Video surveillance in the workplace is easy to deploy and often not covered by specific local, state, or federal laws. An increasing number of employers, including many of their security managers, are looking at implementation of inexpensive video systems to ostensibly protect employees from parking lot confrontations and the business from insider theft. Before writing the check, however, there are several regulatory and employee relation safeguards to consider.
Common justifications for video surveillance
Video surveillance is often a good way to protect employees, customers, and patients. For example, businesses have always looked for ways to protect employees as they enter or exit the workplace. Use of monitored cameras is a good way to ensure employees are not bothered by outsiders or other employees. This is almost an expected safeguard if employees work shifts, causing them to traverse parking areas after dark.
Another reason given for video surveillance is prevention of office asset theft, including cash, computers, copiers, intellectual property, national defense materials, etc. In health care facilities, stolen items can also include drugs intended for residents or patients.
A third justification is monitoring patients in long term care or Alzheimer's facilities to make sure they are safe.
Of course, there are other reasons sometimes given. One is ensuring employees actually work while at the office. However, I'll focus on the three reasons given above. My personal opinion about employee productivity video monitoring is that it is taking the place of good management controls. Managers should manage. They should set expectations and ensure appropriate outcomes. If outcomes are consistently missed, video surveillance should not be necessary to terminate employment.
Although whether to implement video surveillance is often a subjective decision, based on unique conditions at a specific location, the following are four general guidelines which might help:
- Identify specific business outcomes
- Objectively document how video surveillance helps achieve the outcomes
- Discuss with legal counsel and HR if the loss of employee or patient privacy exceeds the business benefits gained
- Attempt to identify alternatives with less risk
Risk, as listed in item 4 above, arises from several sources when video surveillance technology is implemented.
Sources of risk and recommended safeguards
Although regulatory and union-related risk varies from location to location, four sources of elevated business risk must be addressed.
- Employee and customer relations issues. Most managers today agree that our employees are our most valuable asset. Turnover due to job dissatisfaction has a direct negative impact on the bottom line and affect our ability to deliver products and services. If employees believe video cameras are used to "spy" on them, overall job satisfaction levels will most likely fall. Additionally, notify employees at time of employment that the company may monitor certain areas in the facility. Similar issues arise when patients or their families are recorded in long term care facilities or hospitals. Ensure clearly visible notices of surveillance with cameras placed in plain view.
- Regulatory concerns. In the U.S., the Health Insurance Portability and Accountability Act (HIPAA) contains very clear standards governing patient privacy. Placement of cameras and how collected data is stored and accessed should be governed by what is considered reasonable and appropriate in the HIPAA and other similar privacy laws. Further, the U.S. courts have made it clear that it's reasonable for employees to expect privacy in areas such as locker rooms, rest rooms, and lounges. Avoid placing cameras or other surveillance technology in these areas. Another regulatory issue arises if audio is included with video. Make sure audio recording solutions don't violate federal, state, or local wiretap laws.
- Retention and e-discovery. A general e-discovery principle is that if it exists, it's potentially discoverable. Output from cameras stored on tape, disk, or other media is subject to discovery during litigation. Develop and enforce strict retention policies controlling how long video files are kept and in what format. IT and Legal personnel should also consider how these videos would be searched pursuant to a discovery order.
- Restricted access. Classify video files as confidential, accessible under strict need-to-know guidelines. In most cases, only investigators or legal counsel need to view them. Similarly, real-time monitoring of cameras should be limited to a select and carefully vetted team. Finally, consider isolating camera networks—physically or logically—from the business network and from the Internet.
The final word
Video surveillance is a great business tool when used intelligently to meet specific business challenges. Understanding these challenges and why video is the best solution is only the first step. Employees, customers, and patients must also understand the reason for surveillance and be provided notice of monitoring activities. Don't avoid video surveillance if it's the best solution for a security or safety issue. Just do it right.
Tom is a security researcher for the InfoSec Institute and an IT professional with over 30 years of experience. He has written three books, Just Enough Security, Microsoft Virtualization, and Enterprise Security: A Practitioner's Guide (to be published in Q1/2013). Before joining the private sector, he served 10 years in the United States Army Military Police with four years as a military police investigator. He has an MBA and CISSP certification. He is also an online instructor for the University of Phoenix.