AccounTrust Business Services Inc.

Health organizations and legal responsibilities around video surveillance

Health organizations need to be aware of their legal responsibilities around the collection of video surveillance and audio, says Vancouver privacy and information lawyer Sara Levine.

“It’s important for organizations using video surveillance to treat it like any other collection of personal information — they have the same duties that they have with written records,” she tells “They have to protect it, collect it only for the purposes that are necessary, and they are not to keep it longer than is necessary.”

Levine, who practises in association with British Columbia's Alliance Lex Law Corp., weighs in on the issue after the Canadian Press reported that the Office of the Information and Privacy Commissioner for B.C. announced it was calling on a medical clinic in the lower mainland to immediately stop collecting video and audio of patients, its employees and contractors because it is not authorized under the Personal Information Protection Act (PIPA.)

“Surveillance technology is readily available and inexpensive, but that doesn’t mean you’re allowed to use it however you like. It does not replace adequate business controls and supervision. PIPA establishes what’s reasonable and how personal information can be collected, used, and disclosed,” said the province’s acting Information and Privacy Commissioner Drew McArthur, in a press release

The audit detailed an examination of the clinic's privacy management program and video and audio surveillance that was present in its lobby, hallways, back exits and fitness room, reports the Canadian Press.

“McArthur says the doctor who owns the clinic told auditors that eight video cameras were installed to deter crime, but there was no evidence to suggest such a concern existed. He says video cameras are used too frequently by private businesses to over collect personal information from people without their consent,” says the article. 

Levine says it’s significant that it’s the first time the privacy office audited a private entity.

“Until now, the commission has just been auditing government bodies,” she says. “Video surveillance is an issue that was talked about quite a bit a few years ago in privacy circles but to raise it again and to drive attention to it in the private sector suggests that the commission may be shifting its focus from government to business.”

Levine notes there are guidelines on the use of video surveillance for the public sector but the privacy office has now issued guidelines for private entities.

She says there are issues around video surveillance because it “captures so much personal activity.

“And audio is treated as a separate collection,” she says. “Sometimes audio isn’t needed in a surveillance system. If an audio system isn’t needed, organizations shouldn’t use it because it captures peoples’ conversations, which is a whole other level. And if they do require it, they should only keep it for the shortest amount of time as necessary.”

Levine notes that the commissioner also commented that collecting video surveillance footage can create considerable extra work for an organization. Individuals have a right to request a copy of their personal information and so the organization must be prepared to provide the individual copies of video footage but must ensure they have blurred the images of any other person in the footage in order to protect the personal information of those other people. And the duties to protect the security of personal information extend to video footage, which can add considerable cost to any surveillance system, she says.

The direction from the Privacy Commissioner’s Office comes as it released its audit report, Over-collected and Overexposed: Surveillance and Privacy Compliance in a Medical Clinic, which was started in June 2016 after a complaint to that office, says the press release. "The key finding is that the clinic is not authorized to collect personal information through its video and audio surveillance system," it said. 

“Under PIPA, organizations in B.C. have a responsibility to collect only what is reasonable and to protect the personal information it collects,” said McArthur. 

The audit contained 12 recommendations including:

  1. The clinic should immediately cease the collection of personal information via video and audio recording equipment;
  2. The clinic should develop and provide regular privacy training and education to all staff, with initial training to occur within three months of receiving this report;
  3. The clinic should shred paper records containing patient or employee personal information when disposing of the records; and 
  4. The clinic should store paper records securely in locking cabinets or behind locked doors and lock cabinets and doors when access to records is not necessary. 

Other recommendations require the clinic to update its privacy policy and procedures; conduct regular privacy risk assessments; and use confidentiality agreements with staff and service providers. 

McArthur also asked the clinic to provide a written update within three months about its implementation of the 12 recommendations.

Levine says that is done fairly often.

"When they make orders or recommendations, they often want to go back and see what the organization has done — to see whether they complied with it,” she says.  

Levine says it’s important for health organizations to think about why they are collecting video surveillance and what information they think they really need.

“They shouldn’t use more cameras than they need,” she says. 


To Read More Sara A. Levine, Q.C. Posts Click Here
Lawyer Directory
BridgePoint Financial Services Inc.Toronto Lawyers AssociationMKD InternationalFeldstein Family LawLexop Morrow Mediation Shekter Dychtenberg LLPBales Beall LLP