Where should security cameras go in a dental office?

Key facts

Where do cameras belong?

Where you need a record of who came and went, and where money or controlled items change hands:

• Every exterior door, inside and out
• Front desk and check-out, aimed at the counter and people, not at screens
• Main corridors
• The rack or server room, and any medication storage

These come from FloorStack's own placement guidance (FloorStack). The network closet is one HHS calls out specifically. Its 405(d) guide for small healthcare organizations says data and network closets should stay locked, and suggests a continuously recording camera as a way to audit access where the lock can't log entries (HICP Technical Volume 1).

Where should cameras never go?

• Operatories or any room where treatment happens
• Restrooms
• Private offices and break rooms

Patients and staff have a strong expectation of privacy in these spaces (FloorStack). Every state and DC has laws against certain uses of hidden cameras in private places (RCFP). Recording in a restroom or a changing area creates legal exposure that no security benefit justifies.

Some practices want operatory recording for liability or training reasons. That's a decision for your healthcare attorney and malpractice carrier, with written patient consent, not something to configure by default.

Can my cameras record audio?

Be very careful. Federal law requires at least one party's consent to record a conversation (RCFP, citing 18 U.S.C. §§ 2510–2511). A ceiling camera recording the front desk isn't a party to the conversation it captures, so in many situations no participant has consented.

States add stricter rules. The Reporters Committee for Freedom of the Press lists about 11 states with primarily all-party consent requirements: California, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan (at least for third-party recordings), Montana, New Hampshire, Pennsylvania and Washington. Others, including Missouri, Oregon, Connecticut and Nevada, require all-party consent for some kinds of conversations (RCFP).

The same source notes that if your camera doesn't record audio, wiretap laws generally won't apply (RCFP). The practical default: video only, audio disabled in the recorder settings, and posted signage. Get legal advice before changing that.

Is camera footage covered by HIPAA?

It can be. Footage that shows identifiable patients in a care setting can reveal that someone is a patient of your practice. Treat the recorder as a system that may hold patient information:

• Point cameras away from monitors showing patient data (FloorStack)
• Limit who can view and export footage, and log it
• If a camera vendor or cloud video service stores footage, assess whether it needs a business associate agreement. HHS says cloud providers that store ePHI are business associates (HHS)
• Include the camera system in your risk analysis (HHS)

How should cameras connect to the network?

On their own segment. HHS 405(d) recommends placing IoT devices, naming security cameras, badge readers and building systems, in more restricted network zones (HICP Technical Volume 1). Cameras are frequent targets because owners rarely update them.

Practical setup:

• A camera VLAN that can reach the recorder (NVR) and nothing clinical
• Default passwords changed. CISA lists changing default admin usernames and passwords as a baseline control (CISA)
• Remote viewing through a VPN or the vendor's secured app with MFA, not a port opened on the firewall (CISA)
• The NVR admin login held by the practice, not just the installer (see who owns your passwords)

Who should own the camera system?

The practice. Camera installers often set up the recorder, the cloud viewing account and the mobile app under their own login. That works until you change vendors and find you can't see your own footage. Put the NVR admin account, the cloud account and the license in the practice's name. Hold those credentials yourself, and give the installer its own separate login that you can remove. The same rules that apply to your IT contract apply here (what your IT contract should say). HHS 405(d) even suggests a continuously recording camera as one way to audit access to locked data and network closets, which makes camera access a security matter, not just a convenience (HICP Technical Volume 1).

What does camera planning mean for the build-out?

Each camera needs a ceiling drop, usually powered over Ethernet, run back to the rack (FloorStack). That means camera locations have to be on the drawings before rough-in. Count them alongside your operatory drops, and size the PoE switch and UPS for them in your network design.

To see this on your own floor plan, FloorStack Studio (live, free plan) builds a 3D IT plan of your office with every device placed.

To turn this into a drawing your low-voltage contractor can bid, the free network & IT plan generator (coming soon) is planned to produce drops, rack, Wi-Fi and VLAN plans from your floor plan.

How FloorStack helps

The free FloorStack Studio plan draws each camera's field of view against your real walls, so you can see what it will record before it goes up. Each camera gets its drop, switch port and recorder location on the plan. It's part of the FloorStack dental build-out platform. Start a free Studio plan, or see the Dental Office IT Setup hub.

Free tools on the FloorStack dental build-out platform for this step: Network & IT plan generator (free tool, coming soon).

Free tools for this step

• FloorStack Studio (live, free plan): a 3D IT plan of your office with every device placed.
• Network & IT plan generator (free tool, coming soon): turn your floor plan into a drops, rack, Wi-Fi and VLAN plan.