How to install practice cameras (while staying on the right side of the law)

In response to an outbreak of crime near your practice, you decide to install closed-circuit TV cameras (CCTV) inside and outside the premises to provide added security. As well as installing cameras outside the premises and in the reception area to deter theft and vandalism and keep staff and patients safe, you also plan to have cameras in the consulting and treatment rooms.


Before taking these steps, you need to be aware that private medical practices must comply with state laws regarding the installation of CCTV and meet obligations under the Commonwealth Privacy Act in relation to the handling of personal information collected through CCTV in private practices. In some states, it may be a criminal offence to film people without their consent, so it is essential to get advice before you install any security cameras.

There are a number of issues you need to consider including:

  • informing patients, staff and others entering the premises, that CCTV is used  
  • whether to store and how to secure recordings
  • dealing with requests for footage
  • amending practice policies – including your practice privacy policy.

Informing patients and the public

Warning signs should alert people entering your practice that CCTV cameras are in use should be placed in a prominent and easy to read location.

While the presence of CCTV cameras may help to improve safety and security for staff and patients, this needs to be carefully balanced against the need to respect the privacy and confidentiality of medical consultations. For this reason, the installation of CCTV would not generally be recommended in treatment areas unless there was a specific need for it and patients provided their express consent to the use of such cameras.

Informing employees

It is not just patients who need to be considered when installing CCTV. Legislation in the ACT and NSW requires notification also be given to employees, and in Victoria surveillance cannot occur in workplace toilets, washrooms or change rooms. Practices in those jurisdictions should, therefore, check their state’s specific requirements before installing CCTVi.

In the other jurisdictions, it is good practice to provide notice to employees before the security system begins operating. Using the requirements in the NSW legislation as a guide they should be told about the kind of surveillance, starting date, why cameras are being installed, how footage will be recorded and stored, whether footage will be on live feed, and whether surveillance will be permanent or temporary.

Storing and securing recordings

Personal information should only be collected by private medical practices if it is ‘reasonably necessary for one or more of the entity’s functions or activities’ (Australian Privacy Principle (APP) 3.2).

The Office of the Australian Information Commissioner (OAIC) provides advice on the use of surveillance devices.

The OAIC says that if you are using CCTV, personal information recorded must be kept securely and destroyed or de-identified when it is no longer required.

Information gathered through CCTV should only be kept for as long as necessary to fulfil the purpose of the cameras.

Requests for footage

Requests for access to CCTV footage should be treated like other requests for personal information and assessed on a case by case basis. The footage must not be used or disclosed for a purpose other than the reason it was collected, without the consent of the individual affected or where an exception applies under the Privacy Act (APP 6.1).

If a person who has been recorded seeks access to that CCTV footage it can be provided on request if it covers only that person. However, there are exceptions to providing access, such as if the footage recorded other people and it would, therefore, have an unreasonable impact on the privacy of those people. Other exceptions are covered in APP 12.1. For more information, view the OAIC’s APP privacy fact sheet. 

CCTV footage may also be subject to a subpoena or other disclosure requirements as part of legal proceedings.

If CCTV has been installed to safeguard your staff and premises and to prevent crime in the practice, the consent of individuals may not be required if access to the footage is reasonably necessary to a police investigation. However, be wary of requests for access to CCTV footage from the media or individuals not included in footage as such disclosure may breach the Privacy Act.

Seek advice from Avant if you are uncertain how to respond to a request for CCTV footage.

Practice policies

You will also need to amend the practice’s privacy policy, including details of how you will deal with requests from the police, the media or other interested parties for a copy of footage from your cameras.

Key points:

  • Display signs inside and outside the practice to warn those entering that they will be under surveillance.
  • Amend your practice’s privacy policy and patient registration forms so they refer to the presence and operation of CCTV and location of cameras, particularly:
    • information on how the footage will be stored and how long it will be kept;
    • if the system will include live feeds;
    • how people entering the practice will be advised about the security system;
    • whether security footage will be disclosed to any entity and, if so, the likely circumstances of disclosure.
  • If you are in NSW, ACT or Victoria check the specific requirements of the legislation in relation to your staff before installing CCTV.

Seek advice if you are unsure about positioning of cameras, storage or security when you are planning to install cameras.

By: Tracy Pickett, Medico-legal Advisor and Dr Owen Bradfield, Medico-legal Advisor, Avant

Aug 3, 2017

This article was first published in Medical Observer. Read the original article here.