Updated
Healthcare security systems: what HIPAA and the DEA decide for you
Healthcare is the building type where the security system can become the compliance problem. A camera pointed down a corridor sees a monitor at the nurse station. A door reader log records which clinician entered which room and when. A recorded duress call carries a patient name. None of that is forbidden, but all of it lands inside the same rules that govern the chart, which means camera placement and log retention are decisions your privacy officer has to sign, not just your facilities manager.
The fact that sets the spec
If a camera can read a screen, the recorder is now storing protected health information.
The HIPAA Security Rule requires a covered entity to limit physical access to its electronic information systems and to implement physical safeguards for all workstations that access electronic protected health information, restricting access to authorized users. A camera whose field of view includes a workstation display is capturing that data and writing it to a recorder, which pulls the video system into scope: who can view it, who can export it, how long it is retained, and what happens on disposal. The fix is cheap on design day and expensive later. Walk the camera angles with your privacy officer before the mounts go up, and specify privacy masking on any view that includes a screen, a whiteboard or a printed schedule.
The systems
What a healthcare facilities security system needs
System by system, and why. Each links to the buying guide with the questions that separate a sound quote from a cheap one.
Zoned access: med room, records, server room, MRI, and the back corridor
Healthcare access control is not one perimeter, it is a set of nested zones with different populations. Clinical staff need the med room but not the server room. Housekeeping needs the back corridor at 11 p.m. Vendors need one door for one afternoon. Specify per-zone schedules, a working revocation path for locum and travel staff, and audit log export you can run yourself. For MRI, the access decision is a safety decision: Zone III and Zone IV control is about keeping ferromagnetic objects and untrained people out of the magnet room, and that door should be controlled by the MRI safety officer's rules, not the building's default group.
Access Control Systems guideCameras on the ways in and out, never in treatment areas
The default line is simple: cover entrances, exits, corridors, elevators, loading dock, pharmacy approach, parking and waiting areas. Do not cover exam rooms, treatment rooms, or any view that reads a screen. That leaves a real design problem at nurse stations and reception, where you want coverage of the counter and not of the monitor. Privacy masking solves it if the masking is applied at the camera and burned into the recording, not applied in the viewing client where an administrator can turn it off. Ask which it is.
Video Surveillance & CCTV guideStaff duress buttons where the risk actually is
Fixed duress buttons at reception and in intake or interview rooms, and wearable duress for staff who work alone or behind a closed door. The design question is not the button, it is what happens when it is pressed: who is notified, does it show a room-level location, and is anyone assigned to respond who is not already doing something else. California's healthcare standard makes that explicit, requiring that staff designated to respond have no other assignment that would prevent them from responding immediately. That is a good test anywhere.
Commercial Alarm Systems guideAfter-hours intrusion on a building that is never quite empty
A 24-hour hospital has no closed state, so intrusion detection is zone-based and schedule-heavy: pharmacy, records, business office, labs, the loading dock. A medical or dental office does close, and it needs the ordinary thing done well. Ask how the monitoring center handles a medication room trip at 3 a.m. versus a lobby trip, and whether your DEA-registered storage is alarmed to a central station or a police agency with a duty to respond, which is how the DEA regulations describe acceptable alarm transmission.
Business Alarm Monitoring guideLocked doors in a healthcare occupancy are a fire code conversation
Clinical and behavioral health areas use door locking arrangements that ordinary offices never touch, and each one has a fire code path. Delayed egress, controlled egress in areas where patients need containment, and elevator lobby locking all have conditions attached and all interact with the fire alarm system. Get the fire alarm contractor, the access control contractor and the AHJ aligned before the hardware is ordered.
Commercial Fire Alarm guide
The rules
The rules that set the spec for healthcare facilities
Every claim below was checked against a named source on the date shown. Rules change and vary by jurisdiction, so confirm the current version with the regulator or your AHJ before you sign a scope.
HIPAA Security Rule: facility access controls are a named standard
45 CFR 164.310 requires a covered entity or business associate to implement policies and procedures to limit physical access to its electronic information systems and the facilities housing them, while ensuring properly authorized access is allowed. The addressable implementation specifications name a facility security plan safeguarding the facility and equipment from unauthorized physical access, tampering and theft; access control and validation procedures based on a person's role or function, including visitor control; and maintenance records documenting repairs and modifications to physical security components such as hardware, walls, doors and locks. The same section requires physical safeguards for all workstations that access ePHI.
What it does to the spec. This is what turns a badge system into a compliance artifact. You need role-based zones, a visitor control process that produces a record, and a written maintenance log for doors and locks. Practically: specify audit log retention and self-service export up front, because your auditor will ask for who-entered-what, and a system where only the integrator can pull that report will cost you every time.
Source:45 CFR § 164.310, Physical safeguards (eCFR)· checked 2026-09-18
DEA: controlled substance storage, and an alarm that reaches someone with a duty to respond
21 CFR 1301.71 makes the physical security controls in §§ 1301.72 to 1301.76 the standard against which the DEA judges whether a registrant guards against theft and diversion, and lists the adequacy of electric detection and alarm systems, including supervised transmittal lines and standby power, among the factors it weighs. For practitioners, § 1301.75 requires Schedule I substances and Schedules II through V substances to be stored in a securely locked, substantially constructed cabinet. For non-practitioner storage areas, § 1301.72 describes safes, steel cabinets and vaults equipped with an alarm system that on unauthorized entry transmits a signal directly to a central station protection company, a local or state police agency with a legal duty to respond, or a 24-hour control station operated by the registrant. Section 1301.76 requires written notice to the local DEA field division within one business day of discovering a theft or significant loss, with DEA Form 106 filed within 45 days.
What it does to the spec. Two concrete effects. The alarm on drug storage must be a monitored path, not a local sounder, and you should have the monitoring station's response procedure in writing. And the one-business-day notification clock means you need to know a loss happened, which is an argument for door-level access logging and a camera covering the approach to storage rather than the storage itself.
Source:21 CFR §§ 1301.71 to 1301.76 (eCFR)· checked 2026-09-18
California's healthcare workplace violence standard is the most prescriptive design checklist in the country
8 CCR 3342 applies to health facilities, home health and hospice, emergency medical services and medical transport, drug treatment programs, and outpatient medical services in correctional settings. It requires employers to correct environmental risk factors including obstacles and impediments to accessing alarm systems, locations where alarm systems are not operational, and entryways where unauthorized entrance may occur such as staff doors and emergency exits. It requires configuring treatment areas, patient rooms, interview rooms and common rooms so that employee access to doors and alarm systems cannot be impeded; installing and maintaining an alarm system or other effective means by which employees can summon security and aid; providing line of sight or other immediate communication in all areas where patients or the public may be present, which may include surveillance systems or sight aids; and, where a person may be anticipated to possess a weapon, monitoring and controlling designated public entrances using safeguards such as weapon detection devices, remote surveillance, alarm systems, or a registration process conducted by personnel in an appropriately protected work station.
What it does to the spec. Even outside California this reads as a specification. It tells you to place duress devices where a person cannot be blocked from reaching them, to fix blind sightlines with cameras or mirrors rather than policy, and to treat the staff entrance as a controlled entrance. In California it is enforceable, and it sets the baseline that a general-industry plan under Labor Code § 6401.9 does not have to meet.
Source:8 CCR § 3342, Violence Prevention in Health Care, California DIR· checked 2026-09-18
California SB 553: the dental office is covered by the general rule, the hospital is not
California Labor Code § 6401.9, added by SB 553 in 2023, requires a written workplace violence prevention plan, a violent incident log, training, and hazard correction from essentially all California employers. Facilities and operations covered by 8 CCR 3342, and employers who comply with 3342, are exempt from § 6401.9. The statute defines four violence types, including Type 1 violence by a person with no legitimate business at the worksite and Type 2 violence directed at employees by patients or visitors, and defines an engineering control as a device that removes a hazard or creates a barrier between the worker and the hazard.
What it does to the spec. A medical or dental practice that is not a licensed health facility falls under § 6401.9, not the healthcare standard, and most practices did not realize they were covered. The plan has to identify and correct hazards, which is where reception glazing, a controlled door between the waiting room and the clinical corridor, and a duress button at the front desk become documented corrective actions rather than optional upgrades. Verify current requirements with Cal/OSHA before writing them into a specification.
Source:Cal. Labor Code § 6401.9 (SB 553), California Legislative Information· checked 2026-09-18
Infant abduction: rare, concentrated, and the reason maternity gets its own system
NCMEC records 345 confirmed infant abductions related to healthcare between 1964 and January 2025. Of those, 140 occurred at healthcare facilities, 152 in homes and 49 elsewhere, and 16 infants abducted under six months of age remain missing. NCMEC publishes guidelines on prevention of and response to infant abductions for health care professionals, now in its 10th edition, and provides technical assistance and training to healthcare and security professionals.
What it does to the spec. If you have a maternity unit, infant protection is a separate system with its own tag, alarm and door-release logic, integrated with access control so a tagged infant near a stairwell or elevator locks the door and holds the elevator. Price it separately from the building's access control, and ask specifically how it behaves on a fire alarm, because that interaction is where designs fail inspection.
Source:National Center for Missing & Exploited Children: infant abductions· checked 2026-09-18
Reference
DEA controlled substance storage: what the rule requires, by registrant type
| Registrant | Storage requirement | Alarm |
|---|---|---|
| Practitioner (clinic, dental or medical office, hospital pharmacy stock) | Schedule I and Schedules II through V in a securely locked, substantially constructed cabinet. Pharmacies and institutional practitioners may instead disperse Schedules II through V through the noncontrolled stock so as to obstruct theft. | Not specified by § 1301.75; the § 1301.71 factors still apply, including the adequacy of detection and alarm systems. |
| Non-practitioner storage area (distributor, manufacturer, narcotic treatment program) | Safe, steel cabinet or vault meeting the construction requirements of § 1301.72, sized to the quantity and schedule held. | Alarm that on unauthorized entry transmits directly to a central station protection company, a local or state police agency with a legal duty to respond, or a 24-hour control station operated by the registrant. |
| Any registrant, after a loss | Not a storage rule, but the clock that follows one: written notice to the DEA field division within one business day of discovering a theft or significant loss. | DEA Form 106 filed within 45 days of discovery. |
Simplified for planning. The DEA also allows materials and construction that are a structural equivalent to the listed controls, and will consider substantial compliance after evaluating the overall security system. Confirm your own configuration with the DEA field division before you build to it.
Source:21 CFR §§ 1301.71 to 1301.76 (eCFR)· checked 2026-09-18
Ballpark pricing
What a healthcare facilities security system costs
Labeled ballparks for planning, not quotes. Per-opening access control in healthcare runs in the same band as any commercial building, roughly $1,500 to $3,500 for a standard door and $3,000 to $5,000 once hardware, labor and first-year software are included, but healthcare has more openings per square foot than almost any other occupancy because of zoning. Infant protection, ED weapons screening and MRI zone control are each separate systems with their own price and should be quoted as separate line items so you can phase them.
| Building | Typical scope | Installed | Recurring |
|---|---|---|---|
| Medical or dental office | 3,000 to 8,000 sq ft · 6 to 12 cameras · 4 to 8 controlled doors including med storage · duress at reception · intrusion on the suite | $12,000 – $40,000 | $75 – $300/mo |
| Outpatient clinic or ASC | 10 to 30 cameras · 10 to 25 controlled doors · zoned access for clinical, records and server rooms · wearable or fixed duress · after-hours intrusion by zone | $40,000 – $150,000 | $250 – $900/mo |
| Hospital or multi-building campus | 150+ cameras · 100+ controlled doors · infant protection on maternity · ED entrance screening · parking and garage coverage · 24-hour security operations view | $500,000 – $4,000,000+ | $2,000 – $15,000/mo |
Labeled ballparks for planning, built from the site’s per-system cost guides. A quote comes from a contractor who has walked the building.
Before you sign
What to ask a healthcare facilities security bidder
The questions that are specific to this building type. A bidder who has done this work before will have answers; one who has not will have a brochure.
- 01
Walk me every camera's field of view and show me what it can read.
Do this on site, with the privacy officer present, before mounts are installed. Anything that can resolve a monitor, a whiteboard or a printed schedule either gets moved or gets a privacy mask. Ask whether the mask is applied at the camera and recorded that way, or applied in the viewing software where a user with the right permission can remove it.
- 02
Who can export video, and what does the export log look like?
You will need to produce footage for an incident, a claim or a subpoena, and you will need to prove who else has produced it. Ask for per-user permissions, a viewing and export audit trail, and a demonstration of an export your risk manager can hand to a lawyer.
- 03
How does the duress alarm tell responders which room?
A duress signal that says only that someone in the clinic pressed a button is close to useless. Ask for room-level location, how it is displayed, who receives it, and what the response assignment is. Then ask what happens if that person is already with a patient.
- 04
What is the alarm transmission path on the controlled substance storage?
The DEA framework is built around a signal that reaches a central station, a police agency with a legal duty to respond, or a 24-hour control station the registrant operates. Get the path, the supervised line or communication path, and the standby power arrangement in writing, and get the monitoring center's response procedure alongside it.
- 05
How do the locked doors behave when the fire alarm activates?
In a healthcare occupancy this is the question that decides whether you pass inspection. Ask which doors release on alarm, which are permitted to stay locked and under which code provision, and how the interconnection is tested. Get the AHJ's agreement before the hardware is ordered, not after.
- 06
Does the access control system handle locum, travel and vendor credentials without a ticket to you?
Healthcare staffing churns. Ask how a travel nurse gets a credential on a Sunday, how it expires automatically, and who at your organization can do it. A system where every credential change is an integrator service call will quietly cost more than the install.
Straight answers
Healthcare Facilities security, FAQ
How much does a healthcare security system cost?
For planning: a medical or dental office runs about $12,000 to $40,000 installed, an outpatient clinic or ambulatory surgery center about $40,000 to $150,000, and a hospital or multi-building campus $500,000 and up, often well into seven figures. Access control drives more of the number than cameras do, because healthcare zones heavily and a controlled door costs roughly $1,500 to $3,500 installed. Infant protection, emergency department screening and MRI zone control are separate systems and should be quoted as separate lines.
Does HIPAA allow security cameras in a medical facility?
Yes, in the right places. HIPAA does not ban cameras; it requires physical safeguards that limit access to electronic information systems and to the facility, and physical safeguards for workstations that access ePHI. In practice that means cameras cover entrances, exits, corridors, waiting areas, the pharmacy approach, the loading dock and parking, and do not cover exam or treatment rooms. The constraint most facilities miss is field of view: if a corridor camera can read a nurse station monitor, the recording holds protected health information and the video system inherits the access, retention and disposal obligations that go with it. Mask those views at the camera.
Where should hospital security cameras be placed?
Entrances and exits, the emergency department approach and waiting area, main corridors and corridor intersections, elevator lobbies and cabs, stairwell doors, the pharmacy and med room approaches, the loading dock, cashier and business office, parking lots and garages, and the perimeter. Not exam rooms, treatment rooms or behavioral health patient rooms. At nurse stations and reception, cover the counter and mask the screens. California's healthcare workplace violence standard is a useful checklist here: it directs employers to fix blocked visibility and blind areas where an assailant may be present, which is a coverage argument rather than a policy one.
What does OSHA require for workplace violence in healthcare?
Federally, there is no healthcare-specific workplace violence standard, so enforcement runs through the General Duty Clause. California is different and more demanding: 8 CCR 3342 requires health facilities to maintain a violence prevention plan, correct environmental risk factors including blocked access to alarm systems and entryways where unauthorized entrance may occur, install and maintain a means for employees to summon aid, and monitor and control designated public entrances with safeguards such as weapon detection, remote surveillance or a protected registration station where a weapon may be anticipated. California employers outside that scope, which includes most private medical and dental practices, fall under Labor Code § 6401.9 instead. Check with your own state plan, since several states have adopted their own rules.
Do medical offices need access control, or are keys enough?
Keys are enough until the first departure. The reason healthcare moves to credentials is not the front door, it is the med room, the records room and the server closet, where you need a per-person log of who entered and when, and the ability to revoke one person's access without rekeying. HIPAA's physical safeguards standard names access control and validation procedures based on role, including visitor control, as an implementation specification. A small practice can do this well with four to eight controlled doors.
What is infant protection and does a small maternity unit need one?
It is a tagging and door-control system that alarms and locks exits when a tagged infant approaches them. NCMEC records 345 confirmed healthcare-related infant abductions between 1964 and January 2025, of which 140 happened at healthcare facilities, so the event is rare but the consequence is absolute. If you have a maternity unit of any size, price it as its own system, integrated with access control and the elevators, and ask specifically what it does when the fire alarm activates.
Can security cameras in a clinic record audio?
Assume not, and in a clinic the safest specification is audio disabled at both the camera and the recorder. Several states require the consent of every party to record a private conversation rather than just one, and a healthcare setting is exactly where a conversation is presumed private. Check your own state's wiretap statute before you enable it anywhere. Beyond wiretap law, a recording of a clinical conversation is protected health information, which pulls the recorder deeper into HIPAA scope. Silent video is the easy default. If a bidder ships audio-enabled cameras without raising the issue, ask what else they have not raised.
Other building types
The systems are the same. The rules they operate under are not.
Cost guides
Dated, sourced ranges for each system, with per-unit prices.
What commercial security systems cost in 2026Get your healthcare facilities priced.
One short form, contractors who already work under your rules, and pricing you can compare line for line. No obligation, no fee.