Does your medical practice use video surveillance? If so, you should be aware of how it pertains to the Health Insurance Portability and Accountability Act (HIPAA) of 1996. It's not uncommon for doctor's offices, hospitals, and other medical practices to record operating procedures. But if you're familiar with HIPAA, you probably know that any personally identifiable information cannot be used without the patient's consent. This begs the question: can covered entities use video surveillance without violating HIPAA?
It's important to note that video surveillance only conflicts with HIPAA when it's used to record patients. If a medical practice only has video cameras installed outside for the purpose of preventing/deterring burglary, then there's really no issue. However, if the video cameras are placed directly inside operating rooms where they record patients without their consent, it may be viewed as a violation.
Furthermore, video surveillance isn't necessarily classified as Protected Health Information (PHI) if it's used strictly for real-time surveillance and not recorded. When you press the “record” button, however, it may conflict with HIPAA unless you have the patient's consent to record them. This is one of the reasons why many doctors choose to simply watch their video surveillance as opposed to actually recording it. As long as you aren't recording it – whether on hard disk, the cloud, or elsewhere – you won't have any conflicts with HIPAA.
To recap, it's OK to record patients using video surveillance, but only if you have their consent. If you want to record an operating procedure on a patient, ask the patient for his or her consent beforehand. It only takes a couple of minutes to ask a patient if he or she minds to be recorded, but doing so could save you from a world of trouble later down the road.
Even if the patient gives their consent to be recorded, the footage must be treated like any other form of PHI. This means implementing the necessary safeguards to prevent unauthorized access or use. Selling or giving away the footage would be a direct violation of the patient's privacy rights under HIPAA, at which point the Health and Human Services (HHS) may cite you for the violation. When in doubt, err on the side of caution by keeping the footage to yourself. If you plan to hand it over to a third-party for research purposes, you'll need a Business Associates Agreement (BAA) that outlines how the footage will be used.