HIPAA and security cameras: what 45 CFR 164 actually requires

What HIPAA's Security Rule says about cameras

The Security Rule lives at 45 CFR Part 164, Subpart C. Two sections drive camera decisions: 164.308 (Administrative safeguards) and 164.310 (Physical safeguards). 164.310(a)(1) is the load-bearing one. Every covered entity must "implement policies and procedures to limit physical access to its electronic information systems and the facility or facilities in which they are housed, while ensuring that properly authorized access is allowed."

That sentence doesn't say "install cameras." It says facility access has to be controlled and authorized access has to be provable. OCR (the HHS Office for Civil Rights) and accrediting bodies treat camera coverage of access points, plus matching badge logs, as the realistic way to satisfy the rule for areas storing electronic PHI. A door log without video shows who badged in. Video without a log shows who walked in. Neither alone proves authorized access. HHS's own Security Rule Crosswalk to NIST 800-53 PE-3 and PE-6 maps facility access controls to monitored ingress and egress, which is where the requirement comes from.

Where cameras go in a HIPAA-covered facility

Public entry and exit points get cameras by default: the main lobby, ED ambulance bay, and after-hours staff entrances, with retention long enough to support an incident review. The server room or data closet hosting the EHR gets a camera on the door, ideally with a second inside facing the rack. The pharmacy and any drug-storage area gets coverage of the cabinet and the room, not just the corridor. Loading docks need coverage as a known social-engineering vector. Perimeter cameras cover parking, the ambulance bay, and any unmonitored side door. This list is drawn from OCR settlement language, Joint Commission survey reports, and published health-system facility-security plans.

Where cameras don't go: patient treatment rooms (clinical-purpose exception with documented consent only), exam rooms, restrooms (illegal in every state), locker rooms (illegal in most states), employee break rooms (varies by state, written notice typically required), and chapels or quiet rooms. Behavioral-health units sit in the middle. Cameras in seclusion-room corridors are common; cameras inside the seclusion room are a clinical decision documented in the chart, not a default. Same for ICU patient-monitoring cameras: those are clinical equipment on a separate network with separate consent and access rules.

Camera retention: HIPAA vs state law

HIPAA sets no video-retention window. 45 CFR 164.316(b)(2) requires policies and procedures be retained six years, but that covers the written camera policy, not the footage. State law and accreditation standards fill the gap. New York hospitals retain footage 30 days minimum under DOH 405.10. California sets retention by documented risk analysis, with most acute-care hospitals at 90 days. Texas sets no specific window. Illinois under HFSRB rules requires enough to investigate reported incidents, in practice 30 to 90 days. Florida usually 30 days. Massachusetts hospitals follow DPH guidance, commonly 60 days.

The defensible default across most healthcare systems is 60 to 90 days. Shorter than 30 days makes incident response hard, because patient complaints often arrive weeks after the event. Longer than 180 days creates privacy exposure the facility can't justify under a documented purpose. The retention number lives in your written camera policy and matches the longest specific requirement across your sites.

Joint Commission EC.02.01.01 for accredited hospitals

For Joint Commission accreditation, the Environment of Care standards add operational requirements on top of HIPAA. EC.02.01.01 requires the hospital to "manage safety and security risks," including risk-based access control of security-sensitive areas: the pharmacy, ED, behavioral-health unit, infant-care unit, and morgue. Surveyors want a written security management plan, evidence of camera coverage of those areas, infant or vulnerable-population protection workflows, and test documentation. Hardware alone doesn't pass. A camera offline for six months without anyone noticing is a finding even if the rest of the install is solid.

EC.04.01.01 requires the hospital to monitor environmental conditions, which gets read into camera-system uptime. Camera health monitoring (the integrator's NOC or the VMS flagging cameras that go offline) becomes part of the evidence package. Tec-Tel monitoring agents handle that for healthcare customers as a standard inclusion.

DEA Part 1300 for facilities with Schedule II storage

Hospital pharmacies, methadone clinics, oncology infusion suites, and any DEA controlled-substances handler get a second overlay. 21 CFR 1301.71 sets the requirement; 1301.72 through 1301.76 spell out the implementation. The storage area must be "substantially constructed" with continuous monitoring suitable for the schedule stored. For Schedule II: motion-activated continuous video of the cabinet (not just the room), an alarm signaling a 24-hour monitored station, and a badge-plus-PIN credential tying each access event to a person. Inventory and access logs must be retrievable for two years per 1304.04. DEA inspectors look for the chain connecting access event to person to inventory record. Most legacy installs produce one or two of the three; DEA wants all three on the same audit trail.

Methadone clinics get an additional layer under 42 CFR Part 8. Oncology infusion suites handling Schedule II hazardous drugs need the same DEA controls as the main pharmacy, even in a separate building. We've installed those controls on hospital-owned infusion centers.

Cloud cameras vs on-prem under HIPAA

Both models are HIPAA-permissible; the compliance work differs. Cloud cameras require a Business Associate Agreement before any footage that could capture identifiable patients lands in the vendor's tenant. Under 45 CFR 164.504(e), the vendor commits to safeguard PHI, report breaches inside 60 days, and sign a similar BAA with any subcontractor that touches the data. The BAA attaches to your facility's HIPAA documentation.

On-prem (NVR or VMS rack) needs no vendor BAA because no third party handles the footage. The compliance work moves to your IT team: encrypted-at-rest storage, network segmentation from clinical systems, role-based VMS access, an audit log of every footage retrieval, and a documented disposal process when drives retire. The wrong move is a cloud deployment without a BAA, the gap OCR finds in settlement reviews.

Most mature healthcare systems run hybrid: on-prem NVR at each acute-care campus where camera density is high and IT already manages a hardened SAN, plus cloud video at branch clinics where local IT is thin. Same VMS pane of glass at the central security team, same retention policy on both. The BAA covers only the cloud-side footage; on-prem footage is governed by the customer's own written information security program.