What's in this template?
This CCTV and Surveillance Privacy Policy gives Australian healthcare practices one document covering camera placement, patient notification and footage handling. It is built from Australian Privacy Principle 5 of the Privacy Act 1988 and the state and territory surveillance devices Acts that govern whether a device may be installed at all and whether its use must be disclosed.
The template includes:
- A permitted and prohibited area table: reception and waiting rooms are fine, consultation rooms and amenities are not
- The two-layer legal framework: what the Privacy Act requires versus what your state's surveillance devices Act requires
- A footage access table: who can view recordings, on what basis, including a police or law enforcement request
- Storage, security and retention rules, with a 30-day default retention period
- An incident and breach-assessment procedure, linked to the Notifiable Data Breaches scheme
- Appendix A: ready-to-print entrance and waiting room signage wording
- Appendix B: a footage access and disclosure register
Editable placeholder fields
{{practice_name}},{{practice_address}}{{privacy_officer}},{{privacy_officer_email}}{{system_administrator}},{{practice_manager}}{{state_surveillance_act}}the surveillance devices Act (and workplace surveillance Act, where one exists) for your state{{storage_system}},{{retention_period}}(the template defaults to 30 days){{effective_date}},{{next_review_date}},{{approved_by}}
Two separate documents, two separate purposes
This policy produces two artifacts: the internal policy governing how the practice manages its cameras, and the printable Appendix A signage that patients and visitors actually read on the wall. Both are needed. A policy without signage does not discharge the APP 5 notification obligation, and signage without a policy behind it leaves the practice with no answer when a patient asks what happens to the footage.
It sits alongside your other privacy documents without replacing them:
- Your Privacy Policy is the umbrella APP 1 statement. This policy is a specific, narrower document that it points to.
- Your Patient Data Collection Notice is the APP 5 notice given at the point of collection generally. This policy is the equivalent notice for the specific case of being recorded on camera.
What the law actually requires
APP 5 requires that patients be told, generally before or at the time information is collected, that they may have their personal information collected, including by CCTV, and how it will be handled. Because footage from a healthcare practice can capture the fact that a specific person attended, and in some layouts which consulting room they entered, it can amount to health information rather than ordinary personal information, which raises the bar for how carefully it needs to be handled.
State and territory surveillance devices Acts are the second layer, and they are not uniform. Each state has its own Act governing whether a device may record at all and, in most states, whether the recording must be disclosed by notice or signage. Several states also have a separate workplace surveillance Act that adds specific obligations about recording employees, distinct from the obligations owed to patients and visitors. The template flags this with a state note rather than naming a single Act, because the answer depends on where the practice is.
How to customise this template
- Download the Word document and replace every
{{placeholder}}with your details. - Walk the premises against Section 5's permitted and prohibited area table before relying on the policy. A camera angled to catch a consulting room doorway is a common and avoidable problem.
- Confirm your state's surveillance devices Act in Section 4, and check whether a separate workplace surveillance Act applies to any staff-facing cameras.
- Print Appendix A and put it up at every public entrance and inside the waiting room before switching on a camera that has not previously had signage.
- Set your retention period in Section 8. The template default is 30 days, which is common for practices without a specific reason to keep footage longer.
- Brief the Practice Manager and system administrator on the footage access rules in Section 7, since they are the two roles with routine access.
- Review every two years, or sooner if a camera is added, moved, or the applicable Act changes.
Related templates and tools
- Privacy Policy: the parent APP 1 document this policy sits under.
- Patient Data Collection Notice: the general APP 5 notice this policy specialises for cameras.
- Data Breach Response Plan: for unauthorised access to or loss of footage.
- Third-Party Data Sharing Agreement: use it for any external monitoring or cloud storage provider.
- WHS Policy: the security rationale for cameras in entrances, corridors and car parks.
- Healthcare privacy and cyber security: how APP 5 fits the wider privacy picture.
Frequently asked questions
Do we need a sign if we have CCTV in the waiting room?
Yes. APP 5 requires patients to be told they may be recorded, and most state surveillance devices Acts either require or strongly recommend signage for the same reason. A sign at the entrance and inside the waiting room, in plain language, satisfies both obligations. Appendix A gives you wording you can print immediately.
Can we put a camera in a consultation room?
The template does not cover this because it is a materially different decision to a waiting room camera. Recording a clinical consultation captures the substance of the patient's care, not just the fact of their attendance, and needs the patient's express consent for a specific, stated purpose, handled separately from this general surveillance policy. Most practices do not record consultation rooms at all.
How long should we keep CCTV footage?
The template defaults to 30 days, which is common practice absent a specific reason to keep footage longer. Footage that becomes relevant to an incident, complaint or legal request is isolated and kept only until that matter is resolved, then deleted in the normal cycle. Keeping footage indefinitely is itself a privacy risk under APP 11, which requires personal information to be destroyed once it is no longer needed.
Does the same policy cover recording staff as well as patients?
It covers cameras that happen to capture staff working in areas like reception and corridors, but several states have a separate workplace surveillance Act with its own notice obligations that apply specifically to employees, sometimes including a minimum notice period before surveillance starts. Check the state note in Section 4 and add a specific employee notice if your state requires one.
Can police ask us for CCTV footage?
Yes, and the template's access table treats that as a defined pathway rather than an ad hoc decision. Footage is provided in response to a warrant or court order, or where the practice reasonably believes disclosure is necessary to lessen or prevent a serious threat to someone's life, health or safety, consistent with APP 6.2. Every request and response is logged in Appendix B.
Is footage of a patient considered health information?
It can be. Footage that identifies a person, combined with the fact that the recording was taken at a healthcare practice, discloses that the person attended for care, which is health information under the Privacy Act. That is why this policy treats footage with the same seriousness as any other health record, rather than as ordinary security footage.
Do we need a separate policy for a doorbell camera or a mobile security camera?
No. The template's scope in Section 2 covers any fixed or mobile surveillance device the practice operates, including doorbell and intercom cameras with recording, so long as it is used to fulfil this policy's placement, notice and retention rules.