Other than surveillance cameras inside clinics and hospitals, consultations between doctors and patients may also be recorded for medical research and documentation purposes. As such, the act of video recording patients may raise concerns. Questions like “Does HIPAA apply to video recordings?” may also arise.
This post delves deeper into the HIPAA regulations related to video recording patients and whether such recordings have specific privacy and security requirements.
Table of Contents
Is Recording a Patient a HIPAA Violation?
Video recordings and surveillance have specific HIPAA implications for healthcare organizations. The HIPAA Rules clearly state that medical providers must always protect a patient’s protected health information (PHI). The lack of proper implementation could warrant a HIPAA violation, eventually leading to legal and financial repercussions.
Indoor surveillance
For indoor cameras, covered entities can record videos in public areas such as entrances, exits, waiting rooms, and hallways. These areas are the most difficult places to monitor because of high levels of foot traffic. With a surveillance camera, you can see who entered the facility and identify any potential threat that may lead to incidents.
Under HIPAA, healthcare facilities cannot place security cameras in bathrooms or changing rooms. It’s important to check if public areas are located next to a restroom to avoid capturing any private or sensitive footage.
Outdoor surveillance
For outdoor places like parking lots and garages, visible cameras must be placed around the building to detect any criminal activity. This will help monitor staff, patients, and vehicles entering and leaving the facility. Generally, HIPAA prohibits the placement of security cameras in areas where people have a reasonable expectation of privacy.
Footage with access to PHI
HIPAA requires healthcare facilities to identify any cameras installed in physical spaces with access to PHI. These include labs or operating rooms with a view of computer screens displaying PHI. As per the guidelines set by HIPAA, video recording patients in these areas requires additional security features to protect sensitive information. You can accomplish this by restricting access or implementing configurable privacy masks that blackout a computer monitor.
When Does HIPAA Apply to Video Recording?
HIPAA applies to video recordings when the films or images are used other than a patient’s diagnosis, treatment, or identification. Obtaining consent from a patient or an authorized family member is needed to provide awareness of how their videos and photos will be used. Furthermore, the hospital staff are strictly prohibited from using their personal devices when getting images and footage related to patient care.
If the recordings are primarily for educational purposes, HIPAA requires removing patient identifiers. Additionally, the Institutional Review Board (IRB) must approve the video surveillance used for research. However, consent may not be necessary to protect patient security in cases of neglect or abuse.
Ethical and Legal Implications of Video Recording Patients
The recording of conversations and activities between patients and healthcare staff can pose significant risks. These may include loss of control over the use of photos and videos, which can create legal and ethical implications.
Privacy concerns
Patients often compromise their sensitive information due to breaches and unauthorized access. Hackers may use the information taken from video recordings to make fraudulent transactions. Moreover, the moment you enter the institution’s premises, all your actions are recorded without your knowledge. Private conversations may also be captured by surveillance cameras, which could breach patient confidentiality.
Loss of control over the recording
Despite HIPAA’s efforts to protect patient privacy, healthcare facilities still have complete control over what’s being recorded in their surveillance cameras. As a result, the recording may be edited or tampered with, which could be posted and shared on social media platforms without the patient’s consent. It can also be a form of coercion or intimidation because the footage could get exploited for malicious purposes.
HIPAA-Compliant Patient Video Recording: Best Practices
Since HIPAA requires the confidentiality of protected health information (PHI), covered entities must comply with proper video recording practices. For proper handling of video recordings, follow these HIPAA-compliant strategies in healthcare settings:
Conduct a risk analysis
Make sure to perform risk assessments before installing video surveillance cameras. This can help identify any vulnerabilities associated with patient privacy. By doing so, you can create remediation plans and revise your current security policies and procedures accordingly.
Secure video storage and access
Place your surveillance monitors in a restricted area accessible by authorized employees. Passersby must not hear the audio from the videos. If there’s no one using the computer monitors, these should automatically log off. Blurring the faces of your patients can help protect their identity.
Encrypt video footages
Encrypting video footage can help secure private information against malicious entities. It’s best to use robust encryption algorithms that are difficult to crack and have a credible track record. Doing so adds another layer of protection, as only authorized individuals with the decryption key can access the video recording’s content.
Use strong access controls
Enable multi-factor authentication and password protection to secure your surveillance software. Those that require access to the footage must have unique login credentials. Make sure that only security personnel and the management staff are authorized to access the video recordings.
Establish audit controls
Only use HIPAA-compliant telehealth platforms and other video recording software with robust access controls. Administrators must also keep an audit log of all employees accessing the video recordings. Audit controls can track suspicious activities and implement timely response measures to mitigate risks and potential damages.
Train staff on HIPAA compliance
Training staff on the importance of HIPAA compliance and what they should do to ensure privacy when handling video recordings is essential for any healthcare organization. This training should cover privacy practices when video recording patients and understanding HIPAA violations’ legal and ethical implications.
Penalties for Non-Compliance with HIPAA Video Recording Rules
Filming patients without their consent is subject to HIPAA fines, depending on the severity of the violation. Accidental disclosure of PHI on video recordings will fall under tier 1 or lack of knowledge, with a penalty from $127 per violation to $63,973.
Meanwhile, leaked videos and images due to data breaches demonstrate higher levels of accountability for protecting patient privacy. In this clause, violators may face up to five years in jail and up to $63,973 in monetary fines.
If there is clear willful neglect, such as ignoring the wrong camera placements inside the hospital, covered entities may suffer up to 10 years in jail with a fine of $63,973. Lastly, failure to report the incident to HIPAA within 30 days after the incident may result in penalties of up to $1,919,173.
HIPAA Guidance on Photos, Video, and Audio Recording in Clinical Areas
Recordings in clinical areas, regardless of format, could contain protected health information (PHI). Thus, HIPAA has strict requirements regarding the use of photos, audio, and video recordings of patients to protect their privacy and confidentiality.
Healthcare providers must obtain consent from patients should they need to use the recording for treatment or research purposes. They are also responsible for securing the recordings and limiting access and use to what is only necessary for the patient’s care or treatment journey.
