Yes, hospitals can have cameras in patient rooms, but only when the monitoring serves a real clinical or safety purpose, the patient or their legal representative consents, and the facility follows the federal and state privacy laws that govern the footage. No single federal statute either bans the practice or greenlights it. The answer depends on why the camera is there, whether it captures audio, what your state requires, and how the hospital handles what it records.
Why a Camera Might Be in Your Room
Most cameras in patient rooms are not security cameras. They are clinical monitoring tools, and the purpose matters because the law treats purpose-driven medical monitoring differently from general surveillance.
The most common use is continuous video monitoring, sometimes called telesitting or virtual sitting. A trained technician watches a live feed of several high-risk patients at once, usually through a mobile device set up in the room, and can speak to the patient through two-way audio and alert floor staff if the patient tries to get out of bed or shows other signs of danger. Fall prevention drives most of these interventions, and hospitals lean on the technology to supplement in-person staff during nursing shortages.
Federal regulations specifically authorize video and audio monitoring in one narrow scenario: when a patient is placed in both physical restraints and seclusion at the same time, continuous monitoring must be done either face-to-face or by trained staff using video and audio equipment near the patient.1eCFR. 42 CFR 482.13 — Condition of Participation: Patient’s Rights Outside that situation, CMS does not directly address room cameras.
The Joint Commission, which accredits most U.S. hospitals, has drawn a firm line for patients at high risk of suicide: video monitoring cannot replace constant one-to-one visual observation by a qualified staff member. A camera feed may supplement that in-person watch, but not substitute for it.2The Joint Commission. Video Monitoring of Patients at High Risk for Suicide
What HIPAA Requires
HIPAA does not contain a rule that says hospitals may or may not install cameras. What it regulates is how protected health information is handled, and a video recording of a patient in a hospital room almost certainly qualifies as PHI. The recording captures the patient’s image in a care setting, and the room is typically surrounded by identifiers: name on a wristband, medication lists on a whiteboard, vital-sign displays, and spoken conversations between staff.3U.S. Department of Health and Human Services. Guidance on Covered Health Care Providers and Restrictions on Media Access to Protected Health Information about Individuals in Their Facilities
Because the footage is PHI, the Privacy Rule limits its use and disclosure to what is necessary for treatment, payment, or healthcare operations, unless the patient signs a written authorization for something broader. Administrative staff cannot browse footage from a clinical monitoring camera for non-clinical reasons.
If the footage is stored or transmitted electronically, the HIPAA Security Rule adds technical requirements. Hospitals must implement access controls so only authorized personnel can view recordings, assign unique user identifications, and maintain audit logs of activity in systems that hold the data.4eCFR. 45 CFR 164.312 — Technical Safeguards Encryption is classified as “addressable,” which does not mean optional; the hospital must either encrypt the data or document why an equivalent safeguard is reasonable.5HHS.gov. Summary of the HIPAA Security Rule
Your Right to Personal Privacy Under CMS
Any hospital that participates in Medicare or Medicaid must comply with the CMS Conditions of Participation, which include a plain patient right: “The patient has the right to personal privacy.”1eCFR. 42 CFR 482.13 — Condition of Participation: Patient’s Rights The same rule requires care in a safe setting, notice of patient rights, and a grievance process with a written response.
That creates a practical tension. A camera installed for fall prevention supports the right to a safe setting but potentially intrudes on the right to personal privacy. Hospitals resolve the tension through documented clinical need, patient consent, and PHI-level handling of the footage. When the clinical justification ends, the camera should end with it. A device left running after the patient is no longer at fall risk is difficult to defend under these regulations.
Audio Recording Is a Separate Legal Problem
A camera that captures video without sound raises one set of issues. A camera that also records audio raises a different one, because audio recording triggers federal and state wiretap laws that operate independently of HIPAA.
Under federal law, intercepting an oral communication is illegal unless at least one party to the conversation consents.6Office of the Law Revision Counsel. 18 U.S. Code 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Roughly a dozen states are stricter. Nine require all parties to consent to any audio recording, and four others have mixed statutes that depend on the circumstances. In an all-party consent state, a room camera that picks up a nurse-patient conversation is illegal unless both agreed to be recorded.
Penalties are more severe than most people expect. Depending on the state, criminal violations can be felonies with fines up to $100,000 and prison sentences measured in years. Civil liability adds damages, attorney fees, and litigation costs. That is why many continuous video monitoring systems use two-way audio the patient and staff know about, rather than passive recording of the room.
State Laws Add Another Layer
State law varies substantially. Many states prohibit video surveillance in places where people normally undress, which functionally includes hospital rooms where patients change into gowns, undergo examinations, and receive personal care. Some states require explicit written consent before any camera operates in a patient room. Others allow surveillance under specific conditions, such as a documented safety need, without requiring per-patient consent.
Because no two states handle this the same way, a hospital operating in several states needs location-specific policies rather than one national approach. What matters for you: regardless of the state, you can ask whether cameras are present in your room, what they record, who watches the footage, and how long it is stored. If you are not comfortable with monitoring, ask whether you can decline. In many states, opting out is a legal right, not just a courtesy.
How Consent Should Work
When a hospital wants to place a camera in your room for clinical monitoring, consent is the linchpin. Before the camera turns on, the hospital should explain what it records (video only or video with audio), who watches the feed, whether the footage is stored, how long it is kept, and who can access it later. Your agreement should be documented in writing.
Consent for video monitoring is narrower than a general admission consent form. Signing a consent to treatment does not automatically authorize surveillance. If the hospital later wants to use the footage for something beyond direct patient care, such as staff training, quality review, or any external disclosure, HIPAA requires a separate written authorization that spells out the new purpose and lets you refuse.3U.S. Department of Health and Human Services. Guidance on Covered Health Care Providers and Restrictions on Media Access to Protected Health Information about Individuals in Their Facilities
When a patient cannot consent because of age, cognitive impairment, sedation, or an emergency, the decision falls to a legal guardian, healthcare proxy, or other authorized representative. If no representative is available and monitoring cannot wait, many hospital policies prohibit using the footage for any purpose until consent is obtained after the fact. You or your representative can withdraw consent at any time, and the hospital must accommodate that decision.
When You Want to Record the Hospital
The question runs in both directions. Patients and family members increasingly want to record interactions with staff, whether to remember discharge instructions, document care quality, or preserve evidence of suspected mistreatment. Hospitals generally cannot ban this outright, but they can set conditions.
Most hospital policies allow patients to record conversations about their own treatment with the treating provider’s knowledge. Restrictions kick in when the recording captures other patients’ information, interferes with care delivery, or includes staff members who have not agreed to be recorded. A family member filming a nurse without the nurse’s knowledge could violate wiretap laws in an all-party consent state, and hospitals have legitimate grounds to stop recordings that create an unsafe environment or compromise other patients’ privacy.
Hidden recordings are the highest-risk category. Even in a one-party consent state, a concealed camera left in a room may pick up conversations the patient is not part of, such as two nurses discussing another patient’s care. That would violate wiretap law regardless of intent. The safer approach is to record openly, limit the recording to your own interactions, and ask staff first.
If You Think Your Privacy Was Violated
If you believe a hospital recorded you without proper consent or mishandled footage from your room, you can file a complaint with the Office for Civil Rights at HHS. OCR investigates complaints against healthcare providers that violate the HIPAA Privacy, Security, or Breach Notification Rules, and its investigations can result in corrective action plans and financial settlements.7HHS.gov. Filing a Health Information Privacy Complaint OCR has previously penalized hospitals for exposing patient information to unauthorized viewers, including a 2023 settlement of $240,000 involving security guards accessing medical records.8HHS.gov. Resolution Agreements
You can also file a grievance directly with the hospital. CMS requires every participating hospital to maintain a grievance process, provide a written response, and identify a contact person who can address your concern.1eCFR. 42 CFR 482.13 — Condition of Participation: Patient’s Rights If the issue involves audio recording without consent, your state attorney general’s office handles wiretap law enforcement. If you suffered actual harm from unauthorized surveillance or a data breach, a private attorney can advise you on state tort claims, because OCR settlements go to the government, not to you.
How Long Footage Is Kept
Retention varies widely. There is no single federal rule dictating how long clinical video monitoring is retained. Some facilities overwrite footage within days unless it has been flagged for an investigation or incident review. Others keep recordings for weeks or months, depending on internal policy and state records-retention requirements.
What does not vary is the obligation to protect footage while it exists. Under the HIPAA Security Rule, video recordings that qualify as electronic PHI must be subject to access controls, audit trails, and integrity protections for as long as they are stored.4eCFR. 45 CFR 164.312 — Technical Safeguards You can ask your hospital how long it keeps footage and whether a recording of your stay still exists. If the footage qualifies as part of your medical record, you may also have the right to request a copy, though reproduction costs vary by state.