numerals 5.2 and 6.4); annual data are due by the last working day of March the following year (numeral 7.2); and nominal registration of outpatient consultation is conditional, permitted only if the institution has a suitable collection tool (numeral 10.6).

Where the chain breaks: CLUES

All of that hangs on one requirement: every establishment in the system must have a CLUES (numeral 5.5) — the Clave Única de Establecimientos de Salud, the identifier that tags every record entering it. Without one there is nothing to report under. The current guidelines (published 25 June 2025) are blunt in article 9:

“No se generará CLUES a dispensarios médicos en escuelas, iglesias, cubículos médicos en empresas, proyectos de construcción, equipos itinerantes o profesionales de la salud.”

No CLUES is issued to health professionals. Measure that carefully: article 9 excludes the professional, not a consultorio with its own premises. Article 8 is the affirmative rule: a CLUES is generated for establishments with their own infrastructure, independent in budget, staff, access and premises, and for consultorios inside a medical tower one CLUES covers the whole building, not each office — which is how much of Mexican private psychology practises. Nor can a practitioner register: it happens centrally through official enlaces (article 5), the state ones registering private establishments (article 7), and the application needs a licencia sanitaria or aviso de funcionamiento (article 14).

The most-cited federal mechanism does not reach you either: the 2012 accord establishing SINBA, the basic health-information system, obliges federal agencies and entities providing health services, states and municipalities joining by agreement. Private providers are absent.

The honest conclusion is not “there is no obligation”. It is that the obligation is latent — alive in the statute, broad in the norm — and has no channel through which a solo practice could discharge it, or anyone enforce it, today.

The duty that is real: the aviso al Ministerio Público

One external reporting duty does reach private psychotherapy in Mexico. NOM-046-SSA2-2005, on family and sexual violence, binds the national health system’s institutions and public, social and private health-service providers alike; its numerals 5.10 and 5.11 require “las instituciones” of those three sectors to notify the Ministerio Público (the prosecutor’s office) on the form in its Appendix 1, and to register and notify the case. One caveat: the operative numerals in chapter 6.5 turn on “lesiones u otros signos” — injuries or other signs — and on the treating physician, so how they land in a psychotherapy consultation with no physical injury is unsettled in the text. What is not in doubt is that the norm reaches the private sector and belongs on the confidentiality-limits list you set out at the start of treatment — the subject of informed consent in psychotherapy. Who else may demand the record in writing is covered in confidentiality and legal requests.

Suicide attempt is not on the notifiable list

Many clinicians believe otherwise, and the belief has clinical consequences: it makes them warn clients of a confidentiality limit that does not exist. In NOM-017-SSA2-2012, Mexico’s epidemiological-surveillance norm, the word “suicidio” does not appear — zero hits in the full text — and its notification appendices reach transport-accident and domestic-violence injuries, not suicide or attempted suicide. In the statute, articles 136 and 137 build mandatory notification around transmissible disease, and article 161 requires health professionals to file whatever reports the health authority demands on non-transmissible diseases and syndemics, on the terms of regulations to be issued for that purpose — which we could not locate for psychological practice (checked 25 August 2026). The gap is regulatory, not statutory.

So the duty triggered by suicide risk is clinical and documentary, not administrative: we located no federal norm designating anyone to notify. Any risk disclosure calls for an immediate clinical risk assessment under your own protocol and training, and a note that shows it — the subject of documenting a suicide risk assessment. Give your client the crisis line serving their location, and confirm what your jurisdiction requires: reporting rules for risk vary sharply.

Where this is heading

Mexico’s Programa Sectorial de Salud 2025-2030 (published 4 September 2025) states the direction openly: it makes issuing legal instruments that strengthen information reporting a priority intervention, describes the nominalización of registries — the shift to named records — and notes that the problem affects public, private and social sectors alike. Three honest limits on the analysis above. As of 25 August 2026 we found no accord or norm published after 15 January 2026 operationalising the database for private providers, but that is a best-effort search, not a verified negative. We checked no state legislation under article 13 B V, the likeliest place a real duty would surface first — confirm that with your professional body or state health ministry. And we could not retrieve the annex listing activities subject to an aviso de funcionamiento, so we neither affirm nor deny that a psychology office must file one.

The portable question

Strip out the Mexican nouns and a checklist remains. First, find the instrument that creates the duty and check its rank: an internal ministerial regulation, a statute and a binding technical norm are three different things, and only some can bind you. Second, find the mechanism — identifier, form, channel, deadline; a duty with no mechanism is not one you are currently failing. Third, find the duties that are real where you practise — notifiable conditions, violence reporting, who may compel the record — and put them in your consent conversation.

All of which lands in the same place: a record complete before anyone asks, whether the asker is an authority or a client requesting a copy of their own file. gesell.ai keeps that chart structured client by client — intake, clinical history, treatment plan and session notes — and archives informed consents there, signed digitally. You review and approve each document; the clinical content stays yours. What stops depending on memory is whether it is all there on the day someone with authority asks.