Imagine a police officer escorting a drunk driver through the emergency room with his body camera still on—not only is the officer recording the driver, the officer is simultaneously recording every individual and every patient that officer comes into contact with.  In an era of attempted police reform, where law enforcement is ramping up their use of body cameras, hospitals must be increasingly aware of violations to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the implications of police body cameras within the confines of its medical center. 

As a general matter, HIPAA regulates how PHI is used, disclosed, and safeguarded by covered entities and business associates (collectively, entities) and protects individually identifiable health information, including photographs and any comparable images that can be used to identify a patient, including photos of tattoos, birthmarks, and other identifying features. Though limited incidental disclosures are permissible under the Privacy Rule embedded in HIPAA, this same rule also requires entities to account for their disclosures in a disclosure log and adopt reasonable and appropriate administrative, physical, and technical safeguards to prevent unauthorized uses and disclosures of PHI. Failure to do so is equivalent to a HIPAA breach.

Unfortunately for medical providers, particularly emergency rooms, HIPAA does not regulate law enforcement and the onus is on the medical entity to comply with HIPAA.  Beginning in 2016, with Illinois’ adoption of the Illinois Law Enforcement Officer-Worn Body Camera Act, law enforcement officers are required to have a body camera on when in uniform responding to calls for service, or engaged in any law enforcement-related encounter or activity while on duty. Moreover, under the Act, though there are few instances where an officer has the discretion to turn his or her camera off, these instances do not include entry into a medical facility, thus leaving open the possibility for disclosure of PHI in the form of photos and videos to law enforcement if an officer is recording in an emergency department or other hospital setting.

Importantly, many law enforcement jurisdictions have issued directives regarding the use of body cameras in medical facilities. Notably, in 2018, the Chicago Police Department adopted a policy for CPD’s use of body cameras.  This policy recognizes several triggering events that require the officer to turn his or her camera on, including calls for service, arrests, seizure of evidence, searches, high-risk situations, and “any other instance when enforcing the law.” Discretionary use of body cameras is permitted in situations including those that “will serve a proper police purpose” and where it will support investigations and evidence collections. Such a triggering event could easily occur within a hospital setting and in such cases, simply requires an officer to announce the camera is in use to those with a reasonable expectation of privacy. Notably, however, the policy also specifically excludes the use body camera recording “inside medical facilities, except when directly relevant and necessary to a law enforcement investigation and approved by the member’s immediate supervisor.” 

Overall, there appears to be a substantial gap in law enforcement’s potential use of body cameras in a medical setting, including an emergency room, and the protections afforded by HIPAA. While HIPAA is a legislative mandate governing medical facilities and does not apply to law enforcement, it still requires a medical facility to provide “appropriate safeguards” to protect patient privacy.  However, it remains to be seen what these safeguards are as it relates to law enforcement’s use of body cameras in a medical setting. Medical facilities are free to contact their local law enforcement agency to discuss the agency’s specific policy on the use of body cameras in a medical setting, the bottom line remains that law enforcement may use body cameras in a medical setting without the knowledge of medical providers or patients, thus compromising patient autonomy and privacy as guaranteed by HIPAA. Medical providers certainly can and should “self-regulate” and request officers turn off body cameras, be aware of local law enforcement entity regulations and policies, and contact their local law enforcement agency for specific departmental policies on the use of body cameras.