Question 994 - CISA discussion

The greatest concern with finding closed-circuit television (CCTV) systems located in a patient care area is that there are no notices indicating recording is in progress. This is because CCTV systems in healthcare settings can pose a threat to the privacy and confidentiality of patients, staff, and visitors, especially in sensitive areas where personal or medical information may be exposed.According to the government's Surveillance camera code of practice1, CCTV operators must be as transparent as possible in the use of CCTV, and inform people that they are being recorded by using clear and visible signs. The signs should also provide contact details of the CCTV operator and the purpose of the surveillance. By providing notices, CCTV operators can comply with data protection law and respect the rights and expectations of individuals.

Option B is correct because the lack of notices indicating recording is in progress is a clear violation of the Surveillance camera code of practice1, which applies to local authorities and the police, and is encouraged to be adopted by other CCTV operators in England and Wales.The code also applies to Scotland, along with the National Strategy for Public Space CCTV2.The code is intended to be used in conjunction with the guidance provided by the Information Commissioner's Office (ICO)3, which applies across the UK. The ICO states that CCTV operators must inform people that they are being recorded by using prominent signs at the entrance of the CCTV zone and reinforcing this with further signs inside the area.

Option A is incorrect because cameras not being monitored 24/7 is not the greatest concern, as it does not necessarily affect the privacy and confidentiality of individuals. CCTV systems may have different purposes and objectives, such as deterring or monitoring crime, enhancing security, or improving patient care. Depending on the purpose, CCTV systems may not require constant monitoring, but rather periodic review or analysis. However, CCTV operators should still ensure that they have adequate security measures to protect the CCTV systems from unauthorized access or tampering.

Option C is incorrect because the retention period for video recordings being undefined is not the greatest concern, as it does not directly affect the privacy and confidentiality of individuals. However, CCTV operators should still define and document their retention policy, and ensure that they do not keep video recordings for longer than necessary, unless they are needed for a specific purpose or as evidence. The retention period should be based on a clear and justifiable rationale, and comply with data protection law and industry guidelines.

Option D is incorrect because there being no backups of the videos is not the greatest concern, as it does not affect the privacy and confidentiality of individuals. However, CCTV operators should still consider having backups of their videos, especially if they are needed for a specific purpose or as evidence. Backups can help to prevent data loss or corruption due to system failures, disasters, or malicious attacks. Backups should also be stored securely and encrypted to prevent unauthorized access or disclosure.