My Director of Nursing (DON) decided to put up a personal surveillance camera in her office.  It streams to her phone, and both she and her husband can view the stream at any time.  It captures both pictures and sound.  She didn’t ask permission or even tell us about the camera until I discovered it the other day when I was in her office.  Is this okay?

The question brings to light an interesting intersection between employee expectations, modern technology, and the actual structure of statutes which may be applicable in the workplace. 

Of particular note is that this is a managerial employee who has chosen to engage in surveillance of both patients and people she supervises without posting a sign, asking permission or providing notice to anyone, including her employer, that surveillance is ongoing. 

Further, this captures not just video, but also audio, which creates greater concerns for privacy.  Additionally, because this is a DON, patient information could be revealed which would lead to a potential HIPAA violation as well as potential violations of the CMS regulations relating to patient dignity and rights. 

To sum it up succinctly, this is a bad idea on many levels.

As a manager, it’s not appropriate to simply throw up a surveillance system without coordinating with your employer and working through the pros and cons of the process.  Additionally, in this instance, outside third parties had access to this surveillance; specifically, the employee’s spouse. This creates a HIPAA violation and could violate other laws regarding privacy as well as your corporate policies involving trade secrets and similar matters. 

In Iowa, where only one person has to consent to the recording for it to be legal, one person present actually has to consent.  It can be presumed that the camera was continuing to run even if the DON wasn’t in the office which would be in direct violation of prior Iowa case law that says you can’t leave hidden surveillance with no one present as a consenting party.

The Big Picture

While surveillance may be appropriate, particularly if it is done by management, there needs to be appropriate signage or warning to employees, family members, and others that surveillance occurs in a particular area.  

The facility needs to carefully weigh what will be surveilled and how data will be kept and for how long.  Certainly, if there was an assault or another kind of problem, this could be subpoenaed by the County Attorney’s Office or a defense attorney. There also needs to be appropriate protections for HIPAA or any other privacy rules which may relate to the circumstance.