Healthcare in Latin America
Clinical records are kept for up to twenty years. The encryption on them may not last that long.
Brazil, Colombia, Chile and Mexico each require clinical records to be kept for years after the last visit. A record whose protection rests on public-key cryptography can be copied today and read once a quantum computer can break that cryptography. The retention period is how long it has to hold.
Retention
How long each record must be kept.
Minimum retention periods, counted from the last entry or the last visit. Each is the text of the rule, with our translation.
“Decorrido o prazo mínimo de 20 (vinte) anos a partir do último registro, os prontuários em suporte de papel e os digitalizados poderão ser eliminados.”
Our translation · Paper and digitized patient records may be destroyed once at least 20 years have passed since the last entry.
“La historia clínica debe retenerse y conservarse por el responsable de su custodia, por un periodo mínimo de quince (15) años, contados a partir de la fecha de la última atención.”
Our translation · The clinical record must be kept by whoever holds it for at least fifteen years from the date of the last visit. The same article doubles the period for victims of human-rights violations.
“Los prestadores deberán conservar la ficha clínica por un período de al menos quince años.”
Our translation · Providers must keep the clinical record for at least fifteen years.
“[...] deberán ser conservados por un periodo mínimo de 5 años, contados a partir de la fecha del último acto médico.”
Our translation · Clinical records must be kept for at least 5 years from the date of the last medical act.
The other side of the clock
How soon the cryptography may break.
Probability bands from the Global Risk Institute Quantum Threat Timeline Report 2025 (Mosca and Piani, published March 2026, 26 experts surveyed).
What the rules say
What the rules say about protecting them.
“dado pessoal sensível: dado pessoal sobre [...] dado referente à saúde ou à vida sexual, dado genético ou biométrico, quando vinculado a uma pessoa natural”
Our translation · sensitive personal data: personal data about [...] health or sex life, genetic or biometric data, when linked to a natural person
Health data is sensitive personal data.
Read the source“Os agentes de tratamento devem adotar medidas de segurança, técnicas e administrativas aptas a proteger os dados pessoais de acessos não autorizados”
Our translation · Processing agents must adopt technical and administrative security measures able to protect personal data from unauthorized access
The duty to protect is general; the law leaves the technique to the processor.
Read the source“No processo de digitalização será utilizado certificado digital emitido no âmbito da Infraestrutura de Chaves Públicas Brasileira (ICP-Brasil) ou outro padrão legalmente aceito.”
Our translation · Digitization shall use a digital certificate issued under the Brazilian Public Key Infrastructure (ICP-Brasil) or another legally accepted standard.
A digitized record rests on a public-key certificate, which has to stay trustworthy for as long as the record is kept.
Read the source“Con fines de intercambio de información entre Prestadores de Servicios de Salud los SIRES deben implementar mecanismos de autenticación, de cifrado y de firma electrónica avanzada”
Our translation · For exchanging information between health service providers, electronic health record systems must implement authentication, encryption and advanced electronic signature mechanisms
Record systems that exchange data must encrypt and sign it. The health ministry certifies systems against this standard.
Read the source“se entiende por datos sensibles aquellos que afectan la intimidad del Titular [...] así como los datos relativos a la salud, a la vida sexual y los datos biométricos”
Our translation · sensitive data means data that affect the privacy of the data subject [...] as well as data concerning health, sex life and biometric data
Health data is sensitive data.
Read the source“El responsable de datos debe adoptar las medidas necesarias para resguardar el cumplimiento del principio de seguridad establecido en esta ley, considerando el estado actual de la técnica”
Our translation · The data controller must adopt the measures needed to uphold the security principle of this law, taking into account the current state of the art
Security is measured against the state of the art. The law was published on 13 December 2024 and applies from 1 December 2026.
Read the sourceNone of these rules mentions quantum computers or post-quantum cryptography, and none sets a date for it. The case rests on two things stated with their sources: how long a record must be kept, and how soon a quantum computer may break the public-key cryptography protecting it.
What an assessment gives you
Each part, against what it serves.
They become the first term of the ranking: how long each record system’s data must stay secret, taken from the rule that applies to it rather than guessed.
The inventory: the cryptography in the code and dependency manifests of the record systems you give us, each finding with the file and line where it was seen, including the key exchange and signatures that exchanges and digitized records rely on.
The migration plan and the evidence file: what to replace first given those retention periods, sealed as linked, signed records an auditor can check offline.
What this is not
- This is not legal advice or a certification under any of these laws.
- The assessment covers the systems you put in scope. Cryptography we are not shown is not in the inventory.
- The retention periods are minimums. Longer periods set by other rules, or by your own policy, extend the exposure.
Next
See what the deliverable looks like.
The sample is a made-up bank, not a hospital, but it shows the method: an inventory, a ranking by how long data must stay secret, and a plan.
Quotations read from the official texts on 21 September 2026: planalto.gov.br, dof.gob.mx, secretariasenado.gov.co, minsalud.gov.co and leychile.cl. Translations are ours.