EHS for the Healthcare Industry in Mexico
Manage COFEPRIS licenses, RPBI, radiation and civil protection by facility. Standardize compliance by service type, control Responsible Health Professionals, and keep evidence organized for inspections at any time.
Five authorities. Dozens of NOMs.
The healthcare sector in Mexico operates under multiple overlapping authorities and regulations. Understanding who regulates what and anticipating penalties for non-compliance is key to keeping operations risk-free.
COFEPRIS
Federal Commission for Protection against Sanitary Risks
Dominant in the sector, it issues two authorizations: a Health License for surgery, radiation or blood banks, and an Aviso de Funcionamiento for clinics, laboratories and pharmacies. Both require a Responsible Health Professional. The Sanitary Operation Commission inspects via DIGIPRiS; non-compliance triggers closure, fines or revocation.
SEMARNAT / NOM-087
Secretariat of Environment and Natural Resources
Every facility generates Biological-Infectious Hazardous Waste (RPBI). NOM-087 classifies levels (I, II, III) by daily beds or samples, dictating storage, collection and reporting requirements. SEMARNAT and PROFEPA monitor compliance; violations result in closure and criminal liability for the establishment.
Secretariat of Health
SSA3 NOMs
NOM-SSA3 standards define infrastructure requirements: NOM-016 (hospitals), NOM-005 (outpatient), NOM-007 (laboratories) and NOM-004 (records). These are mandatory requirements for COFEPRIS approval.
CNSNS
Radiation and safety
Facilities with X-ray or PET equipment require a COFEPRIS license and NOM-229. Radiotherapy requires NOM-002-SSA3, and NOM-012-STPS regulates staff exposure. Dosimetry, equipment calibration and technical shielding verification are essential.
STPS
Risk management
Classified as high risk, they require patient evacuation plans. STPS applies NOM-002 (fire), NOM-005 (chemicals), NOM-017 (PPE), NOM-026 (signage) and NOM-035 (psychosocial).
WHY THE HEALTHCARE SECTOR IS DIFFERENT
Each service you add changes the compliance profile.
In healthcare, services dictate permits: an operating room triggers health licenses; radiology, radiation licenses; a laboratory, NOM-007. Compliance is not fixed, but evolves as the facility grows.
Service-driven permits
Consultations require an Aviso de Funcionamiento; surgery, a Health License; imaging, a radiation license (NOM-229); and laboratory, NOM-007. Each service triggers COFEPRIS processes.
RPBI level and waste
Level I clinics have minimal requirements. Level III hospitals (60+ beds) require refrigerated areas, authorized collection and management plans that scale dramatically.
Responsible health professional per facility
Each site requires a responsible professional registered with COFEPRIS. Surgery requires specialists and laboratories require NOM-007. Without a valid registration, operations are illegal.
Patient safety and EHS
Failures in shielding, RPBI or fires with bedridden patients are catastrophic. In healthcare, non-compliance risks lives, not just fines; the consequences are the highest.
Four types of healthcare facilities.
Four different compliance profiles.
Private Hospitals and Surgical Clinics
Hospitals with surgical or obstetric procedures require a COFEPRIS Health License. NOM-016-SSA3-2012 defines infrastructure down to the detail: sterile areas, ventilation and dimensions by service type. Level III generators (60+ beds) face the strictest RPBI requirements: refrigerated storage, max. 7-day retention, incineration of pathological waste and annual reporting to SEMARNAT.
Key Risk
HOW NAPSSOFT SOLVES IT
A hospital without a valid health license lacks legal basis to operate, implying total and immediate closure of the unit.
Improper RPBI handling leads to severe administrative sanctions and carries potential criminal liability for executives.
Civil protection inspections are critical; failures in hospital evacuation protocols are considered high-risk violations.
HOW NAPSSOFT SOLVES IT
Structure the comprehensive compliance catalog: COFEPRIS licenses, SSA3 standards, radiation management, RPBI, civil protection and STPS.
Automatically track the validity of the responsible health professional registration and manage waste collection contracts and manifests.
Link each compliance requirement to the hospital's specific services, enabling modular management that grows with the facility.
Key Permits/NOMs:
COFEPRIS health license
NOM-016-SSA3 infrastructure
RPBI management (NOM-087 Level II-III)
Radiation license / NOM-229
Medical gases and anesthesiology
STPS occupational safety + NOM-002
High-risk civil protection
Municipal license
Clinical and Diagnostic Laboratories
Clinical laboratories require a COFEPRIS Aviso de Funcionamiento, a Responsible Health Professional, and compliance with NOM-007-SSA3 for organization, staffing and biosafety.
RPBI management is classified by volume: Level I (1–50 samples/day), Level II (51–200) and Level III (200+). Chains with 10 to 50+ branches must manage NOM-087 compliance by location without losing quality accreditation.
Key Risk
HOW NAPSSOFT SOLVES IT
Laboratories that omit NOM-007 face immediate COFEPRIS closure and legal invalidation of their results.
Poor RPBI handling, especially sharps, creates critical infection risks and severe environmental sanctions.
In laboratory chains, a single branch's non-compliance triggers cascade COFEPRIS audits across the entire commercial network.
HOW NAPSSOFT SOLVES IT
Configure NOM-007 requirements along with digital RPBI management and responsible health professional records per location.
Track equipment calibration schedules and centralize evidence from quality control programs required by the authority.
Scale operational oversight from 5 to more than 50 branches, maintaining a uniform compliance standard across the entire chain.
Key Permits/NOMs:
COFEPRIS aviso de funcionamiento
NOM-007-SSA3 clinical laboratories
RPBI management (NOM-087 Level I-III)
Biosafety and chemical handling
Clinic Chains and Outpatient Care Networks
Networks of clinics, medical offices, dental chains and urgent care centers scale to 10, 50 or 100+ locations under NOM-005-SSA3. Each has a relatively straightforward compliance profile. The challenge is scale: Aviso de Funcionamiento, Responsible Health Professional, RPBI, civil protection and municipal licenses multiplied across dozens of states and municipalities. Adding services at a branch changes its individual profile.
Key Risk
HOW NAPSSOFT SOLVES IT
Operating 20 locations means managing 100+ individual permits; a single missing aviso de funcionamiento can cause branch closure.
High turnover of responsible health professionals creates legal compliance gaps if records are not updated with the authority immediately.
Lack of standardization in RPBI and civil protection management plans raises the risk of administrative sanctions across the clinic network.
HOW NAPSSOFT SOLVES IT
Standardize the baseline compliance catalog for all clinics, adapting specific requirements based on each location's services.
Track responsible health professional records in real time with expiration alerts to ensure legal coverage across the entire network.
Centralize municipal license and health permit management on a corporate dashboard showing the chain's compliance status.
Key Permits/NOMs:
NOM-005-SSA3 infrastructure
RPBI management (NOM-087 Level I)
Clinical records (NOM-004-SSA3)
STPS occupational safety
Civil protection
Minor surgery → health license
Imaging → radiation license
Laboratory → NOM-007-SSA3
Imaging Centers and Radiotherapy
Facilities with ionizing radiation require a separate COFEPRIS license per piece of equipment (COFEPRIS-05-024-A). NOM-229-SSA1 defines shielding, dosimetry, calibration and protection for operators and patients. Radiotherapy (NOM-002-SSA3) adds treatment planning and quality assurance. Nuclear medicine adds radioactive material management under CNEN. NOM-012-STPS regulates workers’ occupational exposure.
Key Risk
HOW NAPSSOFT SOLVES IT
Operating radiation equipment without a valid license goes beyond administrative violations and constitutes a criminal offense with serious legal consequences.
Equipment calibration failures compromise patient safety by delivering incorrect radiation doses outside medical standards.
Exceeding exposure limits triggers STPS interventions, while improper radioactive waste handling triggers SEMARNAT and CNSNS sanctions.
HOW NAPSSOFT SOLVES IT
Manage radiological compliance in a specialized manner, tracking licenses per equipment, dosimetry records and technical shielding verification.
Link worker dosimetry monitoring with NOM-012-STPS requirements, ensuring an auditable and safe exposure history.
Centralize and synchronize permit management before CNSNS (National Nuclear Safety and Safeguards Commission) and COFEPRIS on a single platform.
Key Permits/NOMs:
COFEPRIS radiation license
NOM-229-SSA1 X-ray
NOM-002-SSA3 radiotherapy
CNEN nuclear medicine permits
Civil protection
Dosimetry + verified shielding
NOM-012-STPS occupational exposure
Municipal license
configured for your industry
From regulatory chaos to clinical-grade compliance.
A system that understands health regulation in Mexico, not a generic document manager you have to adapt per location.
Civil Protection in Healthcare
Radiation Compliance
RPBI Management by Level
Configuration by Facility
Sanitary Officer Control
Permit Catalog — HEALTHCARE
Comprehensive permit and NOM base for healthcare facilities in Mexico.
Final catalogs are configured by facility type, services offered, RPBI level and municipality during onboarding.
| Health license | COFEPRIS | Per facility | Critical | Health license (hospital, operating room, obstetrics, etc.) |
| Notice of operation | COFEPRIS | Per facility | Critical | Filing receipt and evidence |
| Registration of the health officer in charge | COFEPRIS | Per facility | Critical | Registration and credentials |
| Health construction permit | COFEPRIS | Per project | High | Permit (new facilities) |
| License for radiation-emitting equipment (X-rays, CT, radiotherapy) | COFEPRIS | Per equipment | Critical | License by modality |
| Authorization of the radiation safety officer | COFEPRIS | Per facility | Critical | Permits and accreditations |
| NOM-016-SSA3 – Minimum infrastructure and equipment requirements for hospitals and medical offices | Secretariat of Health | Ongoing | Critical | Infrastructure compliance evidence |
| NOM-005-SSA3 – Infrastructure and equipment requirements for outpatient care | Secretariat of Health | Ongoing | High | Compliance evidence (clinics and medical offices) |
| NOM-007-SSA3 – Organization and operation of clinical laboratories | Secretariat of Health | Ongoing | Critical | Organizational evidence and quality control |
| NOM-006-SSA3 – Anesthesiology practice | Secretariat of Health | Ongoing | Critical | Compliance evidence for surgical procedures |
| NOM-004-SSA3 – Medical record | Secretariat of Health | Ongoing | High | Evidence of the medical records system |
| NOM-229-SSA1 – Facilities and radiological protection for X-ray equipment | Secretariat of Health | Ongoing | Critical | Shielding, dosimetry, and verifications |
| NOM-002-SSA3 – Radiotherapy services | Secretariat of Health | Ongoing | Critical | Quality assurance program (radiotherapy only) |
| NOM-087-SEMARNAT-SSA1 – Management of Hazardous Biological-Infectious Waste (RPBI) | SEMARNAT / SSA | Ongoing | Critical | Management plan, manifests, and training |
| Registration as an RPBI generator | SEMARNAT | Registration | High | Classification and registration evidence |
| RPBI collection contract | Authorized company | Annual | Critical | Contract and manifests |
| CNEN nuclear medicine permits | Competent authority | Per radioactive source | Critical | Applicable permits (nuclear medicine only) |
| Medical equipment calibration records | In-house / Vendor | Periodic | High | Calibration certificates |
| Dosimetry monitoring for occupationally exposed personnel | Competent authority | Periodic | High | Exposure records |
| NOM-002-STPS – Fire prevention and protection | STPS | Ongoing | High | Program and equipment evidence |
| NOM-005-STPS – Handling of hazardous chemicals | STPS | Ongoing | Medium | Procedures (medical gases and chemicals) |
| NOM-017-STPS – Personal protective equipment | STPS | Ongoing | Medium | PPE matrix and records |
| NOM-035-STPS – Psychosocial risk factors | STPS | Ongoing | High | Assessment and action plan |
| NOM-030-STPS – Preventive occupational health and safety services | STPS | Ongoing | Medium | Annual program |
| Internal Civil Protection Program | State / Municipal Civil Protection | Annual | Critical | Plan, drills, and brigades |
| Evacuation and emergency response plan | Civil protection | Ongoing | Critical | Plan tailored for patients and visitors |
| NOM-251-SSA1 – Hygiene practices for processing foods, beverages, or dietary supplements | COFEPRIS | Ongoing | High | Hygiene program (if there is a kitchen or cafeteria) |
| NOM-031-SSA3 – Care for vulnerable populations | Secretariat of Health | Ongoing | High | Compliance evidence (nursing homes, geriatric facilities, etc.) |
| Municipal operating license | Municipality | Variable | Medium | License and payment receipts |
| Safety of medical gas installations | Competent authority | Periodic | High | Certificates and verifications of the medical gas system |
Not all permits apply to all facility types. The catalog is configured by facility type and services during onboarding. Critical = risk of closure. High = fines + restrictions. Medium = administrative.
Ideal profiles for NAPSsoft EHS in healthcare.
Third-Party Management
Specialists who audit technical evidence and ensure operational continuity of medical networks during federal inspections.
EHS Consulting Firms: Health
Firms that coordinate compliance for multiple clients and require unifying permit tracking per site type.
Outpatient clinics
They manage operating notices, sanitary representatives, and civil protection across dozens of sites in various municipalities.
Imaging and radiotherapy
Sites with radiation licences, equipment calibration, dosimetry, and strict compliance with NOM-229 and NOM-002-SSA3.
Laboratory Chains
Networks with NOM-007, quality control, and RPBI in 10 to 50+ branches with variable sample volumes and biosafety.
Hospital Groups
They operate multiple sites with COFEPRIS licenses, NOM-016 infrastructure, Level II-III RPBI, and critical radiation permits.
Third-Party Management
Specialists who audit technical evidence and ensure operational continuity of medical networks during federal inspections.
EHS Consulting Firms: Health
Firms that coordinate compliance for multiple clients and require unifying permit tracking per site type.
Outpatient clinics
They manage operating notices, sanitary representatives, and civil protection across dozens of sites in various municipalities.
Imaging and radiotherapy
Sites with radiation licences, equipment calibration, dosimetry, and strict compliance with NOM-229 and NOM-002-SSA3.
Laboratory Chains
Networks with NOM-007, quality control, and RPBI in 10 to 50+ branches with variable sample volumes and biosafety.
Hospital Groups
They operate multiple sites with COFEPRIS licenses, NOM-016 infrastructure, Level II-III RPBI, and critical radiation permits.
STRATEGIC Shielding for Mitigation