Draft pending review by a lawyer. This text describes what the product does today; it is not legal advice and may change before final publication.
A summary for clinics: clinical record (NOM-004), electronic systems (NOM-024), advertising (COFEPRIS) and HIPAA. It says what the platform does, what the clinic is responsible for, and what we do not claim.
1 · What this summary is
This summary explains how Soluciones para Doctores relates to health-sector rules in Mexico. It also explains what the US health law (HIPAA) says and why it almost never applies to a Mexican clinic.
Soluciones para Doctores is management software for private clinics: scheduling, messages, an AI receptionist, reminders and a patient portal. Tsunami Automation Global LLC does not provide medical services. The clinic and its professionals are responsible for care, the clinical record, consents and their advertising.
We are not a law firm and this text is not legal advice. Some rules can be read differently depending on your case. Talk to your lawyer.
Legal basis: LFPDPPP (DOF 20-mar-2025), art. 2, fracs. XII y XIV
2 · Clinical record (NOM-004-SSA3-2012)
NOM-004 says how the clinical record must be put together. These are the points that matter most to a clinic that uses software:
- Retention: the record is kept at least 5 years from the last medical act (numeral 5.4).
- Ownership: the record belongs to the institution or provider that generates it. The patient has rights over the information, to protect their health and confidentiality (numeral 5.4).
- Privacy: data that identifies the patient is not disclosed. Publishing record data requires the patient's written authorisation. A third party receives it only on written request of the patient, the guardian or the authorised physician, or of a competent authority (numerals 5.5 and 5.7).
- Each note carries the date, time, full name and signature of its author. The signature can be handwritten, electronic or digital (numerals 5.10 and 5.12).
The clinic remains responsible for the record even if it uses our platform. The personal-data law also asks to keep sensitive data only for the minimum time needed. The two periods work together: the clinic decides how long it keeps each data item and why.
A lawyer must confirm how NOM-004 and the 2025 LFPDPPP apply to each other in your clinic.
Legal basis: NOM-004-SSA3-2012 (DOF 15-oct-2012), numerales 5.2, 5.4, 5.5, 5.10; LFPDPPP (DOF 20-mar-2025), art. 12
3 · What the platform does with the clinical record
The platform is designed for administration and reception, not as a full electronic health record. It has some limited clinical functions inside:
- Structured consultation notes (subjective, objective, assessment and plan) and appointment notes, stored encrypted, for roles with permission to view clinical notes.
- A prescription draft that prints with the physician's name and professional licence number and a line for a handwritten signature. It has no advanced electronic signature, no official folio and no official electronic prescription.
- Consent templates that the clinic can create and store. The text and its legal sufficiency belong to the clinic.
There is also an activation control for the clinical-record module. By default it is off. It can be in pilot mode, only for clinics we approve, or on for all. It requires field-level encryption to be configured. A clinic's request and its approval are kept in the audit log.
This activation control does not yet govern the consultation-note and prescription screens described above. For that reason we do not offer the platform as an electronic health record that conforms to NOM-004 or NOM-024. If your clinic needs that record, use a system built for it or talk to us first.
The clinic remains responsible for the content of the record, its signatures, the informed-consent letters (minimum content in numeral 10.1 of NOM-004) and the retention period. The platform does not delete patient data on its own. Deletion is a manual procedure; write to privacy@tsunamiautomation.com.
Legal basis: NOM-004-SSA3-2012 (DOF 15-oct-2012), numerales 5.2, 5.10, 10.1; LFPDPPP (DOF 20-mar-2025), art. 8
4 · Electronic record systems (NOM-024-SSA3-2012)
NOM-024 regulates information systems for electronic health records and the exchange of health information. By its scope, it binds health-system establishments that adopt an electronic record system and the persons who own, use, develop, distribute or sell it. The official standards catalogue of the Ministry of Economy lists it as in force.
We do not claim that the platform is certified or assessed as conforming to NOM-024. Our public privacy and security page (/nom-024) says the same in other words: the AI is administrative, the full clinical record is limited until the legal and technical review is closed, and we do not promise clinical signature, electronic prescription or COFEPRIS compliance.
If we offer an electronic health record in the future, NOM-024 would be part of what we must review first. If your clinic adopts an electronic record system, ask your lawyer what the clinic itself must comply with.
Legal basis: NOM-024-SSA3-2012 (DOF 30-nov-2012), numeral 1.2 (ámbito) y numeral 11 (vigencia)
5 · Advertising of health services (COFEPRIS)
The public profile of a professional or a clinic is advertising. These are the rules we reviewed, based on the text of the General Health Law Regulation on Advertising:
- Licence and issuing institution: a professional who advertises must state the institution that issued their degree, diploma or certificate and, where applicable, the professional licence (cédula) number, in any medium (art. 19).
- Notice, not permit: advertising of professional activities requires a notice to the health authority, filed 5 days before it starts (arts. 86 fr. I and 87). A permit is requested for advertising health services, except services given individually (art. 79 fr. I).
- Truth: the ad must match the real features of the service, must not attribute qualities it does not have, and must inform rather than mislead (arts. 6, 7 and 18).
- Do not advertise treatments of unproven scientific efficacy (art. 18 fr. II).
- Beauty services: only real, proven results, with risks, contraindications and side effects (arts. 63-65). The regulation does not expressly mention before-and-after photos or the phrase “guaranteed results”, but the articles above and the Federal Consumer Protection Law (art. 32, truthful and verifiable advertising) limit them.
A lawyer must confirm whether your case needs a notice or a permit. The platform does not file notices or permits with COFEPRIS for the clinic.
Legal basis: Reglamento de la Ley General de Salud en materia de Publicidad (DOF 4-may-2000, última reforma 8-sep-2022), arts. 6, 7, 18, 19, 63-65, 79 fr. I, 86 fr. I y 87; Ley Federal de Protección al Consumidor, art. 32
6 · What the public profile shows and what the clinic must add
A profile appears in the directory only if the clinic publishes it. The public page shows: name, specialty, city and address, a biography written by the clinic, languages, services with price (or “Price to be confirmed”), the contact phone, the booking calendar and approved reviews with the name and the initial of the last name.
The public page does not show today the professional licence (cédula) number or the institution that issued the degree, although the platform lets you save the cédula in the profile settings. Until that changes, add them yourself in the biography. We do not show patient photos on the profile.
| Topic | What the platform does | What the clinic must do |
|---|---|---|
| Licence and institution (art. 19) | Saves the cédula in settings; does not show it on the public page. | Write the cédula number and the issuing institution in the biography. |
| Notice to the health authority (arts. 86-87) | Does not file notices. | Confirm with its lawyer whether it applies and file it before advertising. |
| Ad text (arts. 6, 7, 18, 63-65) | Does not review the content of the biography or the services. | Not promise results, not advertise treatments without scientific support and, for aesthetics, state the risks. |
| Prices | Shows the price the clinic chooses to make visible. | Keep them current and clear. |
Legal basis: Reglamento de la Ley General de Salud en materia de Publicidad (DOF 4-may-2000, última reforma 8-sep-2022), art. 19; LFPDPPP (DOF 20-mar-2025), art. 8
7 · Reviews, testimonials and patient photos
A review, a testimonial or a photo of a patient is personal data. If it says something about their health or treatment, it is sensitive data. To publish it, the clinic needs the patient's express consent, given in writing or with an electronic signature or authentication mechanism (LFPDPPP, art. 8). NOM-004 also asks for written authorisation to publish data that identifies the patient (numeral 5.5).
- In the platform, a review is shown only after it is approved, and the clinic can hide or report it. The name is shown with the initial of the last name.
- The patient writes the text of the review and it can mention their health. The clinic must read it before approving it and must not approve reviews that reveal health data unless the patient has agreed.
- Testimonials or photos that the clinic puts on its own website or social media are outside the platform. They need their own written consent, and they must not promise results.
Legal basis: LFPDPPP (DOF 20-mar-2025), art. 8; NOM-004-SSA3-2012 (DOF 15-oct-2012), numeral 5.5; Ley Federal de Protección al Consumidor, art. 32
8 · Health data: consent and exceptions
Health data is sensitive data. The clinic, as controller, needs the patient's express consent, given in writing or with an electronic signature or authentication mechanism, and must be able to prove it (art. 8). The law has exceptions. For example, no consent is needed for processing that is indispensable for medical care or diagnosis when the patient cannot give it and it is done by someone bound by professional secrecy (art. 9 fr. VI), or for transfers needed for prevention, diagnosis or medical care (art. 36 fr. II). Cancellation can be refused when a health professional processes the data under professional secrecy (art. 25 fr. VII).
The platform asks for express consent for health data in the intake forms and stores the version of the text that was accepted, the date and the technical details of the acceptance. The clinic must decide which legal basis it uses for each processing activity and keep its privacy notices up to date.
Legal basis: LFPDPPP (DOF 20-mar-2025), arts. 8, 9 fr. VI, 12, 25 fr. VII y 36 fr. II
9 · HIPAA (United States)
HIPAA is a United States law. It applies to covered entities (health plans, health care clearinghouses and providers that send certain standard electronic transactions) and to their business associates, that is, those who create, receive, maintain or transmit protected health information on behalf of a covered entity (45 CFR 160.102 and 160.103).
A Mexican clinic with no HIPAA-covered activity in the United States is not subject to it. For those clinics, the law that matters is the LFPDPPP.
We do not claim that Soluciones para Doctores complies with HIPAA or that it is HIPAA-certified. If your clinic treats patients in the United States as a covered entity, or works for one, you would need a business associate agreement (BAA) with us (45 CFR 164.504(e)). We do not offer that agreement today. Contact us at support@tsunamiautomation.com to talk about your case. We do not promise that we can sign it.
Legal basis: 45 CFR 160.102; 45 CFR 160.103; 45 CFR 164.504(e)
10 · Our safeguards against the HIPAA Security Rule
This table is only an honest comparison, for clinics that want to assess the level of protection. It does not mean that we comply with HIPAA.
| HIPAA rule | What we do today | Status |
|---|---|---|
| 164.308 Administrative: information access management | Roles with separate permissions; isolation between clinics with row-level security. | Covered |
| 164.308 Administrative: security incident procedures | Documented internal procedure and an incident register. We do not run periodic drills yet. | Partial |
| 164.308 Administrative: contingency plan | Daily copy (31 copies) and a copy in separate storage every 6 hours (14 generations); one documented restore test, not periodic. | Partial |
| 164.308 Administrative: evaluation, security officer and training | We have no third-party audit, certification or published penetration test, and no formal training programme that we can show. | No |
| 164.310 Physical: facility access controls | Servers are in a data centre of the hosting provider in Germany. Its physical controls belong to the provider; we do not audit them. | Partial |
| 164.310 Physical: workstations and devices | Devices of the clinic's team: the clinic controls them. | No |
| 164.310 Physical: device and media controls (disk encryption) | We do not claim disk or backup-file encryption; field-level encryption exists. | No |
| 164.312 Technical: access control | Individual accounts, role permissions, session timeout for inactivity and field-level encryption of patient data. | Covered |
| 164.312 Technical: audit controls | Log of sensitive actions; it does not cover every read of every screen. | Partial |
| 164.312 Technical: integrity | AES-GCM encryption detects alteration of encrypted fields. There is no general integrity check of all data. | Partial |
| 164.312 Technical: person or entity authentication | Password with scrypt hash and optional two-step verification. It is not mandatory yet. | Partial |
| 164.312 Technical: transmission security | HTTPS with HSTS for access to the platform. | Covered |
Legal basis: 45 CFR 164.308; 45 CFR 164.310; 45 CFR 164.312
11 · Breach notification timing: Mexico and HIPAA
| Mexico (LFPDPPP) | HIPAA (only if it applies) | |
|---|---|---|
| Who is told | The person the data belongs to, when the breach significantly affects their property or moral rights. | Each affected person and, depending on size, the authority and the media. A business associate tells the covered entity. |
| Deadline | “Immediately”. The law does not set a number of days or hours. The text of the law we reviewed does not mention a notice to the authority. | Without unreasonable delay and, in any case, no later than 60 calendar days after discovery. |
| Our commitment | We tell the clinic without undue delay and within 72 hours of confirming the breach. The clinic tells its patients immediately. | Only if your clinic is a covered entity and an agreement is signed. |
If your clinic is in both worlds, follow the shorter deadline.
Legal basis: LFPDPPP (DOF 20-mar-2025), art. 19; 45 CFR 164.404(b); 45 CFR 164.410(b)
12 · Summary: who does what
| Topic | The platform | The clinic |
|---|---|---|
| Clinical record | Encrypted consultation notes and a printable prescription draft. Not offered as an electronic record that conforms to NOM-004 or NOM-024. | Put it together, sign it, keep it at least 5 years and protect its privacy. |
| Consents | Asks for consent for health data at intake and stores its version and date. Lets you store templates. | Write and sign the informed-consent letters and decide the legal basis. |
| Advertising | Shows the profile that the clinic publishes. Does not file notices or review the text. | Licence and issuing institution, notice to the authority where it applies, truthfulness. |
| ARCO rights | Records the request and tracks the deadline. Cancellation is a manual procedure. | Answer within the legal deadlines (20 business days to answer and 15 more days to carry out). |
| Breaches | Tells the clinic within 72 hours of confirming it. | Tell the affected patients immediately. |
| HIPAA | No compliance is claimed. No BAA is offered today. | Only if a covered entity: assess whether it can use the platform. |