Information Managers
  • Home
  • Services
    • All Services
  • Templates
  • Blog
  • Contact Us
  • Practice Management Success
  • Podcasts

How to Process an Access Request for Security Camera Images

Posted on June 12, 2018 by Jean Eaton in Blog, Uncategorized

Have you ever said… “If only I had someone to ask!”

Each month, we discuss your questions about practice management, human resources issues, clinic management best practices, procedures, resources, practical privacy tips, and more in Practice Management Success membership.

In this Q&A, we're talking about:

How to Process an Access Request for Security Camera Images

A patient has requested access to the video security images at my clinic.

What do I do now?

I have received two inquiries from clients lately about disclosing images from surveillance cameras.

In one situation, there was a patient incident in the patient reception area. The patient requested access to the video footage.

In another situation, a patient was suspected of stealing cash from a staff members’ personal coat pocket. Charges were laid by the police, and the clinic manager was anticipating making the images available to the police if requested.

If you have a security camera in your healthcare practice, you need policies and procedures to control how the images will be used, how to advise your patients and staff that you use security cameras and how you will respond to an access request or security incident.

Here are my tips to help you to prepare your security camera policy.

Security Cameras To Provide Safety and Security

We often choose to implement surveillance cameras to provide safety and security for staff and patients. This is primarily intended to deter theft of equipment and records and to monitor for potentially wrongful and illegal activities by patients, visitors, or employees of the clinic.

Patients, staff, and visitors expect that their privacy and confidentiality will be respected and that the images will be used appropriately. As a custodian, you need a written policy and procedure to ensure good business practices, meet privacy legislation, and ensure that individuals have access to their own information.

Security Camera

Keep The Images for the Least Amount of Time Necessary

Remember that collecting and keeping the least amount of information necessary for the intended purpose is a good privacy practice.

If you have a security incident, you probably will be able to recognize it right away or within a few weeks of the event.  Keep only the images that are needed to manage a security incident and delete the remaining images. Keeping all digital images longer than is necessary is not recommended.

Many security systems will over-write the images on a 15 or 30 day cycle.

 

What To Do If An Incident Occurs

If an incident occurs, the video should be reviewed immediately by the authorized custodian.

If you think that the images will be required in the future, copy the required video to a DVD or other memory device. Store the memory device at a secure, offsite location for at least a one (1) year period under the control of the custodian.

In the event that a patient requests access to their own images or if there is the potential for involvement of other people such as the police, insurance, or the Office of the Information and Privacy Commissioner (OIPC), to access the videos in an investigation of a (suspected) security and privacy breach, take the following steps.

  • Export the video images from the security system into a video file format and stored to a separate memory device (DVD, USB, etc.)
  • Transfer the video images to still images, if needed.
  • Review the images and ‘sever’ to remove or obscure the identities of other individuals in the images. 

 

Access Requests

These recordings  probably contain personal information as defined under the Personal Information Protection Act (Alberta) (PIPA).

The patient or client can request access to their own identifying information.   Use your your current access and release of information policies to guide you to process this request.

I always prefer to have requests in writing so that I can be certain of the details of the request and can confirm the identity of the requester.

The attending custodian or business owner must authorize the release of the information.

Do you need a Security Camera Privacy Policy template?

Privacy policy templates and other tips, tools, and training for your healthcare practice, become a member of Practice Management Success!

Get Your Practice Management Success membership
access request for CCTV images, Access Request for Security Camera Images, healthcare, policy template, security camera policy template, video surveillance images

Search the site

What is the elephant in the room?

The Elephant in the Room Find out here...

Privacy Policy

"The 15 Day Privacy Challenge has given me some great resource information and helped me to identify the areas that I need to work on. I found value in almost all of the Privacy Challenges, but I would say Risk Assessment, Social Media, Email Phishing and Spam, and Confidentiality are the top four."

- Sharon

Register for Free On-line Privacy Breach Awareness Training!

Privacy Policy

Copyright 2022 Information Managers Ltd.

Manage Cookie Consent
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
Manage options Manage services Manage vendors Read more about these purposes
View preferences
{title} {title} {title}