The New York Times newly established Privacy Project, recently highlighted the extent to which our society has created a “facial recognition machine” – cameras are everywhere, even in doorbells. Early this month, 131 patients (and counting) of a women’s hospital in San Diego, California filed a lawsuit against the hospital after discovering that there was secret video surveillance in three labor and delivery operating rooms, recording medical procedures without patients’ consent. Patients were recorded during Cesarean sections, birth complications, treatment after miscarriage, hysterectomies and other medical procedures from July of 2012 to July of 2013.   Approximately 1,800 patients were recorded during this period. The patients are suing the hospital for invasion of privacy, breach of fiduciary duty, negligence, negligent infliction of emotional distress and unlawful recording of confidential information.

In addition to not informing the patients of the hidden cameras, the lawsuit alleges that the hospital was “grossly negligent” in its storage of the recordings. The lawsuit claims that recordings were stored on employee computers, often without password protection and that the hospital “destroyed at least half the recordings but cannot say when or how it deleted those files and cannot confirm that it took the appropriate steps to ensure the files were not otherwise recoverable.”

This is not the first lawsuit against the hospital regarding the hidden cameras. Since 2016, the hospital has faced several lawsuits alleging privacy violations and other claims stemming from the video records.

The hospital said in a statement on April 4th to the San Diego community that the cameras were installed as part of an investigation regarding drugs and other equipment missing from several anesthesia carts in hospital operating rooms, and it was not intended for patients to be visible on the recordings, although ultimately that was the case.

The issue of hidden cameras is particularly common in elder care facilities, where for example family members secretly install a “granny cam”, to step in and help protect their elderly loved ones from abuse in the facility, including neglect, physical abuse, unexplained serious injuries and thefts. A study published in 2011 found that an estimated 260,000 (1 in 13) older adults in New York had been victims of one form of abuse or another during a 12-month period between 2008 and 2009, with “a dramatic gap” between elder abuse events reported and the number of cases referred to formal elder abuse services. Clearly, states are struggling to protect a vulnerable and growing group of residents from abuse. Technologies such as hidden cameras may help to address the problem, but their use raises privacy, security, compliance, and other concerns.

Whether installed by a concerned family member in a nursing home, or a medical professional or a hospital administrator, the use of video surveillance devices can pose a number of issues and potential risks, particularly when the devices are hidden and/or record audio as well as video. Here are just a few questions these devices raise:

• Has the organization addressed federal and state laws establishing consent requirements when recording communications?

• Are there state laws that specifically addresses hidden cameras or similar privacy rights? For “granny cams”, at least five states (Illinois, New Mexico, Oklahoma, Texas, and Washington) have laws specifically addressing the use of cameras in this context. While state “granny cam” laws are not applicable to the hospital case, in California, for example, the California Invasion of Privacy Act (CIPA) protects against recording of an individual’s confidential information without prior consent.

• In general, if the organization installs such a device, what rights and obligations does it have with respect to the scope, notice, content, access, security, storage, deletion and other aspects of the recording?

• For surveillance likely to capture protected health information, have the HIPAA privacy and security regulations been addressed? This includes assessing the risk of making the recordings, controlling access to the recording, and securing that information.

• What record retention, chain of custody, and record destruction requirements and best practices should be implemented?

• How do the features of the device, such as camera placement and zoom capabilities, affect the analysis of the issues raised above?

Facilities considering this technology, even when well-intentioned, must assess the privacy and security implications. Practices and procedures considered and implemented, as applicable, not only for what happens prior to device installation (i.e. notice, consent, device placement, scope etc.), but also for what happens after recordings occur, including lawful and effective data storage and deletion policies.