HIPAA and security cameras: what 45 CFR 164 actually requires

HIPAA does not universally require security cameras. Its Security Rule requires covered entities and business associates to protect electronic protected health information through administrative, physical, and technical safeguards. Cameras may support a facility's risk-based security plan, but they do not establish compliance by themselves. Healthcare camera decisions also need a review of patient privacy, footage access, retention, vendor responsibilities, and applicable state rules.

What HIPAA's Security Rule says about cameras

The HHS Security Rule summary describes a flexible, technology-neutral framework for protecting electronic protected health information (ePHI). Physical safeguards address facilities, workstations, and devices. They do not prescribe one universal surveillance layout. A badge log does not automatically need matching video to be valid, and adding cameras does not replace the facility's risk analysis.

For a design meeting, separate the security problem from the proposed device. Is the problem an unobserved entrance, uncontrolled access to a records area, an incident that cannot be reconstructed, or an unreliable recorder? Each calls for a different scope. Assign a facility decision-maker to approve the purpose and boundaries of recording before an installer specifies views.

Use our commercial security camera installation guide for camera reuse, recording, network, and rollout decisions. Pair that discussion with access control where the actual requirement is restricting entry.

Separate facility surveillance from patient-room recording

Start the facility survey with entrances, deliveries, circulation routes, and equipment rooms where the security team has identified a need. This is a planning sequence, not a legal list of approved camera locations. Check whether a view unintentionally includes a treatment bay, computer screen, neighboring room, or other sensitive activity.

A patient-room camera can serve clinical observation, a facility-security purpose, or a resident's own request. Those uses require different decisions. A national list of states that “allow cameras” would not resolve whether a particular hospital room, nursing-home room, or clinical workflow is lawful. Have the privacy and clinical teams define the use before installation, including live viewing, recording, sound, access, and any consent process.

For sensitive areas, bring a marked floor plan to the review. Record excluded views and required masking alongside approved coverage. Do not enable audio merely because the camera includes a microphone. Keep recording disabled until the facility has approved the applicable configuration.

Retention: written policy and actual recording capacity

45 CFR 164.316 requires specified Security Rule documentation to be kept for six years from creation or when last in effect, whichever is later. That is not a universal footage-retention requirement. Do not substitute an arbitrary 30-, 60-, or 90-day default for a review of the facility's applicable obligations.

Once the facility approves a period, the installation scope should state camera resolution, frame rate, recording schedule, storage capacity, and what happens when storage is full. Define how authorized staff preserve an incident separately from routine overwrite. Ask for a recorded-video retrieval test and a documented check of the actual available recording history after the system has run.

Cloud, on-site storage, and vendor responsibilities

HHS cloud-computing guidance explains the business-associate obligations of providers that maintain ePHI, including encrypted data they cannot decrypt. Where that relationship applies, a BAA and appropriate safeguards are part of the arrangement. A product label or a sales statement about encryption is not a substitute for reviewing the agreement.

On-site storage changes the architecture, but does not automatically eliminate third-party involvement. Inventory remote support, managed services, exports, backups, and service accounts. Ask which parties can reach recordings and under what authorization. Confirm responsibilities before buying a subscription or granting a support account access.

Access, export, and maintenance decisions

Identify who may watch live views, retrieve recordings, export clips, or administer the system.
Keep account ownership and staff departure procedures in the handover documentation.
Specify how authorized exports are requested, recorded, transferred, and stored.
Agree who notices a recorder failure or lost camera and who is responsible for repair.
Test the chosen user roles with the facility's designated staff before accepting the system.

Pharmacies, accreditation, and additional requirements

DEA controlled-substance rules are a separate layer. The DEA practitioner and registrant manuals explain the relevant security framework. Have the registration holder identify the applicable requirements for its storage and dispensing activity; do not infer a universal camera-and-PIN specification from the presence of medication.

Accredited facilities should also bring their current security-management requirements and any corrective-action scope. Tec-Tel can help translate an approved equipment requirement into camera, door, cabling, and recording work. Legal interpretation, clinical approval, and accreditation decisions remain with the facility and its advisers.

Prepare a useful healthcare security scope

Bring the site plan, current camera and recorder models, desired recording tasks, approved retention policy, network contact, and installation hours. Separate mandatory work from optional analytics or monitoring. Ask the proposal to identify equipment reuse, privacy settings, testing, training, ongoing fees, and work excluded from the installation. That makes competing proposals easier to compare without treating a hardware purchase as a compliance certification.

Planning reference reviewed September 22, 2026. This guide supports an equipment discussion and does not replace facility-specific legal or privacy advice.

Frequent buyer questions

Does HIPAA require security cameras at hospitals and clinics?

No blanket camera mandate appears in HIPAA's physical-safeguard standard. The facility must assess its risks and implement appropriate safeguards. Camera coverage may be one measure alongside controlled access, visitor procedures, and other protections.

What does a HIPAA-aware camera installation cost?

Cost depends on approved camera locations, existing equipment, recording and storage requirements, cabling, access permissions, vendor responsibilities, and installation constraints. Ask for separate equipment, labor, storage, licensing, and ongoing-support lines. A generic per-camera price does not establish either project cost or compliance.

When does a camera vendor need a Business Associate Agreement?

Assess whether the vendor creates, receives, maintains, or transmits protected health information on behalf of a covered entity or business associate. HHS says a cloud provider maintaining ePHI is a business associate even if the data is encrypted and it lacks the key. On-site storage alone does not remove the need to assess third-party access and services.

How long does HIPAA require us to keep video footage?

HIPAA does not set a universal surveillance-video retention period. Its six-year Security Rule documentation requirement concerns required documentation, not a blanket six-year footage rule. Establish the footage period with the facility's legal and privacy team, accounting for applicable obligations, incident holds, and the purpose of recording.

Can cameras be placed in patient treatment rooms?

HIPAA alone does not supply a national yes-or-no placement list. Clinical monitoring, facility surveillance, and patient-initiated recording are different uses. Review the specific setting, state law, privacy expectations, consent or authorization requirements, and who can see or export images before choosing equipment.

Does pharmacy surveillance have separate requirements?

Controlled-substance security requirements are separate from HIPAA. The applicable DEA provisions depend on the registration and activity. Review those requirements with the pharmacy's compliance owner rather than treating every drug-storage room as subject to the same camera, alarm, or retention specification.

Plan your healthcare security installation

Bring your current equipment, site requirements, and the changes you need. Book a free consultation with Tec-Tel or call 855-577-0400.

Tell us how many sites you run and what's already in place. We'll show you what a build or upgrade looks like.

Straight answers from the team that does the work. We're platform-agnostic, so you get the system that fits your sites, not one brand's catalog.