Before placing surveillance devices in any location, approval must be given by which party?

• A. Privacy officer
• B. Facility administrator
• C. Legal counsel
• D. Security director

Answer: (C)

Before placing surveillance devices, the plan must be reviewed for legal compliance and risk, especially around privacy protections. Legal counsel provides this crucial review, ensuring the proposal aligns with applicable laws such as HIPAA and state privacy regulations, along with organizational policies, data retention, notification, and potential liability. Their formal approval confirms that security needs are balanced with patient and staff privacy rights and legal requirements.

The privacy officer guides privacy program considerations and policy implications, but the final sign-off on legal risk typically comes from legal counsel. The facility administrator and security director manage operations and security implementation, not the legal clearance required to deploy surveillance.