HIPAA-Compliant Security Camera and Access Control Installation for Oklahoma Medical and Dental Practices

Worth getting straight, because most vendors do not. §164.312 covers technical safeguards for electronic information systems: unique user identification and emergency access procedures are required, while automatic logoff and encryption are addressable. Physical doors are not in §164.312 at all. They live in §164.310(a) (Facility Access Controls), where all four specifications are addressable.

“Addressable” does not mean optional, and it does not mean mandatory. Per §164.306(d)(3) it means you assess whether the safeguard is reasonable and appropriate for your practice, implement it if so, or document why not and implement an equivalent alternative where reasonable. It is a documented-decision obligation, and the documentation is the part OCR asks for.

UniFi Access is how we help you land that decision on the record. Every door to a records area, medication storage room, server closet, or restricted clinical zone is logged with timestamp, credential, and a camera-linked video record. Time-based permissions restrict after-hours access.

Credentials are revoked the moment an employee separation is recorded: no key rotation, no lock changes, no gap between termination and access removal. When OCR or the Texas Attorney General asks who entered your records storage room on a specific date, you produce the answer in seconds (with timestamps, credentials, and camera-verified video) from the same platform managing your network and surveillance.

The Security Rule requires hardware, software, and procedural mechanisms that record and examine activity in systems containing electronic protected health information. UniFi’s centralized management console produces a complete, exportable audit trail of every access event, every administrator action, every configuration change, and every camera event across the entire infrastructure. When an audit demands evidence of who did what, when, and on which system, you produce it from a single console rather than reconciling logs across four separate vendors.

Most cloud-based camera and access control vendors do not sign a Business Associate Agreement. A camera in an exam room corridor that captures a patient’s face, a chart visible at a workstation, a prescription label, or a patient name on a sign-in sheet is capturing PHI-adjacent imagery. If that footage is stored on a third-party cloud server without a BAA, which is the default for nearly every consumer-grade and prosumer-grade surveillance product on the market, the practice is, technically, transmitting PHI to a third party with no compliant agreement in place.

For Texas practices, the exposure is amplified. Chapter 181 defines “covered entity” more broadly than HIPAA: extending to virtually any organization that assembles, collects, analyzes, uses, evaluates, stores, or transmits PHI of a Texas resident. Your cloud camera vendor is almost certainly a covered entity under Texas law whether they know it or not, and your practice is responsible for the relationship.

No practice has ever audited themselves on this. OCR has. The Texas Attorney General has. Every system Red River Integration deploys records and stores locally.

Footage lives on Network Video Recorder hardware you own, inside your practice, on a network segment isolated from your EHR and your business network. No third-party cloud. No vendor servers. No BAA gap because there is no third party in the loop.

The Security Rule requires technical security measures to guard against unauthorized access to electronic protected health information transmitted over electronic networks. UniFi enterprise networking provides the foundation (managed switches, enterprise-grade routers, professionally configured wireless coverage) with proper VLAN segmentation that isolates clinical workstations, EHR traffic, surveillance, access control, guest Wi-Fi, and back-office systems from each other. Network segmentation is the single most overlooked technical safeguard in independent practice IT.

A flat network, where every device sees every other device, means a compromised guest device, a compromised IoT thermostat, or a compromised front desk PC can reach your EHR. Proper segmentation eliminates that path entirely.

Being precise here, because the citations get abused. 21 CFR §1304 is records and inventories, not surveillance: complete, accurate, readily retrievable records. Physical security for practitioners is §1301.75, which requires controlled substances be stored in a “securely locked, substantially constructed cabinet.” Neither section requires a camera. Any vendor telling you DEA mandates video for your med room has not read either one.

What cameras and credentialed access do is document the access those records already assume. UniFi Access logs every entry to medication storage with credential and camera-linked timestamp, so when a count comes up short you can answer the question rather than open an investigation into your own staff with nothing to go on. UniFi Protect records to local NVR hardware regardless of internet status. That is a risk decision, and a good one for most practices handling Schedule II substances. It is not a mandate, and we will not sell it as one.

Every practice running card payments at the front desk falls under PCI DSS v4.0.1. (Note the version: v4.0 was retired at the end of 2024, so anyone still quoting “PCI DSS 4.0” at you is a revision behind.)

To be accurate about it: PCI does not require network segmentation. What segmentation does is reduce your scope. Without it, your entire flat network is the cardholder data environment and every device on it is in scope, including the cameras and door controllers we install, which PCI explicitly counts as in-scope security systems. With it, the assessment stops at an isolated VLAN. Card terminals on one. Clinical systems on another. Guest Wi-Fi on a third.

The one place PCI does reach into physical security is Requirement 9.2.1.1: entry and exit points to sensitive areas (your server closet or back office, not the front counter, which PCI expressly excludes where only POS terminals sit) must be monitored by either cameras or physical access control, with the data retained at least three months. Either satisfies it. This is, as far as we can find, the only three-month retention rule that touches a medical practice, and it comes from the card brands rather than from HIPAA.

UniFi Protect records continuously to local NVR hardware on your network regardless of internet status: that footage is captured and retained on infrastructure inside your practice, not dependent on a cloud connection. What an internet outage does compromise is everything that depends on a working connection: cloud-hosted EHR access, e-prescribing and PMP submission, point-of-sale and insurance claim adjudication, real-time alert delivery to the practice administrator, and the management plane for surveillance and access control. UniFi 5G Max provides automatic dual-SIM cellular failover: the moment your primary connection drops, the system fails over without manual intervention and your EHR access, e-prescribing, claim submission, and management capabilities stay online without interruption. For practices in rural service areas across Southwest Oklahoma and North Texas where wired internet reliability is inconsistent, 5G Max can also serve as the primary connection, the difference between treating today’s patients and rescheduling them.