Healthcare footage shows people at their most vulnerable, and sooner or later, someone asks to see it. A single request can take in patients, visitors, staff and children. As Natasha Quick, Security Lead at Royal Cornwall Hospitals NHS Trust, puts it: "People are ill, anxious and sometimes intoxicated".
In the UK, footage is held by NHS trusts, ambulance services, care homes and independent hospitals. In the US, it is held by hospitals and a range of other health care providers.
This guide helps you decide whether your current footage release process—manual or built into your camera system—will keep up as you install more cameras and more requests arrive. And what to look for if it won't.
#Where healthcare footage comes from
Video footage can come from several sources in the healthcare environment:
Fixed CCTV across wards, A&E Departments, corridors and car parks
Body-worn cameras on security officers, clinical staff and ambulance crews
Phones—including patients recording their own care
Rising hostility towards healthcare workers prompted organisations to equip frontline personnel with body-worn devices. According to NHS England data from the 2025 Staff Survey, 14.47% of respondents reported experiencing physical violence from patients, relatives, or visitors over the preceding year. NHS England has provided £8.4 million to all 11 ambulance services to evaluate body-worn cameras in a three-year trial.
The situation in the US is equally concerning. Healthcare workers accounted for 73% of all non-fatal workplace injuries and illnesses caused by violence in 2018, according to the Bureau of Labor Statistics.
Barnsley Hospital NHS Foundation Trust first deployed body-worn devices to protect security personnel more than a decade ago. Meanwhile, Manchester University NHS Foundation Trust rolled out over 100 devices to support clinical and security staff, noting that a single camera may capture fifty or more individuals within a short period—a stark reminder that every new lens inflates the volume of potentially disclosable material.
Read our overview of what NHS security managers heard about staff safety at the 2023 NAHS conference, run by the National Association for Healthcare Security. And to explore surveillance technology further, see the healthcare section of our CCTV guide.
#Who asks for it, and how fast you must answer
A patient, a family, a solicitor, an insurer, the police, a court or the regulator may request healthcare footage. At Manchester University NHS Foundation Trust, most requests come from the Trust's own investigations rather than from the public: slips, trips and falls, car-park collisions, patient complaints and allegations against staff, among others. Our article on hospitals shows how a trust handles one request that spans CCTV, body-worn and phone footage.
According to Barnsley Hospital NHS Foundation Trust, relatives may request video recordings when they are dissatisfied with a family member's care. Legal representatives and insurers also request footage.
Law enforcement enquiries, including missing-person cases led by local police, fall under the remit of Royal Cornwall Hospitals NHS Trust, which also processes video recordings for coronial proceedings. Likewise, South London and Maudsley NHS Foundation Trust supplies redacted footage to regulatory bodies like the Care Quality Commission (CQC).
In care home environments, the Care Quality Commission notes: "If you use surveillance to help keep people safe or monitor their wellbeing, we treat it as part of their care." Read our piece examining how families, employees and regulators access care home video recordings.
Whatever the route, the footage leaves the building, and someone else sees it. In the words of the Information Commissioner's Office (ICO), "Once you have disclosed information to a third party, they become the controller for the copy they hold."
Under UK regulations, the ICO requires organisations to fulfil a subject access request (SAR) promptly, within one month of receipt. However, extensions of up to two additional months are permitted for complex cases or multiple submissions.
In the US, the Health Insurance Portability and Accountability Act (HIPAA) grants individuals access to their medical records. Guidance from the US Department of Health and Human Services (HHS) requires healthcare providers to process access applications within 30 calendar days of receipt, with a single 30-day extension allowed if formally justified in writing.
However, this entitlement applies only to files classified as a designated record set; surveillance footage not used in clinical decision-making generally falls outside that definition. Beyond HIPAA access requests, footage can leave a US hospital through legal discovery or at the police's request.
Also in the US, a 2024 white paper on body-worn devices by the International Association for Healthcare Security and Safety (IAHSS) Foundation notes that patients may have a legal right to request body-worn camera footage if it is considered part of their record, and in some states even if it is not. It adds that the police may want footage that shows evidence of a crime, such as an assault.
Public-records petitions present another avenue for requests involving state-run facilities. When members of the public requested emergency department lobby footage from Oregon Health & Science University (OHSU), the Multnomah County District Attorney’s order of 13 March 2025 noted that the petitioners had experienced a negative interaction with staff while seeking medical care, leading to pending litigation. Because OHSU is a public institution, this disclosure mechanism applies—a pathway unavailable when dealing with private healthcare providers.
#What has to come out before footage leaves
In hospital footage, everyone who isn't the subject of the request must be protected, and what has to come out goes well beyond faces. Manchester University NHS Foundation Trust lists what its footage can hold:
patients receiving treatment
children and vulnerable adults
visitors
staff
computer screens showing patient records
clinical documents
medical equipment displays
hospital signage that identifies someone
vehicle registration numbers.
Body-worn footage also captures sound, which can include names, conditions and conversations.
According to the ICO's guidance, organisations may need dedicated software to obscure third-party audio and visual elements, using techniques like blurring, masking, or solid fills to hide specific details. In a practical example of an effective body-worn setup, the regulator shows how teams can quickly pinpoint relevant recordings and apply the necessary redactions to protect bystander privacy while meeting strict legal deadlines.
When footage reveals something about someone's health, it is designated as health data. The ICO defines it as personal data that "reveals information about his or her health status". Being in hospital isn't enough on its own. In the ICO's example, a GP or hospital appointment alone won't tell you anything about a person's health, as it may be a check-up or screening appointment. But footage of a patient on a ward, in A&E or in a mental health unit, or of a patient record on a screen, can reveal it. Our article sets out what a mishandled disclosure costs a trust in public trust.
Footage reused for staff training or research has to be de-identified, too. The Royal Wolverhampton NHS Trust is exploring using redacted real-world footage for staff education and performance training. For details, see what de-identifying health data involves when footage is reused for training or research.
In the US, patient images are identifiers. The HHS de-identification guidance lists "Full-face photographs and any comparable images" among the identifiers to remove when de-identifying health information. Our article explains what HIPAA treats as protected health information.
During the Oregon proceedings, OHSU maintained that patients remained identifiable—even with obscured faces—through clothing, personal items, demographic traits, and care dates combined with recording timecodes. Addressing HIPAA considerations, the district attorney noted: "I agree that security video from a public area of a hospital could be subject to the Privacy Rule to the extent it depicts a patient, or person seeking to become a patient, and that depiction is reasonably identifiable." Nevertheless, the order concluded that OHSU's full-body blurring was excessive, as it masked individuals who were not recognisable. In this case, it found that redacting only the faces of anyone who might be identifiable would have anonymised them just as well, and released more of the footage that wasn't exempt from disclosure.
For the law itself, see the UK sector obligations in our legal compliance guide, and its HIPAA section for the US.
#The workload
Request volumes vary considerably across organisations. Both Royal Cornwall Hospitals NHS Trust and The Royal Wolverhampton NHS Trust report modest numbers, yet the process's labour-intensive nature and high regulatory stakes create major operational hurdles. Meanwhile, Barts Health NHS Trust processes roughly 25 video-related subject access requests annually across its eight hospital sites, some of them involving hours of footage from several cameras. As Barnsley Hospital NHS Foundation Trust points out, when the Trust has to redact video, the material is usually important. At South London and Maudsley NHS Foundation Trust, teams process about one submission a month, a figure expected to surge as 500 additional cameras are planned across two new hospital developments.
At Manchester University NHS Foundation Trust, the average time spent redacting each request rose from 4.4 hours in 2023 to 16.3 hours in 2024, before the Trust signed up for Identity Cloak in July 2025. Its CCTV Administrator, Charlotte Davison, recalls spending several months on a single internal investigation involving just 27 minutes of video footage. She looked for a tool because, in her words, "I wanted something that was absolutely going to help me with my workload as pixelation used to take up so much of my time."
Barnsley found the redaction built into its cameras "was not sufficiently sophisticated for the Trust's requirements", and Barts found its body-worn camera supplier's cloud tool unsuitable because it required frame-by-frame redaction.
Manchester, Barnsley and Barts all now use Identity Cloak, Facit's video redaction software.
#Using Identity Cloak for healthcare footage
Identity Cloak identifies all individuals captured on video without relying on facial recognition. Automated tracking was Manchester University NHS Foundation Trust's top requirement, and its case study reports that, according to Rhys Jones, its Security, Violence Prevention and Reduction Manager, the system was "particularly effective in crowded corridors and Accident & Emergency departments where competing solutions struggled".
Its strongest setting is a solid mask, not just a blur. Manchester uses its custom-shaped setting for signage and computer screens, and the software also offers signage and name-tag masking and face and body redaction. For sound, it redacts audio. At Barts Health NHS Trust, Kamran Khan says:
We can now protect voices and speech as well as faces – which is crucial in an environment where privacy and dignity matter.
Barts also uses its zoom-and-crop tool for distant cameras.
The software outputs a redacted duplicate while preserving your master file completely untouched. It runs on your device, inside your network, and sends no videos or personal data to Facit's servers, only the licence key, device name, and user experience data. For King's College Hospital, an Identity Cloak user since May 2021, keeping video inside the Trust's network mattered because cloud storage had been an issue there. The organisation cited the same priorities in Facit’s 2022 announcement about the partnership. You can deploy it as a standalone desktop program or integrate it via Milestone XProtect.
For footage in proprietary formats, there is a built-in screen recorder. The Royal Wolverhampton NHS Trust found that Identity Cloak solved one of their biggest problems by standardising their CCTV footage so recipients can view it without technical headaches. A trimming tool helps with long clips where the subject comes and goes.
Facit has published case studies with seven NHS trusts. Identity Cloak speeds up the work and removes the frame-by-frame effort, leaving you to decide what to disclose. Facit offers NHS and healthcare discounts, as its healthcare page explains.
#Go deeper: healthcare video by topic
| Topic | What it covers |
|---|---|
| Video requests across a hospital | CCTV, body-worn and phone footage in one request, and how three NHS trusts handle it |
| Body-worn cameras and NHS staff safety | Why rising violence put cameras on NHS staff, and what that means for their footage |
| Care-home footage | The law, the CQC, and residents' privacy and dignity |
| De-identifying health data | Anonymisation and pseudonymisation, and when health data stops being personal data |
Start your free Identity Cloak trial
One request can span several cameras and sites, with just a month to respond. Try Identity Cloak before you commit. NHS trusts can also access free DPIA templates, a business case template and redaction guides.
