The collection of biometric data in the Universal Health Service aims to modernize the system and launch a physical and digital credential for users. That document will allow to accredit the right to benefits, consult the availability of hospitals and medical units and access the electronic clinical record.
Limited access and under authorization
Access to personal information linked to that system is subject to the authorization of the owner or a duly justified judicial order. The applicable regulation also sets express limits on the processing of that information, by establishing that biometric data cannot be used for purposes unrelated to the health system.
The General Law on Protection of Personal Data in Possession of Obligated Subjects prohibits that different use and foresees consequences if those guarantees are violated. Improper use or transfer without authorization can lead to administrative or criminal sanctions.
Interoperability only with express consent
The interoperability between IMSS, ISSSTE and IMSS Bienestar will not be automatic. It will only be activated when there is express consent from each person. That point marks one of the axes of the model proposed for 2026, which places the control of the data in the hands of the owner.
"One is the owner of personal data" - Claudia Sheinbaum, president
The official position in Mexico during 2026 maintains that the biometric data of the Universal Health Service are under national control. Along the same lines, it is assured that there are no international agreements that allow transferring that information to foreign entities.
Credential for procedures and clinical consultation
The future credential is presented as a tool to simplify procedures within the healthcare system. In addition to verifying each user's coverage, it will serve to check which hospitals and medical units have availability and to access the electronic clinical record, always within the foreseen legal margins.
The announced framework rules out the international transfer of biometric data and conditions any exchange between institutions on the express permission of the citizen, with a scheme that places the protection of personal information as one of the central elements of the new healthcare model.