How
to answer: Base your answers on what you know about your Mexico operations specifically — not
corporate-level policies. Each "No" represents a documented compliance gap under
NOM-024-SSA3-2012 or LFPDPPP.
This
document is generated locally. No data is sent to any server. This assessment runs entirely in your
browser.
01
Are clinical records permanently protected against modification or deletion once they have been created?
02
Does your system maintain a chronological log of every action performed on clinical records, identifying who
made each change and when?
03
Does your system restrict access to clinical information based on user roles, ensuring that each user —
physician, nurse, or administrative staff — can only access what their responsibilities require?
04
Are technical controls in place to prevent HR personnel from accessing employees' clinical diagnoses,
prescriptions, or individual medical records?
05
Do you have a formal Information Security Management System (ISMS) with documented risk assessments, defined
procedures, and assigned responsibilities for protecting employees' clinical data?
06
Is the clinical data from employees encrypted both at rest and in transit, rendering it inaccessible to any
unauthorized party?
07
Does each user access clinical records using unique, non-transferable credentials, with no shared accounts or
open access permitted?
08
Can you legally demonstrate, through an unalterable digital record, the identity of the medical professional
who issued each prescription, diagnosis, or clinical authorization?
09
Can your organization produce the complete clinical record of any current or former employee upon request by a
regulatory authority?
10
Does your organization record diagnoses and procedures using standardized medical coding systems, such as the
International Classification of Diseases (ICD), rather than free text or proprietary internal codes?
11
Do you have a formal, documented process for obtaining explicit employee consent prior to collecting or
processing their health data?
12
Does your company's Privacy Notice in Mexico explicitly address the collection, storage, and intended purpose
of employee health data?