Have you ever said… “If only I had someone to ask!”
Each month, we discuss your questions about practice management, human resources issues, clinic management best practices, procedures, resources, practical privacy tips, and more in Practice Management Success membership.
In this Q&A, we're talking about:
How to Process an Access Request for Security Camera Images
A patient has requested access to the video security images at my clinic.
What do I do now?
I have received two inquiries from clients lately about disclosing images from surveillance cameras.
In one situation, there was a patient incident in the patient reception area. The patient requested access to the video footage.
In another situation, a patient was suspected of stealing cash from a staff members’ personal coat pocket. Charges were laid by the police, and the clinic manager was anticipating making the images available to the police if requested.
If you have a security camera in your healthcare practice, you need policies and procedures to control how the images will be used, how to advise your patients and staff that you use security cameras and how you will respond to an access request or security incident.
Here are my tips to help you to prepare your security camera policy.
Security Cameras To Provide Safety and Security
We often choose to implement surveillance cameras to provide safety and security for staff and patients. This is primarily intended to deter theft of equipment and records and to monitor for potentially wrongful and illegal activities by patients, visitors, or employees of the clinic.
Patients, staff, and visitors expect that their privacy and confidentiality will be respected and that the images will be used appropriately. As a custodian, you need a written policy and procedure to ensure good business practices, meet privacy legislation, and ensure that individuals have access to their own information.
Keep The Images for the Least Amount of Time Necessary
Remember that collecting and keeping the least amount of information necessary for the intended purpose is a good privacy practice.
If you have a security incident, you probably will be able to recognize it right away or within a few weeks of the event. Keep only the images that are needed to manage a security incident and delete the remaining images. Keeping all digital images longer than is necessary is not recommended.
Many security systems will over-write the images on a 15 or 30 day cycle.
What To Do If An Incident Occurs
If an incident occurs, the video should be reviewed immediately by the authorized custodian.
If you think that the images will be required in the future, copy the required video to a DVD or other memory device. Store the memory device at a secure, offsite location for at least a one (1) year period under the control of the custodian.
In the event that a patient requests access to their own images or if there is the potential for involvement of other people such as the police, insurance, or the Office of the Information and Privacy Commissioner (OIPC), to access the videos in an investigation of a (suspected) security and privacy breach, take the following steps.
- Export the video images from the security system into a video file format and stored to a separate memory device (DVD, USB, etc.)
- Transfer the video images to still images, if needed.
- Review the images and ‘sever’ to remove or obscure the identities of other individuals in the images.
Access Requests
These recordings probably contain personal information as defined under the Personal Information Protection Act (Alberta) (PIPA).
The patient or client can request access to their own identifying information. Use your your current access and release of information policies to guide you to process this request.
I always prefer to have requests in writing so that I can be certain of the details of the request and can confirm the identity of the requester.
The attending custodian or business owner must authorize the release of the information.
Do you need a Security Camera Privacy Policy template?
Privacy policy templates and other tips, tools, and training for your healthcare practice, become a member of Practice Management Success!
Would you help me by answering a few questions to help me design Practice Management Success to meet your needs?
Jean is a recognized and respected leader and expert in health information management, privacy management and legislation. An engaging workshop leader, she provides solutions that are practical and effective for today’s healthcare providers. Jean is passionate about supporting primary care practices to implement privacy by design and best practices to protect privacy, confidentiality, security of personal information.
Sharon Polsky is the president of AMINA Corp. and a Privacy by Design Ambassador with more than 30 years’ experience advising corporations, governments and organizations about privacy and access implications and unintended consequences of emerging laws, technologies and global trends. She is also president of the Privacy and Access Council of Canada, the nonpartisan national non-profit association of privacy and access professionals in Canada’s private and public sectors.