HIPAA Compliant Security Cameras: What Hospitals Actually Need to Look For

A hospital IT director gets the same request every few years: expand camera coverage, or replace a system that has aged out. This time, Legal attached a question. Do cameras in corridors, waiting areas, med rooms, and ED entrances create a PHI exposure? The search for HIPAA compliant security cameras starts there, and page one is a wall of vendors selling exactly that.

No camera is HIPAA compliant. No camera can be. HIPAA compliance describes how an organization handles protected health information: the healthcare provider that is the covered entity, and any business associate that handles PHI on its behalf. The obligation sits with those organizations, not with the hardware manufacturer. There is no certification a camera company can earn for its cameras and no box a product can tick.

HIPAA doesn't ban cameras in hospitals, either. It governs what happens to footage once a camera captures PHI: who accesses it, how it is stored, how long it is kept, and whether that access is logged. Those four questions are the real evaluation, and a compliance badge answers none of them.

TL;DR

• HHS and its Office for Civil Rights certify no products and endorse no vendors. A vendor claiming HIPAA certification is describing its own self-assessment.
• The useful buyer question is whether a system lets you meet obligations you already carry, and whether you can prove you met them.
• Footage becomes PHI when it identifies an individual and relates to their health condition, care, or payment. Camera placement decides how often that happens.
• Per-camera permissions and audit logs of who viewed and exported footage do the most to change your compliance position, and most vendors leave the details to a sales call.
• HIPAA sets no retention period for camera footage. State law, accreditation expectations, and your own policy set it.
• Any vendor that can access footage containing PHI needs a Business Associate Agreement, including integrators with remote support access.

Why "HIPAA Compliant Security Cameras" Is a Category Error

Compliance obligations attach to organizations, and equipment carries none of them. HHS and its Office for Civil Rights (OCR) enforce HIPAA, and neither certifies persons or products as HIPAA compliant or recognizes private certification programs as proof of compliance. There is no federal registry of approved cameras, no seal with regulatory standing, and no auditor who will accept a vendor logo in place of your own documentation.

That changes the question a buyer should ask. "Is this camera compliant?" has no answer. "Does this system let us meet the obligations we already carry, and can we show we met them when someone asks?" does.

The distinction carries commercial risk as well as regulatory risk. The Federal Trade Commission has shown that HIPAA-linked security marketing can be deceptive under Section 5: in 2016, Henry Schein Practice Solutions paid $250,000 to settle charges that it overstated its dental software's encryption and implied the software helped practices meet HIPAA obligations. A hospital that treats a vendor badge as a transfer of liability has transferred nothing.

The argument applies to every vendor in this market, including the one publishing this article. Coram is an AI physical security platform that works with the IP cameras you already own, and it can support a hospital's compliance obligations through access control, audit visibility, and where it stores footage. When Coram describes itself as HIPAA compliant, as its trust page does, that statement covers Coram's own program for handling PHI as a business associate. It doesn't make anyone's deployment compliant, and no vendor's claim can, because a "HIPAA compliant camera system" is not a category that exists.

What the HIPAA Security Rule Requires of Your Organization

The Security Rule sorts obligations into three safeguard categories, and a camera platform touches each one differently. Knowing which is which tells you where to spend evaluation time.

The minimum necessary standard sits across all three, and it applies to footage the same way it applies to charts. Not everyone with a login should see every camera. A guard covering the loading dock has no business pulling up the ED triage desk, and a system that can't express that distinction leaves you with a policy you can't enforce.

Administrative Safeguards

Administrative safeguards are your policy work: risk analysis, documented policy, workforce training, sanctions, and named responsibility for security. A vendor contributes almost nothing here. A missing or stale risk analysis is one of the failures OCR cites most often, enough that it launched a dedicated Risk Analysis Initiative in 2024, and no platform purchase fixes that.

Physical Safeguards

Physical safeguards cover facility access, workstation security, and device and media controls, and a vendor contributes partially. The platform's architecture shapes where recorders live, who can walk up to them, and how drives get retired. Your facilities team executes the rest.

Technical Safeguards

Technical safeguards cover access control, audit controls, integrity, and transmission security. This is where a platform changes your position the most, and where your evaluation effort belongs.

When Your Camera Vendor Needs a Business Associate Agreement

Any vendor that creates, receives, maintains, or transmits PHI on your behalf is a business associate and needs a signed BAA before footage reaches them. For camera systems, that covers cloud VMS providers, hosted storage, and integrators with remote support access into your environment.

Encryption does not remove the requirement. HHS has addressed this directly for cloud service providers: a provider that stores or processes ePHI meets the business associate definition even when the data is encrypted and the provider holds no decryption key. The obligation follows custody, not visibility.

Two questions get skipped in most evaluations, and both belong in procurement:

• Which vendors and integrators can reach live or recorded footage, including through a support tunnel opened during troubleshooting?
• Does each of them sign a BAA, and does that BAA flow down to their subcontractors?

Ask each vendor for its security and trust documentation alongside the agreement. Retaining the executed BAA is itself a HIPAA documentation obligation, and a BAA that was filed and forgotten tends to surface at the worst possible moment in an investigation.

How Long Hospitals Must Retain Security Camera Footage

HIPAA sets no retention period for camera footage. The six-year figure that circulates in this market comes from 45 CFR 164.316(b)(2), which governs how long you keep policies, procedures, risk analyses, and other compliance documentation. It covers your written camera policy. It says nothing about the video.

The actual window comes from state hospital licensure rules, accreditation expectations, payer and litigation holds, and your own documented policy. Those vary enough that a multi-state health system will land on different numbers in different facilities. That makes a strong case for a platform that sets retention per site instead of as one global setting.

Where Hospital Security Cameras Capture PHI, Zone by Zone

Footage becomes PHI when it identifies an individual and relates to their health condition, care, or payment. In a hospital, context alone often meets that threshold, because the recording establishes that a person sought care at a covered entity. A wristband, a whiteboard, a monitor in frame, or a visible acuity level deepens the exposure.

Where the camera points decides how much exposure you carry.

Two hospitals can buy identical cameras and end up in completely different compliance positions. Placement and access control are deployment decisions, which is why the compliance question can't be answered at the product level. Two zones on the list need more than a row in a table.

Pharmacy and Med Rooms

Pharmacy and med rooms carry a tension the other zones don't. Diversion control programs frequently require coverage of dispensing stations and controlled-substance storage, and those same rooms are where staff handle patient-identified medication. Coverage is expected and exposure is high at the same time, which makes tight viewing permissions on those specific cameras more important than anywhere else in the building. Pairing coverage with tailgating and forced-door alerts on the same doors gives you the entry record alongside the footage.

Behavioral Health Units

Behavioral health carries a different constraint. Accrediting bodies have drawn a line between video monitoring and the direct observation required for patients at elevated clinical risk, so video supplements staffing protocols and never replaces them. Where a unit also carries weapon detection requirements, the same placement review should cover both.

Five Requirements for HIPAA Compliant Security Cameras

If compliance can't be bought, provable control can. Buyers searching for HIPAA compliant security cameras are really shopping for the five capabilities below. Each one lets your organization demonstrate compliance, and each comes with a way to test the claim while the sales engineer is still on the call.

1. Role-Based Access Control Enforced per Camera

Site-level permissions are the common default, and they fail in hospitals because one building holds zones with very different exposure. A role scoped to "Main Campus" that lets a guard see the lobby also lets them see the ED.

You need permissions set at the camera or zone level, so the minimum necessary standard survives contact with a real org chart. The same question applies to your hospital access control system, since the same admin usually grants door permissions and camera permissions.

Demo test: Ask the vendor to build a role in front of you that can see the lobby and cannot see the ED.

2. Audit Logging of Viewing and Export

This requirement eliminates most shortlists, and it's the closest single proxy for the whole argument. Compliance is provability. A system that can't tell you who watched what leaves you unable to answer the first question anyone asks after an incident.

Most legacy NVR deployments can't produce this report. A usable audit trail records three things:

• Who viewed a given camera, and when
• Every export, download, and share, with its destination
• Administrative changes to roles, retention, and camera configuration

Demo test: Ask for a report of all views of one camera over the past 30 days, generated live.

3. Encryption in Transit and at Rest

Every vendor claims encryption, and the practice behind the claim is uneven, which makes location the useful version of this question. Where does footage physically live, in which data center or on which appliance, under which jurisdiction, and who holds the keys?

The answers determine your BAA obligations, your breach notification exposure, and, in a multi-state system, which state rules apply to which recordings. Get them in writing, as trust or security documentation you can attach to your risk analysis. A verbal assurance from a sales engineer won't hold up in an audit.

Demo test: Ask the vendor to name where one camera's recordings are stored and who holds the keys, then check the answer against their written documentation.

4. A Signed BAA Covering Every Path to Footage

Ask for the BAA in writing during evaluation, and ask separately about vendor remote support. Support access is the path most often left off vendor questionnaires, because it's intermittent and gets treated as a service instead of as data access.

Demo test: Ask who at the vendor can view your footage during a support session, and what logs that session.

5. Retention Control You Can Configure and Prove

Retention needs to be set per camera or per zone, because the ED and the parking structure are unlikely to belong under the same policy. Setting it is half the job. You also need to evidence it, which takes per-camera or per-zone configuration, a change history showing who altered a retention setting and when, and documented, verifiable deletion at the end of the window.

Demo test: Ask to see the change history for one camera's retention setting, including who changed it and when.

Beyond the Five: Support for the Cameras You Already Own

Most hospitals already run ONVIF-compatible cameras and have no capital budget to rip and replace them. A platform that adopts existing hardware changes the cost equation, and it changes the compliance timeline too. A system you can deploy this quarter closes an audit gap that a two-year hardware refresh leaves open.

Healthcare Video Surveillance Platforms Compared on What Actually Matters

Four things decide a healthcare video surveillance deployment: where footage physically lives, who can be blocked from seeing it, whether the vendor will sign a BAA, and whether the cameras you already own survive the purchase. Instead of asking which vendors sell HIPAA compliant security cameras, the table covers the three of those four that vendors document publicly. BAA terms almost never appear in public documentation, so that question gets settled in the contract. Coram publishes this guide, and every row, Coram's included, reflects what the vendor documents publicly.

Five of the seven publish real detail on audit logging. Verkada documents per-camera audit logs with CSV export, including camera views and any window in which its own support staff is granted access to a customer organization. Rhombus documents audit trails covering footage access, exports, and shares. Milestone's XProtect logs exports and live and playback viewing once audit logging is turned on. Genetec logs every removal of its privacy masking. Coram lists audit logs among its published security features, and its security questionnaire answers, available on request, cover logins, live viewing, searches, playback, exports, shared links, permission changes, deletions, and Coram's own support access. Avigilon Alta documents audit logs of user logins, including partner and support access, but not of viewing or export. Brivo leaves audit specifics to a sales conversation.

The access control column is thinner still. Per-camera viewing permissions and healthcare BAA terms are the two things that most determine your compliance position. Genetec, Milestone, and Avigilon Alta document camera-level permissions, Coram documents camera-group limits for non-admin users, and none of the seven publishes healthcare BAA terms. That gap is a finding in itself: these questions get settled in a demo and in a contract, which is the practical form the whole argument takes.

Vendor Breakdown: Seven Video Surveillance Platforms for Healthcare

No vendor here can sell you HIPAA compliant cameras, so each entry focuses on whether the platform makes your own controls provable. Every entry is judged against the same criteria as the table, and every one, Coram's included, names where the platform falls short for a healthcare IT team.

Coram

Coram is an AI physical security platform that connects to the IP cameras you already own and manages video security, access control, guest management, and emergency management from a single dashboard.

Coram's case in a hospital starts with the cameras already on the walls. It works with 150+ camera brands over ONVIF or RTSP, so a health system can keep its existing fleet and add AI detection, centralized permissions, and cross-site access on top. For a hospital with several hundred working cameras and no capital budget, that turns a replacement project into a software deployment.

Recording stays local. Coram Point, an on-site appliance, records to RAID inside the facility and runs first-stage AI detection on premises on NVIDIA edge hardware, while the cloud layer handles viewing, AI search, alerts, and multi-site access. For an IT director weighing where ePHI sits, primary storage never leaves the building. Clips that users stream remotely, share, or archive to Coram's cloud Video Vault do reach Coram's US cloud, so the BAA question from earlier still applies.

Access control and video run on the same platform, which changes how investigations work. When a med room door opens after hours, the access event and the video of it land in one record, so a diversion review starts there and skips the manual reconciliation of a door log against an NVR timeline. In a multi-campus system, that review runs from one console with no site visit or VPN hop. Discover finds footage from a plain-language description, and Journey Path follows a person across cameras.

Coram is SOC 2 Type II audited, and its published security controls cover the questions a hospital buyer will ask. Video is recorded on the device at your site, event detection runs on the device, all data in transit is encrypted with TLS, user data held in the cloud is encrypted at rest, and shared video links are monitored and expire after a set timeout. That last control matters more than it looks in a hospital, because uncontrolled clip sharing is a common way footage leaves a governed system. Recipients can download a clip while its link is live, so the expiry window is the control.

Coram also answers the first two demo tests on paper. Admins can limit each non-admin user to specific camera groups, and the audit log captures logins, live viewing, searches, playback, exports, shared links, permission changes, deletions, and Coram's own support access. Support reaches the appliance through an outbound tunnel that the customer can switch off.

Best for: Multi-facility health systems that want centralized access control and audit visibility without moving recording off premises or replacing working cameras.

Watch for:

• Camera configuration changes aren't captured in the audit log today. Ask how retention-setting changes are evidenced before relying on demo test five.
• Video stored on the Coram Point isn't full-disk encrypted by default. Protection relies on the appliance's physical security, access controls, and an isolated camera network, so raise it in demo test three and document it in your risk analysis.
• Limited roles can currently archive clips to the cloud Video Vault, and there's no setting yet to block that. Keep archive-capable roles small.
• Each site needs a Coram Point appliance, so there is still on-site hardware to place, power, and physically secure.

Pricing: Per-camera subscription. Coram publishes no rate card, so pricing comes from a quote for your deployment.

Verkada

Verkada is a cloud-managed physical security platform that runs cameras, access control, alarms, intercoms, and visitor management from a single console.

Verkada is the stronger choice over Coram for a health system that is replacing cameras anyway and wants one vendor across every physical security layer. For a thin IT team, a single support relationship is a real operational advantage. The tradeoff is architectural: recording sits on Verkada cameras, management runs through Verkada's cloud, and third-party cameras connect through a separate Command Connector appliance.

Best for: Health systems refreshing hardware that want one vendor for video, doors, alarms, and visitors.

Watch for:

• Permissions are scoped to sites and subsites, so separating the ED from the lobby means modeling them as separate subsites.
• If your security committee requires video to stay inside the network, the cloud dependency is part of the architecture, and no setting changes it.

Pricing: Per video stream; multi-sensor cameras use more than one license.

Rhombus

Rhombus is a cloud-managed video security platform built around its own cameras, with recordings stored on board each camera.

Rhombus is a better fit than Coram for a single-campus hospital or clinic group that is replacing cameras anyway and wants strong deployment guidance. It publishes the most useful zone-based placement guidance of any vendor here, and it states the compliance position plainly, including that no camera is inherently HIPAA compliant. It also documents role-based controls over who can view, export, and share footage, along with audit trails covering those actions, which is more than most vendors put in writing.

Recording lives on the camera itself, with 20 to 180 or more days of storage depending on model and settings, and every camera carries a 10-year warranty. Pricing is also public: Rhombus publishes hardware and license prices, which makes it easy to model the cost of a refresh before talking to sales.

Best for: Single-campus hospitals and clinic groups doing a hardware refresh that want cloud management with strong deployment guidance.

Watch for:

• The platform is built around Rhombus cameras. A hospital with several hundred working ONVIF cameras would likely be replacing most of them.
• Third-party cameras connect through the N100 Relay appliance, and each one still needs a Rhombus license. Confirm which features carry over to your specific models before planning a mixed fleet.

Pricing: $149 per camera per year on the Professional license, sold in 1-, 3-, 5-, or 10-year terms. Cameras are a separate one-time purchase, starting at $399 MSRP.

Brivo (with Eagle Eye Networks)

Brivo is a cloud-managed physical security platform that combines access control, video, intrusion, and visitor management in the Brivo Security Suite.

Brivo and Eagle Eye Networks announced their merger in December 2025, and the combined company operates under the Brivo name, so anything a buyer reads about Eagle Eye should be checked against that change, support relationships and contract paper included. Brivo is the better fit over Coram for a health system that wants cloud VMS from a vendor whose suite already spans doors, video, and intrusion. Its Bridge and CMVR appliances record locally and sync video and metadata to the cloud, and its large published ONVIF compatibility list suits the mixed estates hospitals accumulate over decades of construction projects, though compatibility runs through that list, so confirm your specific models.

Best for: Health systems with mixed legacy camera fleets that want cloud-managed video with on-site recording appliances.

Watch for:

• Video and metadata synchronize to Brivo's cloud by design, which puts the BAA and data-location questions at the center of the evaluation.
• The suite has no emergency management module, so panic and lockdown workflows need a separate system.
• Merger-period consolidation warrants a direct conversation about support continuity.

Avigilon Alta

Avigilon Alta is Motorola Solutions' cloud-managed video and access control platform, storing footage on board its own cameras or in on-site Cloud Connector appliances.

Avigilon Alta is the better fit over Coram for an enterprise already standardized on Motorola for radio or dispatch, where adding video and access control to an existing commercial relationship simplifies procurement. A large parent company carries more weight in health system purchasing than in most verticals, and Avigilon backs that with a SOC 2 Type II attestation and ISO 27001 certification for its cloud services.

Avigilon Alta also documents more of the controls this article cares about than most of the field. Administrators can grant access per feature and per camera, recordings and metadata are encrypted at rest with a key unique to each deployment, and administrators decide whether Avigilon support or partners can reach the deployment at all, with optional time limits. Every login is recorded in the audit log, including logins through partner and support access. Existing ONVIF cameras connect through Cloud Connector appliances that handle up to 200 streams each, and a single deployment scales to 10,000 cameras.

Best for: Enterprises already standardized on Motorola that want video and access control under one commercial relationship.

Watch for:

• The product line spans Avigilon Alta and Unity, an on-premises line with a different architecture, and buyers routinely evaluate one while being quoted the other. Pin down which platform a proposal covers before comparing anything else.
• Avigilon's strongest analytics are tuned for its own cameras, so third-party hardware limits what the AI can do.
• Avigilon's public documentation describes audit logging of logins, not of who viewed or exported specific footage. Run demo test two.

Genetec

Genetec Security Center is an open, standards-based platform that unifies video, access control, and license plate recognition, deployed on premises, hybrid, or as SaaS.

Genetec beats Coram for large multi-hospital systems with in-house security engineering and an established integrator relationship. Those teams get configuration depth that cloud-first platforms don't match, and camera support is rarely the constraint. Genetec is also one of three vendors here that document permissions down to specific cameras, through partition-based privileges with user-level overrides.

One Genetec capability maps unusually well to the minimum necessary standard. KiwiVision Privacy Protector anonymizes the people in a camera's view by pixelating them, and only users with a separate Remove privacy protection privilege can reveal them. Every removal is logged, and Security Center's user auditing shows who did it. In an ED waiting room, that lets an operator watch for incidents without seeing who is sitting there.

On certifications, Genetec lists SOC 2 Type II compliance and ISO/IEC 27001 and 27017 certification for its cloud services, including Security Center SaaS and Stratocast.

Best for: Large health systems with dedicated physical security staff and a long-standing integrator, running on premises or hybrid by policy.

Watch for:

• Changes are integrator-led, and deployment timelines run long.
• A lean hospital IT team inherits server infrastructure to maintain. That is a legitimate trade for control, and it should be a deliberate one.
• Genetec's SOC 2 and ISO certifications cover its cloud services. In an on-premises deployment, your team supplies the evidence for its own servers.

Milestone

Milestone XProtect is an open, on-premises video management system (VMS) that supports more than 14,000 devices and integrates with more than 1,000 third-party applications.

Milestone beats Coram when policy requires footage to remain entirely on your own infrastructure, viewing included. For a hospital under a strict data-residency policy or running segmented clinical networks, that full local control is the whole point. Milestone reports more than 500,000 installations worldwide, so integrators who know it are easy to find. Milestone's cloud offering, Arcules, is a separate VSaaS product and not a cloud tier of XProtect.

XProtect also covers more of the evidence trail than its reputation suggests. Roles can set live viewing, playback, and export rights camera by camera. Audit logging records exports and live and playback viewing in the Smart Client, digital signing proves that recorded and exported footage hasn't been altered, and Evidence Lock protects selected recordings from deletion when a litigation hold applies.

Best for: Organizations whose policy requires footage to remain entirely on their own infrastructure.

Watch for:

• Audit logging is off until an administrator turns it on, and logging playback depends on threshold settings. Confirm both are configured before you rely on the logs.
• XProtect comes in four variants (Express+, Professional+, Expert, and Corporate), and features vary by tier. Confirm which one a proposal covers.
• Centralized viewing and permissions across a distributed health system take deliberate engineering, and every safeguard a cloud platform provides by default becomes your team's build and your team's evidence.

How to Choose Security Cameras in Hospitals, by Scenario

The right platform depends less on feature count than on which constraint binds: your existing camera fleet, your site count, your state's consent rules, or a deadline you're already behind on. Most hospitals start from one of four positions.

Single Hospital, Existing ONVIF Cameras, Limited Capital Budget

Adoption beats replacement. Prioritize platforms that ingest your current fleet, then put the savings into the access control and audit logging you're missing. Those change your compliance position. A resolution upgrade in a corridor doesn't.

Multi-Site Health System with Centralized IT

Test whether roles defined centrally enforce per camera at every site, and whether retention can differ by state while permissions stay uniform. Ask to see one console administering multiple sites with different retention windows.

Behavioral Health or a State Consent Regime

Start with counsel and your compliance committee, then bring the shortlist a written placement plan. Require per-camera permissions ahead of everything else, and confirm that video supplements required direct observation instead of replacing it.

Mid-Audit or Post-Incident

Filter hard on requirement two and treat the rest as secondary. Ask each vendor to produce a who-watched-what report during the demo, because a vendor that can't do it live won't do it under deadline. Timeline matters as much as features here, so weight platforms that adopt existing cameras and reach production in weeks.

Ask a Better Question at Your Next Vendor Call

The IT director from the start of this article went looking for HIPAA compliant security cameras. The better question to take back to Legal is whether you can show who saw what.

That's an architecture and access control question, and it has an answer. If your committee has decided that recording stays in the building, the market narrows quickly. Coram's approach to hospital security cameras is built around that decision: recording stays local on Coram Point while viewing, search, and permissions run across every site, so a health system can reach footage from anywhere without moving where it's stored.

The other constraint is the hardware already on your walls. Most of the budget in a compliance-driven camera project goes to replacing cameras that still work, and it rarely needs to. Send Coram the camera list from your last audit and find out how much of it can come along.