Security Camera Compliance by Industry: What the Rules Actually Require

Compliance is a layer on top of the camera, not the camera itself

The hardware is rarely the regulated thing. What regulators care about is what the system captures, where it points, how long footage is kept, who can access it, and whether the footage actually drives a response. That is why a fully working camera can still put you out of compliance. The rules below differ by industry, but they all attach to the same handful of system behaviors, not to the brand of camera on the wall.

Healthcare: HIPAA and patient privacy

Cameras in healthcare settings routinely capture protected health information: a patient's face, a chart on a screen, a label on a medication. Once footage captures PHI, it becomes a record subject to HIPAA's privacy and security safeguards, including access controls, audit logging, retention rules, and breach reporting. Cameras are also barred from spaces with a reasonable expectation of privacy, such as exam rooms, patient bathrooms, and changing areas. Senior care stacks CMS conditions and state survey requirements on top of that. The deeper version of this is here: a working camera can still be a HIPAA violation, and the full setting-by-setting breakdown is in our guide to AI surveillance in healthcare.

Retail and payments: PCI DSS

Any business that accepts card payments falls under PCI DSS. Its physical-security requirements call for monitoring the sensitive areas where cardholder data is stored or processed, retaining that footage (commonly at least three months and correlated with entry and exit points), and protecting the recordings from tampering. The flip side matters just as much: cameras must not capture PIN pads or full card numbers. If they do, the footage itself becomes cardholder data that you are now obligated to protect.

Banking and finance: the Bank Protection Act

Federally insured banks operate under the Bank Protection Act and its implementing regulations, which require a formal security program. That program includes cameras positioned to identify a person committing a robbery, plus retention of those recordings. It is one of the oldest and most prescriptive camera mandates in the country, and meeting it on paper is not the same as being protected in practice. We cover that distinction in documented compliance vs. operational protection.

Cannabis, gaming, and other licensed industries

States that license cannabis almost universally require continuous recording. The common threads across state rules are 24/7 coverage of every point of sale, entrance, and storage area, a defined minimum resolution, and a retention window that is frequently 30 to 90 days, set by each state. Gaming is stricter still. Casino surveillance, the "eye in the sky," runs under gaming-commission rules with specific coverage maps and long retention. The pattern holds across sectors: the more heavily an industry is licensed, the more prescriptive its camera rules become.

Manufacturing and food: OSHA and FDA

Manufacturing and food production rarely mandate cameras outright, but cameras increasingly support compliance in adjacent ways. They document PPE use and forklift safety to reduce OSHA exposure, and they support traceability and sanitation verification under FDA food-safety rules. Here the camera is evidence rather than the mandate. See the compliance crossroads in food manufacturing and how cameras factor into OSHA fines and PPE compliance.

Education: Clery Act and FERPA

Colleges that receive federal funding fall under the Clery Act, which requires timely warnings and accurate crime reporting. Those are obligations that cameras support but do not satisfy on their own. Footage that identifies students can also qualify as an education record under FERPA, with its own limits on access and disclosure. The workflow gap is the real risk: active cameras without a timely-warning process are still out of compliance.

The rules that cross every industry: audio and retention

Two requirements cut across all sectors, regardless of vertical.

Audio. Federal law permits one-party consent, but many states (including California, Illinois, Florida, Pennsylvania, and Washington) require all-party consent. Recording audio on a security camera in those states without consent can be a crime, which is why many systems disable audio outright or post clear notice that recording is taking place.

Retention. There is no single national retention period. PCI points to roughly three months, many licensed industries set 30 to 90 days, and banks and casinos run longer. Your insurer or a litigation hold may require more. The safe default is to retain to the longest rule that applies to you. Privacy law also bars cameras in restrooms, locker rooms, and other private spaces in every state, and several states require visible notice that recording is in progress.

What compliance actually asks of the system

Across every framework above, the same five questions recur. What does the camera capture? Where can it point? How long is footage kept? Who can access it, and is that access logged? And does the footage drive a timely response, or just sit on a drive? Meeting the standard is a system-design problem, not a hardware-purchase problem. That is the entire gap between a camera that records and a system that holds up to an audit, which is also why the right questions to ask a vendor matter so much. We list them in 10 questions to ask before signing a security contract.

A note on scope

This is general guidance, not legal advice. Compliance obligations vary by state, by license, and by how your specific operation is structured. Confirm the frameworks that apply to you with qualified counsel before you design or sign off on a system. When you are ready to translate those obligations into a real design, the Tec-Tel team scopes coverage, retention, access controls, and response against the standard your industry is held to.