What AI surveillance actually does in a hospital
AI video analytics in healthcare aren't watching every patient. They watch specific patterns on specific cameras. A fall motion in a corridor outside an inpatient unit. A weapon shape at the ED registration desk. A door propped open on the pharmacy. An adult lingering near the nursery without a visitor badge. The analytics flag the event with a 15-second clip pre-cued to the security operations team or charge nurse, and a human makes the call.
The patterns that earn their keep are narrower than in retail: ED workplace violence, fall risk in corridors, narcotics-room access events, infant-care unit ingress, after-hours intrusion in clinical areas, and aggressive-behavior detection in waiting rooms. Each has a specific destination in the response workflow. Generic "monitor everything" analytics don't survive a year in a hospital because the false positives drown the signal.
The system runs on cameras you already own. Modern platforms (Verkada, Avigilon, Eagle Eye, Rhombus, plus camera-agnostic tools like Dragonfruit) are vendor-flexible enough that ripping out the existing fleet is rarely the right call.
HIPAA, BAAs, and what 45 CFR 164 actually requires
The HIPAA Security Rule lives at 45 CFR Part 164, Subpart C. The two sections driving camera decisions are 164.308 (administrative safeguards) and 164.310 (physical safeguards). 164.310(a)(1) requires every covered entity to limit physical access to electronic information systems and the facility housing them. It doesn't say "install cameras." It says facility access must be controlled and authorized access provable, and OCR and accrediting bodies treat camera coverage of access points plus matching badge logs as the realistic way to do that.
Cloud cameras (Verkada, Avigilon Alta, Eagle Eye Networks, Rhombus) require a Business Associate Agreement before any footage that could capture identifiable patients lives in the vendor's tenant. The BAA is a contract under 45 CFR 164.504(e) where the vendor commits to safeguard PHI on your behalf and report breaches inside 60 days. All four publish a healthcare BAA, which attaches to your facility's HIPAA documentation.
On-prem storage doesn't need a vendor BAA because no third party handles the footage. The compliance work moves to your IT team: encrypted-at-rest storage, network segmentation from clinical systems, role-based VMS access, audit logs of every retrieval. Mature systems run hybrid: on-prem at acute-care campuses, cloud at branch clinics, one VMS pane of glass at the central security operations team.
Where cameras go and where they don't
Public entry and exit points get coverage by default: the main lobby, ED ambulance bay, and after-hours staff entrances, with retention long enough to support an incident review. The server room hosting the EHR or any system handling electronic PHI gets a camera on the door, ideally a second inside facing the rack. Pharmacy and drug-storage areas get coverage of the cabinet itself, not just the corridor. Loading docks get coverage as a known social-engineering vector. Perimeter cameras cover parking, the ambulance bay, and side doors.
Where cameras don't go: patient treatment rooms (clinical-purpose exception with documented consent only), exam rooms, restrooms (illegal in every state), locker rooms (illegal in most states), employee break rooms (varies by state, written notice typically required), and chapels or quiet rooms.
Behavioral-health units sit in the middle. Cameras in seclusion-room corridors are common; cameras inside the seclusion room are a clinical decision documented in the patient's chart, not a default install. ICU patient-monitoring cameras are clinical equipment, not security cameras, and live on a separate clinical network with separate consent and access rules.
DEA Part 1300 for facilities with Schedule II storage
Hospital pharmacies, methadone clinics, oncology infusion suites, and any facility registered as a DEA controlled-substances handler get a second compliance overlay. 21 CFR 1301.71 sets the requirement; 1301.72 through 1301.76 spell out implementation. Storage must be "substantially constructed" with continuous monitoring suitable for the schedule of substances stored.
For Schedule II, that means motion-activated continuous video coverage of the storage cabinet, an alarm signaling to a 24-hour monitored station, and a badge-plus-PIN credential that ties the access event to a specific person. Inventory and access logs must be retrievable for two years per 1304.04. DEA inspectors look for the chain connecting the access event to the person to the inventory record. Most legacy installs produce one or two of those three; DEA wants all three on the same audit trail.