NOM-024 is not a feature you add

SAM is ophthalmology software running in a working eye clinic. Since late 2024 the work has been dominated by NOM-024-SSA3, the Mexican standard for electronic health records — which is not a feature you add to a product but a shape the whole record has to take.

You cannot pause a clinic to do that. The standard reaches into catalogues, provider and organisation data, outpatient and hospital-discharge structures, territories and postal codes, while the same system keeps booking appointments, holding clinical records and following up surgical cases — three kinds of record that are not interchangeable.

So it ran as a programme, not a project: an audit, a pre-verification, sessions with the health authority, then field-by-field validation that has continued since, including nine numbered rounds in a single month. An ISO 27001 security management system was built alongside it.

Work at that length changes what the job is. A large part of it was pair programming, code review, onboarding engineers and training at the clinic — because a standard only the supplier understands is a risk the client is carrying, not one anybody removed.