Mandatory Medical Service in Mexico: What the Law Requires

If your company operates an on-site clinic, a nursing station, or an internal medical service, it is already generating clinical records. And the moment those records exist, the operation stops being a matter for HR alone: four separate authorities come into play, each with its own inspection and penalty logic.

This guide explains what the law requires based on your headcount, and what obligations follow for the medical information that service produces. It's written for HR leadership, compliance teams, and occupational-health leads at large operations — including US teams responsible for a Mexico subsidiary or supplier.

What the Federal Labor Law requires based on your company's size

Article 504 of the Ley Federal del Trabajo (LFT), Mexico's Federal Labor Law, sets out special employer obligations regarding medical care, and those obligations scale with headcount. This isn't a recommendation or a best practice — it's a direct legal requirement.

It's worth reading closely, because the threshold that applies to your company completely changes the infrastructure you have to maintain.

The obligations under article 504

The article lists several special employer obligations. These are the ones that define the medical infrastructure:

• Any workplace: keep the medicines and supplies needed to promptly provide first aid, and train staff to administer it.
• More than 100 workers: set up a nursing station for urgent medical and surgical care, staffed by qualified personnel under the direction of a physician, with an obligation to transfer the worker when the physician determines proper care cannot be provided on site.
• More than 300 workers: install a hospital, with the necessary medical and support staff.
• Alternative to building the hospital: with the workers' prior agreement, contract service with a nearby clinic or hospital that allows for quick, convenient transfer of workers.
• In all cases: give written or electronic notice to the Ministry of Labor (Secretaría del Trabajo), the Labor Inspector, and the Labor Tribunal within 72 hours of any workplace accident, and immediately in the event of death.

That last alternative is the one practically every Mexican company with more than 300 workers uses in practice: nobody builds their own hospital. But the law attaches two conditions to that route that almost never get documented: the agreement with workers has to exist in writing, and the contracted hospital has to be close enough to allow a quick transfer. A company that relies on this alternative without being able to show those two things hasn't actually completed the substitute arrangement, even if it believes the matter is settled.

What almost no one considers: that medical service generates clinical records

Here is the point that usually gets overlooked. The conversation normally stops at meeting the infrastructure requirement: hiring the physician, setting up the clinic, stocking the supplies. But the obligation doesn't end there, because a medical service in operation produces clinical information about identifiable people, every single day.

The sequence is always the same:

1. The company is required to operate a medical service based on its headcount.
2. That service performs the medical exams required by regulation based on the risk of each role, in addition to consultations and incidents.
3. Each of those encounters generates a clinical record containing identifiable health data.
4. Those records become the company's responsibility, along with the system where they're stored.

The four authorities that regulate that information

A single clinical record answers to four separate regulatory frameworks, each with its own authority:

Systems are certified under NOM-024 by the Dirección General de Información en Salud (DGIS), part of Mexico's Ministry of Health, which publishes the list of certified systems. Certification is valid for two years, and the entire national universe of certified systems is barely around twenty platforms.

The filing almost no company made: the notice to COFEPRIS

An on-site clinic or nursing station qualifies as a healthcare establishment under the regulation implementing the General Health Law on the provision of medical care services, which expressly defines a "consultorio" (clinic) to include both privately and socially operated ones. That triggers two concrete obligations: filing an Aviso de Funcionamiento (Notice of Operation) and an Aviso de Responsable Sanitario (Notice of Health Officer) with COFEPRIS (procedure COFEPRIS-05-036) at least 30 days before starting operations, and having a health officer with a registered professional license.

There is no exception for employer-run medical services: the General Health Law and its implementing regulation don't distinguish between a clinic open to the public and one operated internally by a company. It's also a free filing with no expiration, one any compliance team can verify today.

That last row in the table, on data protection, deserves special attention. Since March 2025, a new Ley Federal de Protección de Datos Personales en Posesión de los Particulares has been in force, which dissolved Mexico's former data-protection authority, INAI, and transferred its powers to the Secretaría Anticorrupción y Buen Gobierno. The law sets fines from 100 to 160,000 UMA for certain violations and from 200 to 320,000 UMA for the most serious ones, with an additional fine for repeat offenses. When the violation involves sensitive data, those amounts can be increased up to two times. Health data are, by definition, sensitive data, and at the UMA value in effect in 2026, the applicable ceiling sits above 75 million pesos.

The company isn't just responsible for the medical service existing. It's responsible for the record that service produces and for the system where that record lives.

What to do if your company already operates a medical service

If you already have a nursing station or clinic in operation, the useful question isn't whether you comply with article 504 — you probably do. The question is what happens to the records that service has been generating for years.

Points that tend to get overlooked

In large operations, these are the three points that surface when someone takes a close look:

• Who can see the clinical detail. The Reglamento Federal de Seguridad y Salud en el Trabajo is explicit: the service's physicians must report the worker's fitness for work to the employer, not the diagnosis, "with full respect for the confidentiality required by medical ethics" (art. 50). If HR has access to a colleague's diagnosis instead of only their fitness status, any later labor decision about that person is exposed to being challenged. The access itself becomes the evidence.
• Where the historical records live. Files from older plants, local backups, and paper records are also the company's responsibility.
• Whether the current system is certified. The list of NOM-024-certified systems is public and can be checked. If the system you use doesn't appear on it, that's your answer.

The obligation to operate a medical service is the starting point, not the finish line. What actually defines your company's real risk is how the clinical information that service produces every day gets managed.