How to Request Your Imaging Records in Mexico (Medical Records and ARCO Rights)

2026-10-27

Leer en español: Cómo pedir mis estudios de imagen en México.

You had an MRI, a CT scan or a mammogram in Mexico, and now a doctor, maybe in another city or another country, asks for your "previous studies". The center gave you only the written report, or the disc got lost, or you never received anything. How do you request your imaging records in Mexico, and what is the provider required to give you?

This guide summarizes the Mexican rules in plain English and gives you a short request, in Spanish, that you can hand in.

This is not legal advice. It is a plain-language summary of public regulations, reviewed in October 2026. Laws change and every case is different. If you are in a dispute with a provider, talk to a lawyer.

The short version

The record belongs to the provider, but the information is yours. Mexico's clinical-record standard, NOM-004, says the record is the property of whoever creates it, and that the patient holds rights over the information in it.
Your images are part of the record. The standard explicitly includes imaging documents.
Health data is "sensitive" personal data, and you have the right to access it. In Mexico this is the A in ARCO rights: Access, Rectification, Cancellation and Opposition.
There are deadlines. In general, the provider has up to 20 business days to answer and 15 business days more to hand over what you asked for.
It is free. They may charge only for reproduction, copies or shipping, and if you bring the medium (a blank disc or a USB drive), they must hand it over at no cost.

What NOM-004 says about the clinical record

NOM-004-SSA3-2012 is the official standard for the expediente clínico (clinical record). It applies to public, social and private healthcare facilities.

What the record is (section 4.4). A single set of a patient's information and personal data, made up of written, graphic, imaging ("imagenológicos"), electronic, magnetic and optical documents, among others.
Who owns it (section 5.4). Records are the property of the institution or provider that creates them, but the patient, as the source of the information and the person being cared for, holds rights over it. The same section requires providers to keep records for at least 5 years after the last medical act. So ask early: after that, the law no longer requires them to keep it.
The clinical summary (sections 4.10 and 5.6). A resumen clínico is a document written by a doctor with the key points of your care (at minimum: current condition, diagnoses, treatments, progress and prognosis). The standard says it must be requested in writing.

What the 2025 data-protection laws say

On March 20, 2025, Mexico published two new data-protection laws, in force the next day. Both treat data about your health as sensitive. Which one applies depends on who holds your images.

Private hospitals, clinics and imaging centers fall under the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP):

You have the right to access your personal data (art. 22).
Each provider must name a person or department to handle requests (art. 29), usually listed in its privacy notice (aviso de privacidad).
Your request needs your name and a way to reach you, proof of identity, the right you are exercising, and anything that helps them find your data (art. 28).
They must answer within 20 days and, if the request is granted, deliver within 15 days of answering; each deadline can be extended once, if justified (art. 31). The law counts business days (art. 2).
Access is free; they may charge only to recover reproduction, copy or shipping costs, and if you provide the medium, at no cost (art. 34).
If they don't answer, or you disagree, you can file a complaint with the Secretaría Anticorrupción y Buen Gobierno (Anti-Corruption and Good Governance Ministry), which took over the data-protection role of the former INAI, within 15 days of their answer or after their deadline lapses (art. 40).

Public institutions (IMSS, ISSSTE, federal or state health ministry hospitals) fall under the General Law on Protection of Personal Data Held by Obligated Subjects (LGPDPPSO):

You file with the institution's Unidad de Transparencia (transparency unit), in writing or by the electronic means it offers, and you get a receipt (art. 46).
They have 20 business days to answer (extendable once by up to 10) and 15 to deliver (arts. 3 and 45).
It is free except reproduction, certification or shipping; free if you bring the medium, and free for up to twenty plain pages (art. 44).
If the institution has its own procedure for record copies, it must tell you within 5 days (art. 48).
You can appeal (recurso de revisión) within 15 days of the answer (art. 86).

Step by step

Ask on the day of the exam. Many centers burn the disc on the spot if you ask at the front desk. It is the fastest route.
Find the right desk. At a private provider, look up the data-protection contact in its privacy notice. At a public institution, ask for the Unidad de Transparencia.
Ask for exactly what you need. The images in their original digital format (DICOM) on a disc or USB drive, the radiologist's report, and, if you need it, a clinical summary. If you only ask for "my results", you may get only paper.
Ask in writing, with ID. Bring a copy of your official ID (and, if you ask on someone's behalf, proof that you represent them).
Bring your own medium, if they accept it. A blank disc or a new USB drive. Some places don't accept USB drives for security reasons; ask first.
Keep your receipt. A copy of your request with a received stamp or date. Deadlines run from it, and you need it for any complaint.

A request you can copy (in Spanish)

Providers in Mexico will expect the request in Spanish. Fill in the brackets:

Asunto: Solicitud de acceso a mis datos personales: copia de mis estudios de imagen

[Ciudad], a [fecha]

A quien corresponda, [nombre del hospital, clínica o laboratorio] (departamento de datos personales / Unidad de Transparencia):

Yo, [nombre completo], con fecha de nacimiento [fecha], en ejercicio de mi derecho de acceso a mis datos personales, solicito copia de:

Las imágenes de mis estudios de [tipo de estudio], realizados el [fecha o periodo aproximado], en su formato digital original (DICOM), grabadas en [CD/DVD o USB].

La interpretación (informe) del radiólogo de cada estudio.

[Opcional] Un resumen clínico de mi atención, conforme a la NOM-004-SSA3-2012.

Para localizar mi información: [número de expediente, folio o número de afiliación].

Anexo copia de mi identificación oficial. Recibo respuesta en: [correo electrónico, teléfono o domicilio].

Atentamente, [Firma y nombre]

In English, it says: "In exercise of my right of access to my personal data, I request a copy of (1) the images of my [type of study] from [date], in their original digital format (DICOM), on [CD/DVD or USB]; (2) the radiologist's report for each study; (3) optionally, a clinical summary under NOM-004-SSA3-2012," followed by identifiers, a copy of your ID and how to reach you.

Once you have your discs

You may end up with several discs from different places. MIA Toolkit is a free app for Mac and Windows that copies those discs onto your computer, shows you an inventory of what each one contained, and puts everything on one USB drive with a standard index (DICOMDIR). It works offline, with no account and no cloud: your images never leave your computer. (Why your medical images belong to you, and how to share them on one USB.)

MIA Toolkit is a file-management tool: it copies, organizes and converts imaging studies. It does not interpret images and does not replace your doctor. If you have questions about your health or which studies you need, talk to your doctor.

You can download MIA Toolkit for free and follow the step-by-step guide. More patient guides are on the patients page. Questions: support@miatools.tech.

Reminder: this is not legal advice. It is general information about public regulations. For your specific case, talk to a lawyer.

Sources

Secretaría de Salud. NOM-004-SSA3-2012, Del expediente clínico. Diario Oficial de la Federación, October 15, 2012. Sections 4.4, 4.10, 5.4 and 5.6.
Ley Federal de Protección de Datos Personales en Posesión de los Particulares. New law published in the DOF on March 20, 2025; current consolidated text from the Chamber of Deputies (last amended DOF 2025-11-14). Articles 2, 22, 28, 29, 31, 34 and 40.
Ley General de Protección de Datos Personales en Posesión de Sujetos Obligados. New law published in the DOF on March 20, 2025; current consolidated text from the Chamber of Deputies (last amended DOF 2025-11-14). Articles 3, 44, 45, 46, 48 and 86.

FAQ

How do I request my imaging records in Mexico? In writing, with your ID, to the data-protection contact of the private provider that did the study, or to the Unidad de Transparencia of a public institution. Ask for the images in DICOM format, the radiologist's report and, if needed, a clinical summary.

Can they refuse because the record belongs to the hospital? NOM-004 says the record is the provider's property, but that you hold rights over the information, and the data-protection laws give you a right of access. The laws allow refusal only in limited cases, for example if you can't prove your identity, and the provider must tell you why.

How long does it take? In general, up to 20 business days to answer and 15 more to deliver, with possible extensions. Many centers burn a disc the same day if you ask right after the exam.

Can they charge me? Access is free. They may charge only for reproduction, copies or shipping, and if you bring the disc or USB drive, they must hand it over at no cost.

What happened to the INAI? The INAI was dissolved. For data held by private parties, its role passed to the Secretaría Anticorrupción y Buen Gobierno. For public institutions, complaints follow the review appeal set out in the general law.

← Back to the blog