Video surveillance is now standard in many healthcare facilities. Cameras are designed to increase patient and staff safety, prevent incidents, and support facility management. However, it's important to remember that surveillance footage also constitutes personal data, and in the context of healthcare, it can be particularly sensitive.
Why is monitoring in medical facilities “more sensitive”?
Healthcare facilities are places where health data, a special category of personal data, is processed. Even if cameras don't record medical records, the mere fact that a patient is present in a specific clinic or department can reveal information about their health. This means that the use of monitoring must be particularly carefully considered.
Legal basis and purpose of monitoring
The basis for using video surveillance is most often the legitimate interest of the controller (e.g., ensuring security). However, it is crucial that the entity operating the facility:
- clearly defined the purpose of monitoring,
- demonstrated that monitoring is necessary for its implementation,
- limited the scope of monitoring to a minimum (e.g. avoid recording rooms where patients expect privacy).
Cameras cannot be used “just in case” – a real need is required.
Where can and shouldn't cameras be installed?
In practice, this means that monitoring may be permissible, for example, in:
- entrances to the building,
- corridors,
- reception or waiting room,
- parking lots.
However, special caution should be exercised (and monitoring should often be completely excluded) in places such as:
- medical offices,
- treatment and operating rooms,
- toilets,
- changing rooms.
In these spaces, the patient's right to privacy takes precedence.
Information obligations and transparency
Anyone within range of surveillance cameras should be notified. In practice, this means:
- clear markings (e.g. through pictograms),
- providing access to information about the data controller,
- indication of the purpose and basis of processing.
Transparency is one of the foundations of regulatory compliance.
How long can recordings be stored?
Recordings cannot be stored indefinitely. The retention period should be:
- as short as possible,
- justified for the purpose of monitoring.
In practice, it is often a few days or weeks – but each facility should independently justify the adopted period.
Monitoring and risk analysis
Implementing monitoring should be preceded by a risk analysis and, in some cases, a data protection impact assessment (DPIA). This is particularly important in the healthcare sector, where the risk of violating individuals' rights and freedoms is significantly elevated.
PUODO inspections – topical for 2026
It is worth emphasizing that the healthcare sector has been included in the list of sectoral inspections of the President of the Personal Data Protection Office (PUODO) for 2026. This means that medical facilities – including those using monitoring – can expect increased interest from the supervisory authority.
Summary
Video surveillance in medical facilities may be legal and necessary, but only when used judiciously and with respect for patient privacy. A clearly defined purpose, minimal scope, and transparency are key. In practice, this means finding a balance between security and the right to privacy – a particularly important aspect in healthcare.
This article is for informational purposes only and does not constitute legal advice
Legal status as of March 25, 2026.
Author:
Series editor:
