Data Security Obligations

Is the use of telehealth permitted?

Yes, telehealth is permitted in Mexico, though it is not expressly provided for under relevant local laws.

How is telehealth regulated?

There are no specific laws that relate to, and / or regulate, telehealth.

After an initial project from December 2015 till 27 April 2018 – being the Mexican Official Standard "PROY-NOM-036-SSA3-2015 for the regulation of distance medical attention" ("NOM Project"), which established regulation of procedures for healthcare personnel conducting remote healthcare services – the Mexican Government has taken the approach that telehealth is an activity integrated in health services and therefore, the laws and regulations (such as the General Health Law and the Regulations of the General Health Law in Matters of the Provision of Health Care Services) applicable to general healthcare services, shall apply to telehealth too.

Are there specific fields of healthcare in relation to which telehealth services are currently available, and do they involve the use of proprietary technology or platforms?

Telehealth is currently available for any type of healthcare services as long as it complies with the regulatory framework applicable for healthcare services generally and, if necessary, with the regulatory framework applicable to each specific sector and / or activity within the field of healthcare.

Mexican laws do no establish any kind of requirement or set forth any indication regarding the platforms that must be used when providing telehealth services. However, NOM-024-SSA3-2012 (discussed below) regulates the exchange of information between electronic health record information systems ("SIRES"), which is an information system that allows the capture, management and exchange of structured and integrated information from the patient’s clinical record, as well as geographic, social, financial, infrastructure and any other information that documents medical care. SIRES must obtain a certification under NOM-024-SSA3-2012.

Does the public health system include telehealth services, and if so, are such services free of charge, subsidised or reimbursed? Where the public health system does not include telehealth services, are such services covered by private health insurance?

Yes, the Mexican Social Security Institute ("IMSS") and the Institute for Social Security and Services for State Workers ("ISSSTE") provide telehealth services.

However, those services are limited to patients from difficult-to-access parts of the Mexican Republic who require medical attention in a certain medical specialty. Such services are part of the social security of Mexican workers.

Do specific privacy and/or data protection laws apply to the provision of telehealth services?

Yes, there are several relevant laws and standards that will apply to the provision of telehealth in Mexico:

• Mexican Law for the Protection of Personal Data in Possession of Private Parties (and together with its regulations and guidelines, the "Data Privacy Laws"), ensures the correct processing of personal information held by third parties, especially in digital environments and promotes good practices and strengthens personal data protection controls outside the government sphere.
• Mexican Law for the Protection of Personal Data in Possession of Obligated Parties establishes the basis, principles and procedures for individuals’ right to the protection of their personal data which is in the possession of Obligated Parties (being any authority, entity, organ and body of the Executive, Legislative and Judicial branches, autonomous bodies, political parties, trusts and public funds).
• NOM-024-SSA3-2012 regulates the exchange of health information, electronic record information systems for health, SIRES, and establishes the mechanisms for health service providers to register, exchange and consolidate information.
• NOM-035-SSA3-2012 establishes criteria and procedures that must be followed to produce, capture, integrate, process, systematise, evaluate and disclose health information.
• NOM-004-SSA3-2012 concerns clinical files, and establishes the mandatory scientific, ethical, technological and administrative criteria applicable to the preparation, integration, use, management, filing, conservation, ownership and confidentiality of the clinical record.

How should the cross-border transfer of personal information collected and processed in the course of telehealth services be carried out to ensure compliance with applicable privacy laws?

Under Article 36 of the Data Privacy Law, as a general rule, transfers of personal data to national or foreign third parties requires the holder (i.e. transferor) to issue to the third party a privacy notice and details of the purposes for which that information can be used. The processing of the data must be done as agreed in the privacy notice (which will contain a clause indicating whether or not the owner consents to the transfer of the data), and additionally, the third party recipient, will assume the same obligations that correspond to the responsible who transferred the data.

However, there are some relevant and important exceptions to the general rule that telehealth providers should be aware of. In particular, Article 37 of the Data Privacy Law establishes that national or international transfers of data may be carried out without the consent of the holder when the transfer is necessary for prevention or medical diagnosis, the provision of healthcare, medical treatment or the management of health services. The recipient of the personal data must always assume the same obligations that correspond to the party that transferred the personal data. The party responsible for transferring the personal data may use contractual clauses or other legal instruments to provide for at least the same obligations to which the person responsible for the transfer of the personal data is subject, as well as the conditions under which the holder consented to the processing of the personal data.

Are any specific laws, regulations, or self-regulatory instruments expected to be adopted in the near future?

Given the current regulatory landscape in Mexico, there are no specific laws, regulations, and / or regulatory instruments expected to be adopted soon. This view is supported by the 2018 cancellation of the NOM Project mentioned in Availability of Telehealth.