HIPAA clinic signage guide.
Where the notice goes.
HIPAA never mentions signs. It asks for reasonable safeguards against incidental disclosure of patient information — and a posted recording-device notice is one of the cheapest physical safeguards a clinic can put in place. This guide covers the wording, the placement map and the documentation.
In this guide
- What HIPAA actually requires
- Six placement zones in a clinic
- Wording that covers wearables
- A five-step rollout
- Documenting it for audits
Signage is a safeguard, not a statute.
The HIPAA Privacy Rule requires covered entities to apply reasonable safeguards to protect health information from incidental use or disclosure, and the Security Rule requires physical safeguards for the facilities and equipment that hold it. Neither rule prescribes a sign. What they ask is that you take reasonable, documented steps.
In a clinic, the realistic disclosure risk is a phone: a patient filming a waiting-room complaint, a visitor on a video call with a reception screen behind them, a wearable camera in a corridor. A conspicuous notice is the step that converts an unwritten expectation into a stated rule staff can enforce — and it costs less than any other control on the list.
This guide is practical, not legal advice. Recording law varies by state and country; have your privacy officer or counsel approve your final wording and policy.
Six zones in a typical clinic.
Reception & waiting room
The highest-traffic area, and the one where other patients are most often captured in the background of a photo or video call.
Corridors to treatment rooms
Patients are identifiable by the door they walk through. A notice here covers movement between rooms.
Exam & treatment rooms
Sets the rule before a consultation begins, so staff are not negotiating it mid-appointment.
Restrooms & change areas
The highest-harm environment for covert recording. Post inside as well as on the entry door.
Administration & records areas
Screens, whiteboards and printed charts are all incidental disclosure risks when photographed.
Telehealth & dictation rooms
Audio carries. A visible notice reduces bystander recording of clinical conversations.
Name the devices people actually carry.
Most clinic signage still reads “no cameras”, which was written for a world where a camera looked like a camera. Effective wording lists the categories explicitly:
- Photography and video recording
- Audio recording, including phone calls on speaker
- Screen recording and live streaming
- Smart glasses and AI glasses
- Body-worn, lapel and other wearable cameras
Then give the reason in one line — “to protect the privacy of our patients” — so the notice reads as care rather than bureaucracy. Our no smart glasses signs and no recording signs already use this wording.
Five steps, one afternoon.
- 01
Write the rule before you buy the sign
Add a short recording-device clause to your privacy policy: which devices are prohibited, in which areas, and what staff do when someone records. The sign is the public face of that clause — it should quote it, not invent it.
- 02
Map the areas where PHI is visible or audible
Walk the clinic and note every point where a phone camera could capture another patient, a screen, a chart or a conversation. That list becomes your signage plan.
- 03
Post conspicuous notices at each of those points
Mount at eye level, 1.4–1.6 m from the floor, on the approach side so it is read before entry. One notice per controlled room plus each entry point is the usual baseline.
- 04
Train staff on the script
Give reception a single sentence: 'We don't allow recording in the clinic — it protects other patients' privacy. Would you mind putting that away?' The sign is what makes the sentence uncontroversial.
- 05
Document it for your audit trail
Photograph each installed notice with its date and keep it with your safeguards documentation. Posted-notice evidence is what an auditor or investigator can actually inspect.
FAQ.
Does HIPAA require a clinic to post a no-recording sign?
HIPAA does not name signage as a specific requirement. It requires covered entities to have reasonable administrative, physical and technical safeguards that limit incidental disclosure of protected health information. A posted recording-device notice is one common physical safeguard clinics use to support that obligation, alongside written policy and staff training. Confirm your own program with your privacy officer or counsel.
Can a patient legally record inside a clinic?
Recording rules come from state wiretap and privacy law, not HIPAA, and they differ between one-party and all-party consent states. HIPAA governs the clinic's handling of patient information — so a clinic can still set and post a rule prohibiting recording in areas where other patients could be captured.
Where should the notice go in a clinic?
Waiting room entry, reception desk, corridors leading to treatment rooms, inside each exam or treatment room, and restrooms or change areas. The goal is that a visitor sees the rule before entering any space where another patient could be recorded.
What wording should the sign use?
State the prohibited devices explicitly — phones, cameras, video, audio recording, smart glasses and wearable cameras — and state that the rule protects patient privacy. Generic 'no cameras' wording predates wearables and leaves an argument open.
Which sign should a clinic order?
For indoor waiting rooms, corridors and treatment rooms, the 200 × 300 mm portrait indoor PVC sign ships in 1–2 business days. For exterior entries and carparks, the outdoor ACM version is made to order.
Signs for clinical spaces.
200 × 300 mm portrait · indoor 3mm PVC with matt laminate · bulk discounts on 10+ units.