Risk Considerations for Using Surveillance Cameras in Healthcare Practices
Marcy A. Metzgar
Some providers are installing surveillance cameras in their healthcare practices. They may choose to do so because they want to protect and secure the equipment, records, and medications in their offices; their employees; and their patients. Some wish to prevent access into their practices by unauthorized individuals that may result in theft, violence, or patient record violations. Others want to prevent any physical or verbal abuse that may occur. And some appreciate being able to monitor their practices remotely.
These providers should carefully consider the purpose for installing surveillance cameras to balance their security concerns with their obligation to safeguard their patients’ protected health information (PHI) and comply with HIPAA privacy and security requirements.
No specific federal rule addresses surveillance cameras in medical or dental offices. However, it’s imperative that providers are aware of their state laws and regulations that apply to recording. For example, some states allow audio recording if at least one party to the conversation consents. In other states, all parties must consent to the recording. State laws also might differ regarding telephone versus in-person recording requirements.1
Before installing surveillance systems, providers should devise a written policy that identifies their purpose for doing so, the locations of the security cameras, employee notification method, signage posting, system security, privacy considerations, and archiving. The policy should include how the data will be securely stored, how the footage showing an incident from the security cameras will be maintained, as well as specify who will manage the system, who will have access to the files, and under what circumstances.
Providers should determine the type of surveillance that is most appropriate and lawful in their state — live monitoring vs. recording — and include procedures in their written policy regarding the retention and release of recorded video. Depending on state law, providers may also need to be prepared to respond to legal and patient requests to view surveillance tapes or supply a copy of the recordings.
Since the laws and regulations differ from state to state, providers also may consider consulting their professional liability carrier, an attorney, or a compliance officer to discuss recording as well as HIPAA implications.
Here are some steps to take when installing surveillance cameras:2
- Install security cameras in visible (not concealed) common areas, such as the waiting room. You may also choose to put video surveillance in areas where important equipment is placed or where prescription medications are stored. Cameras should not be placed in exam rooms, bathrooms, employee lunch or break rooms, or other areas where patients and employees have a reasonable expectation of privacy.
- Ensure that the system is secured both physically (i.e., locked in a cabinet) and digitally (i.e., password protected).
- Ensure that the cameras are positioned to avoid any view of patients’ PHI, including information on charts or a computer screen.
- Inform all employees, in writing, that surveillance cameras are being used in the office. Your employees also should sign an acknowledgment form about the cameras, which should be filed in their human resources file.
- Post signage indicating that security cameras are in use. If 5 percent or more of your patients do not speak English, ensure that the signage appears in a second language.
- Consider having your patients sign consent forms that indicate video security is in place. Include on this form how long you intend to store video data that could include recordings of patients.
For information related to patients wishing to record audio or video in healthcare practices, see MedPro’s Risk Q&A: Audio/Video Recording in Healthcare Practices.
Endnotes
1 Justia. (2018). Recording phone calls and conversations. Retrieved from www.justia.com/50-state-surveys/recording-phone-calls-and-conversations/
2 California Dental Association. (2019, October 31). Before recording, protect private patient information. Sacramento, CA: Regulatory Compliance News. Retrieved from www.cda.org/Home/News-and-Events/Newsroom/Article-Details/before-recording-protect-private-patient-information; Valentine, M. (2020, January 24). Security cameras in the medical office. Cooperative of American Physicians. Retrieved from https://www.capphysicians.com/articles/security-cameras-medical-office
