Healthcare Surveillance: Balancing Patient Privacy with Hospital Security Requirements

Every hospital needs CCTV. And every hospital must protect patient privacy. These two requirements are not contradictory — but they require careful design to coexist. The challenge is that surveillance in a healthcare environment requires a level of ethical and legal scrutiny that most other building types do not demand. A patient in a hospital bed is in a uniquely vulnerable position: physically exposed, emotionally stressed, and trusting the institution with their most personal information. Getting surveillance camera placement wrong is not merely a technical error — it is a violation of patient dignity and, increasingly, a legal breach.

Bangladesh's Personal Data Protection Ordinance 2025 (PDPO 2025) introduces formal legal obligations around the collection and processing of personal data — including surveillance imagery. For Bangladesh hospitals, the PDPO 2025 makes what was previously an ethical imperative into a legal requirement. This article explains how to design a hospital surveillance system that achieves the security objectives you need while meeting the privacy obligations that the PDPO 2025 and professional ethics require.

PDPO 2025 Implications for CCTV in Hospitals

The Personal Data Protection Ordinance 2025 was gazetted following the legislative process that began with earlier draft frameworks. It establishes that personal data — including images that can identify individuals — is subject to specific protections regarding collection, storage, access, and transfer.

CCTV footage from a hospital corridor that captures identifiable patients, visitors, and staff qualifies as personal data under the PDPO 2025. This means the hospital, as the data controller, must comply with PDPO 2025 obligations:

Lawful basis for collection: The hospital must have a documented lawful basis for collecting surveillance footage. In a healthcare context, "legitimate interest" (security, safety, and fraud prevention) is the most applicable basis. The legitimate interest must be proportionate — capturing footage in areas where it is necessary for security purposes, not in areas where collection cannot be justified.

Data minimisation: Collect only the personal data (footage) necessary for the stated security purpose. Cameras in locations where security needs do not justify the privacy intrusion — patient bedside areas, toilets, examination rooms — cannot be justified under the data minimisation principle.

Access controls: Access to CCTV footage must be restricted to authorised personnel — security staff for security purposes, management for incident investigations. General staff should not have access to live or recorded footage. Access to footage for clinical or administrative purposes (not security) requires separate justification.

Retention limits: Footage should not be retained longer than necessary for security purposes. A 30-day retention period is appropriate for routine surveillance footage in most hospital areas. Footage that is the subject of a reported incident or investigation should be preserved for the duration of the investigation and any associated legal proceedings.

Data subject rights: Under PDPO 2025, individuals may request access to footage in which they appear. Hospitals should have a documented process for responding to such requests within the timeframe specified in the ordinance.

Notification: The presence of CCTV surveillance must be communicated to all persons entering the surveilled area. Visible CCTV warning signage at all hospital entrances and surveilled areas is both a legal requirement under PDPO 2025 and good practice.

Camera Placement Ethics: What Must Not Be Captured

The ethical framework for hospital camera placement predates PDPO 2025 and reflects fundamental principles of medical ethics — specifically patient dignity and the therapeutic relationship. These principles establish clear exclusion zones where cameras must never be placed, regardless of what security argument might be advanced.

Patient bedside areas: No camera should have a sight line to a patient's bed in a ward, bay, or private room. Patients in hospital beds are frequently in states of undress, undergoing examination, or engaged in intimate personal care. CCTV capture of these moments is a violation of dignity that no security justification outweighs.

Patient toilets and bathrooms: This exclusion is absolute. Cameras must never be placed in or with sight lines into toilets, bathrooms, shower facilities, or bedpan rooms. This applies to all patient toilets — in wards, in patient rooms, in outpatient areas.

Patient changing areas: Areas where patients change clothes — including pre-operative changing rooms, outpatient clinic dressing areas, and changing facilities adjacent to diagnostic imaging — must not have CCTV coverage.

Examination and consultation rooms: General practice consultation rooms, specialist examination rooms, and counselling or psychiatric consultation spaces must not have CCTV. The confidentiality of the therapeutic consultation is fundamental to the clinical relationship. A patient who believes they may be recorded during a consultation cannot give fully candid clinical history, compromising the quality of their care.

Breastfeeding areas: Designated breastfeeding areas must not be under CCTV surveillance. Mothers must be able to breastfeed with complete privacy.

Approved Zones: Where Hospital CCTV Is Appropriate

Having established the exclusion zones, the following areas represent appropriate and justifiable hospital CCTV coverage:

Hospital entrance and main reception: The main entrance is the appropriate point for capturing the identity of all persons entering the facility. Welcome signage and CCTV warning signs at the entrance inform visitors of surveillance before entry. Cameras here provide deterrence and evidence capture for incidents at the entrance.

Emergency department triage area: The triage point in the ED — where staff first encounter patients — is an area with elevated incident risk (agitated patients, intoxicated individuals, aggressive accompanying persons). CCTV in the triage area (positioned to avoid capturing examination activity) is justified by the legitimate safety interest in detecting and deterring violent incidents.

Corridor and circulation areas: Hospital corridors — including ward corridors, lift lobbies, and main circulation routes — are transition spaces where CCTV is appropriate. Cameras in corridors should be angled to capture the corridor rather than looking into rooms through open doorways.

Nursing stations: The nurse station area — the administrative hub of a ward — may have CCTV for medication security purposes. Camera angles must be configured to avoid capturing adjacent patient areas. The positioning of ward cameras requires on-site review during design to verify that the camera's field of view does not intrude into patient bays.

Pharmacy counters: CCTV above and behind pharmacy counters captures transactions and deters medication theft. Camera positioning should capture the counter area and the face of the person collecting medication, not the label on the medication being dispensed (which may reveal patient medical information).

External areas and car park: The hospital car park, ambulance bay, external walkways, and building perimeter are appropriate for comprehensive CCTV coverage without patient privacy concerns.

Plant rooms and technical areas: No patient privacy concerns arise in boiler rooms, generator rooms, or electrical distribution areas. CCTV here serves security (unauthorised access detection) and safety (monitoring conditions in hazardous plant areas) purposes.

Data Access Controls and Footage Security

PDPO 2025 requires that access to personal data — including CCTV footage — be restricted to authorised personnel for authorised purposes. In a hospital context, this means:

Role-based access to VMS: The Video Management System (VMS) through which CCTV footage is viewed must implement role-based access control. Security staff can view live feeds and recorded footage for security monitoring purposes. IT administrators can manage the technical system. Clinical or administrative staff must not have access to CCTV footage unless they are specifically authorised for an investigation.

Audit logging of footage access: Every instance of CCTV footage being accessed — live view, playback, or export — must be logged in the VMS audit trail with the identity of the user, the camera(s) viewed, and the time of access. This log is itself personal data and must be protected.

Physical security of NVR hardware: The NVR (Network Video Recorder) storing hospital CCTV footage must be in a physically secured location — the IT room or security control room — accessible only to authorised personnel. Footage stored on accessible servers without physical security is a data protection failure.

Export controls: Exporting CCTV footage to portable media (USB drive, DVD) for the purpose of sharing with police, legal counsel, or insurance companies is a data transfer that must be authorised, documented, and carried out following a defined process. Exports must be encrypted where technically feasible.

Retention and automatic deletion: Configure the NVR's recording policy to automatically overwrite footage after the retention period (30 days for routine footage). Do not retain footage beyond the retention period without a documented reason (active investigation, legal proceedings).

Patient Consent Requirements

Under PDPO 2025, consent is one lawful basis for personal data processing — but it is not the only one, and in a healthcare security context, it is not the primary basis. "Legitimate interest" (security of persons and property) is the more appropriate legal basis for general corridor and entrance surveillance. However, some specific situations require explicit patient communication or consent.

Where notice is required (not consent): For general surveillance in common areas (corridors, reception, entrance), clear CCTV warning signage provides adequate notice that surveillance is occurring. This is notice, not consent — you are informing persons of surveillance, not asking them to consent to it.

Where explicit communication is required: If a hospital is implementing any form of surveillance that goes beyond conventional security CCTV — for example, using AI analytics on patient footage to track patient falls in wards, or using people-counting analytics in patient waiting areas — this use must be explicitly communicated in the hospital's patient information and privacy notice.

Where consent may be required: If individual patient identifiers are linked to surveillance footage for clinical purposes (for example, monitoring a specific at-risk patient) rather than security purposes, explicit patient consent or clinical justification must be documented.

Bangladesh Healthcare Privacy Context

Bangladesh's healthcare sector does not yet have a specific healthcare privacy statute equivalent to HIPAA in the United States or GDPR-specific healthcare guidance in the EU. The PDPO 2025 provides the general framework. Professional ethical obligations under the Bangladesh Medical and Dental Council's code of conduct, and the Bangladesh Nursing Council's standards, add professional-layer requirements.

As Bangladesh's private hospital sector continues to grow and to pursue international accreditation (JCI, NABH), privacy requirements become more explicit. JCI Standard RI.2.1 specifically addresses patient rights to privacy and confidentiality, including the right to privacy during physical examination. JCI-accredited hospitals must demonstrate that surveillance systems do not compromise these rights.

SSAL designs hospital CCTV systems with privacy by design as a core principle — camera placement is reviewed against the exclusion zone framework during design, coverage maps are produced showing camera fields of view, and privacy masking is configured in cameras where fields of view could potentially capture restricted areas.

Designing a Privacy-Compliant Hospital Surveillance System

A privacy-compliant hospital surveillance system design process includes four steps:

Step 1 — Stakeholder consultation: Consult clinical staff, nursing leadership, the hospital's privacy officer (if appointed), and patient representatives when defining the surveillance system scope. Clinical staff perspectives on which areas genuinely need CCTV — and which are inappropriate — are invaluable.

Step 2 — Camera placement plan with exclusion zone mapping: Produce a floor plan showing proposed camera positions, camera fields of view, and a separate overlay showing the exclusion zones. Any camera whose field of view overlaps an exclusion zone must be repositioned or have privacy masking applied.

Step 3 — Privacy masking configuration: Modern IP cameras support privacy masking — the ability to electronically black out defined areas of the camera's field of view. A camera at a ward nursing station can have a privacy mask applied to the area of the frame that looks toward patient bays, leaving only the nursing station counter area in the recorded image.

Step 4 — Policy documentation: Produce a CCTV policy document that describes the purpose of surveillance, the approved zones, access controls for footage, retention period, data subject rights, and the process for responding to CCTV-related requests or complaints. This document satisfies the PDPO 2025 transparency requirement.

SSAL's healthcare security team has experience designing surveillance systems for hospital facilities that meet both security requirements and patient privacy standards. Our design process includes the camera placement review and privacy mask configuration as standard deliverables.

Get Free Consultation — Contact SSAL to discuss your hospital's surveillance design requirements. We will help you achieve the security coverage your facility needs while designing a system that complies with PDPO 2025 and protects the patient dignity that is fundamental to quality healthcare.