A common and important question from U.S. patients considering treatment at Oceánica in Mexico is: “Does HIPAA protect my medical information when I receive treatment abroad?” The direct answer is that HIPAA, as a U.S. federal law, applies to U.S. healthcare providers and their business associates — not to foreign healthcare providers operating outside the United States.
But this doesn’t mean your medical information is unprotected at Oceánica. Mexico has its own health privacy protections, and Oceánica maintains privacy practices consistent with protecting patient confidentiality as a core clinical and ethical commitment.
HIPAA’S GEOGRAPHIC LIMITS
HIPAA (the Health Insurance Portability and Accountability Act of 1996) is a U.S. federal law that establishes standards for protecting identifiable health information. HIPAA applies to:
- U.S. healthcare providers that conduct electronic healthcare transactions
- U.S. health plans
- U.S. healthcare clearinghouses
- Business associates of the above
HIPAA does not apply to foreign healthcare providers, including Mexican hospitals, clinics, and treatment centers. When you receive treatment at a Mexican healthcare facility, HIPAA’s specific legal requirements don’t govern how that facility handles your health information.
This is not unique to Mexico — receiving medical treatment in any country outside the U.S. means the treatment is governed by that country’s laws, not HIPAA.
MEXICO’S EQUIVALENT PRIVACY LAWS
Mexico has its own legal framework for health information privacy that provides meaningful protections.
Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP):
Mexico’s primary data privacy law — the Federal Law on Protection of Personal Data Held by Private Parties — establishes requirements for how private organizations collect, use, protect, and share personal information, including health information. Key principles include:
- Consent: personal data requires the consent of the data subject for collection and use.
- Information: data subjects must be informed about how their data will be used.
- Purpose limitation: data can only be used for the purposes for which it was collected.
- Security: data holders must implement security measures to protect personal data.
- Access and correction rights: individuals have rights to access and correct their personal data.
This framework provides meaningful privacy protection, though its specific provisions differ from HIPAA’s detailed requirements.
NOM-024-SSA3 (Mexican health records standard):
Mexico has specific healthcare standards (Normas Oficiales Mexicanas) governing clinical records, including confidentiality obligations for healthcare providers. These standards establish professional and legal obligations for healthcare providers to maintain patient information confidentially.
Professional ethics:
Mexican healthcare professionals are subject to professional ethics codes that include confidentiality obligations — just as U.S. healthcare providers are. The physician-patient confidentiality principle exists in Mexican professional practice independent of the specific legal framework.
OCEÁNICA’S PRIVACY PROTOCOLS
While the specific legal framework differs from HIPAA, Oceánica maintains privacy practices that protect patient confidentiality as a core clinical and operational commitment.
Oceánica’s practical privacy commitments:
Patient information is kept confidential and is not disclosed to third parties without patient consent. Specifically:
- Oceánica does not share patient information with employers, family members, law enforcement, or others without the patient’s specific written consent.
- Treatment records are maintained securely.
- Staff are trained in patient confidentiality obligations.
- Admissions information is handled discreetly.
Patients arriving at Oceánica for treatment without wanting anyone to know they are there can maintain that confidentiality — Oceánica’s staff will not confirm or deny whether a specific individual is a patient without the patient’s authorization.
Note on 42 CFR Part 2:
In the U.S., substance use disorder treatment records receive additional privacy protection beyond standard HIPAA — under 42 CFR Part 2, which requires specific patient consent for any disclosure of substance use treatment records, with very limited exceptions. 42 CFR Part 2 also applies specifically to U.S. providers, not to foreign providers. Oceánica maintains equivalent confidentiality practices for substance use treatment records consistent with the spirit of these heightened protections.
SHARING RECORDS WITH U.S. PROVIDERS
After completing treatment at Oceánica, sharing records with U.S.-based continuing care providers is an important aftercare step. The process:
With your consent, Oceánica can provide:
- A treatment summary documenting diagnoses addressed, treatment approach, medications at discharge, and aftercare recommendations
- Specific records requested by U.S. providers (primary care physician, outpatient therapist, psychiatrist)
How records are shared:
- Oceánica shares records only with the patient’s explicit consent
- Records can be transmitted securely to U.S. providers by email (encrypted where possible), fax, or through the patient’s own hands
- The treatment summary is typically provided to the patient at discharge and can be shared with U.S. providers directly
U.S. providers receiving records from foreign providers:
When U.S. providers receive records from foreign providers, those records become part of the U.S. provider’s medical record system — and at that point, HIPAA governs how the U.S. provider handles the information. So once Oceánica’s records are in a U.S. provider’s system, HIPAA protections apply to that U.S. provider’s handling of the information.
COMMON PATIENT QUESTIONS
“Can Oceánica tell my employer I’m there?”
No. Without your explicit authorization, Oceánica will not confirm to any third party — employer, family member, or other — that you are a patient at the facility. Your presence in treatment is confidential.
“Can Oceánica share my information with U.S. authorities?”
Without a valid legal order (court order or other lawful process), Oceánica does not voluntarily share patient information with U.S. or Mexican authorities. Patients in treatment are not at heightened risk of information disclosure to law enforcement.
“Will my treatment in Mexico appear on my health insurance records in the U.S.?”
Since Oceánica doesn’t bill U.S. insurance directly, treatment at Oceánica doesn’t appear on U.S. health insurance records unless you submit a claim for reimbursement. Paying out of pocket for international treatment is one of the ways patients maintain maximum privacy.
FREQUENTLY ASKED QUESTIONS
Does HIPAA protect my information at Oceánica in Mexico?
No. HIPAA applies to U.S. healthcare providers and their business associates, not to foreign providers. Treatment at Oceánica is governed by Mexican privacy law, which provides its own framework of health information protections.
What privacy protections does Mexico have for health information?
Mexico’s Federal Law on Protection of Personal Data (LFPDPPP), healthcare-specific Normas Oficiales Mexicanas, and professional ethics codes for healthcare providers all establish privacy protections for patient health information. The specific framework differs from HIPAA but provides meaningful privacy protection.
Can Oceánica tell anyone I’m a patient?
Without your explicit authorization, Oceánica maintains the confidentiality of whether you are a patient. Your employer, family members not authorized by you, and other third parties will not be informed of your presence in treatment without your consent.
Will treatment in Mexico appear on my U.S. insurance records?
Not if you pay out of pocket and don’t submit a reimbursement claim. Since Oceánica doesn’t bill U.S. insurance directly, no claim is automatically filed. This is one dimension of the privacy advantage of out-of-pocket international treatment.
Recommended Reading
- Is Rehab in Mexico Confidential?
- Is Rehab in Mexico Safe?
- Admissions Process at Oceánica
- Services and Programs at Oceánica
EXTERNAL REFERENCE LINKS
Oceánica is a CARF-accredited residential treatment center in Mazatlán, Mexico. Patient confidentiality is a core commitment of Oceánica’s practice. This article is informational and not legal advice. Call (213) 527-3377 or visit oceanica-usa.com.
