Medical Privacy Redaction in Body Camera Footage

California agencies running body-worn camera (BWC) programs now have a new compliance deadline tied directly to medical privacy redaction. On September 20, 2026, Governor Gavin Newsom signed Senate Bill 691, enacted as Chapter 416 of the Statutes of 2026, amending Penal Code section 832.18 to require every agency with a body-worn camera policy to add a medical privacy redaction procedure by July 1, 2027. The law lets emergency service personnel request that footage of a patient receiving medical or psychological care be redacted, through blurring or muting, before public release. California is not the first state to wrestle with this problem, and it will not be the last, which makes medical privacy redaction a timely issue for any agency that records inside ambulances, hospital hallways, holding cells, or the back of a patrol car during a mental health crisis.

California's New Medical Privacy Redaction Mandate

SB 691 does not ban recording during medical or psychological care, and it does not create an automatic right for a patient to have footage sealed. Instead, it requires agencies to build a request process: emergency service personnel, defined by reference to Government Code section 8669.15 and covering firefighters, paramedics, EMTs, and dispatchers, can ask that a recording showing a patient receiving care be redacted before it is released. Agencies must keep an unredacted original under their existing retention schedules, and the statute states plainly that it does not limit the California Public Records Act, the Confidentiality of Medical Information Act (CMIA), or the federal Health Insurance Portability and Accountability Act (HIPAA).

That last point matters more than it might appear. SB 691 is not filling a gap in medical privacy law generally; it is filling a gap in how body-worn camera policy interacts with medical privacy. The underlying health privacy statutes already existed. What was missing, in California and in most states, was a defined medical privacy redaction procedure inside the body-worn camera policy itself, something records staff and examiners could point to when a request for redaction came in.

Why Medical Privacy Redaction Matters in Body Camera Footage

Body-worn cameras are built to record encounters continuously, which means they also capture moments agencies never intended to broadcast: a patient mid-seizure, a psychiatric hold being administered, an overdose reversal, a sexual assault examination referral, or a private conversation between a paramedic and a family member about a terminal diagnosis. None of that content is collected because an agency wants it. It is collected because the camera was already running when a medical event happened in front of it.

Medical privacy redaction addresses a specific risk that general BWC redaction practice does not automatically cover: footage of a medical or psychological event can be deeply sensitive even when it contains no names, faces, or other obviously identifying information most redaction checklists are built to catch. A few scenarios illustrate the stakes:

• Mental health crisis response. Officers and co-responder teams increasingly record encounters involving a psychiatric evaluation or an involuntary hold, and that footage can expose a person's mental health history to anyone who later obtains the recording through a public records request.
• In-custody medical treatment. Footage of a detainee receiving care in a jail medical unit, or being treated after a use-of-force incident, often sits at the intersection of two legal regimes: public accountability interests and medical confidentiality.
• Ride-along and dash footage of EMS calls. Agencies that co-respond with fire and EMS on medical calls capture patient care routinely, even when the police role in the call is minor.

A records unit without a defined medical privacy redaction procedure has to make these judgment calls ad hoc, under the pressure of a FOIA deadline, with no documented standard to point back to later. That is exactly the situation SB 691 is designed to prevent going forward in California, and it is the situation every agency outside California should be reviewing their own policy against now. Agencies that have already built similar privacy carve-outs for other vulnerable groups, as described in our guide to school surveillance video redaction under FERPA, already have a workable template to adapt.

Does HIPAA Require Medical Privacy Redaction in Police Video?

One of the most common misunderstandings in this area is the assumption that HIPAA automatically governs body camera footage once it shows a patient. It generally does not. Under 45 C.F.R. section 160.103, HIPAA's Privacy Rule binds "covered entities": health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with a covered transaction. A police department is ordinarily none of these things, so an officer's own body-worn camera recording is not, by itself, protected health information subject to HIPAA simply because a paramedic happens to be visible providing care in the frame.

That does not mean the footage is unregulated. State medical privacy statutes often apply even where HIPAA does not. California's CMIA, codified at Civil Code section 56.10 and following, restricts a "provider of health care, health care service plan, or contractor" from disclosing medical information without authorization, language aimed at health care entities rather than police departments directly. The practical effect is similar to HIPAA's: the statute binds the hospital, the ambulance service, or the treating clinician, not the officer wearing the camera. Agencies that assume federal or state medical privacy law already covers their BWC footage, and skip building their own medical privacy redaction procedure as a result, are relying on a protection that was never designed to reach them.

How Other States Approach Medical Privacy Redaction

California is not writing on a blank slate. Washington State has addressed a closely related problem through its public records act rather than its body-worn camera statute. RCW 42.56.240(14), most recently expanded by a 2023 amendment, presumes that disclosure of body-worn camera footage is "highly offensive to a reasonable person," and therefore exempt from release, when it shows areas of a medical facility, counseling office, or therapeutic program office where a patient is registered, treated, or waiting, or when the footage contains protected health information as HIPAA defines that term. The presumption can be rebutted with specific evidence in an individual case, and a requester who successfully challenges a withholding generally cannot recover fees unless the agency acted in bad faith or with gross negligence.

The two approaches differ in mechanism. Washington builds its medical privacy redaction standard into the records-disclosure exemption itself, decided case by case when a request comes in. California's SB 691 instead requires agencies to build the redaction procedure into body-worn camera policy up front, triggered by a request from emergency service personnel rather than by the records unit's own review. Agencies in states without either kind of statute are left to improvise, usually by stretching a general privacy exemption to cover a scenario it was not written for. Reviewing how Washington and California have each handled medical privacy redaction gives records staff in other states a useful starting point for drafting their own policy language before a difficult request forces the issue.

Building a Medical Privacy Redaction Procedure Into BWC Policy

Agencies do not need to wait for a state mandate to put a medical privacy redaction procedure in place. A workable policy typically needs to answer a short list of questions, regardless of which state's law applies:

1. Who can request redaction. Define which roles, such as treating EMS personnel, a records custodian, or legal counsel, may initiate a medical privacy redaction request, and what information the request must include.
2. What triggers review. Specify the categories of footage that automatically route to medical privacy review before release, such as any recording tagged as involving a medical call, a psychiatric hold, or an in-custody death or injury.
3. What redaction actually covers. Clarify that medical privacy redaction can include blurring the patient, muting audio describing treatment or diagnosis, or both, and that it applies to both evidentiary and non-evidentiary recordings.
4. How the unredacted original is preserved. Require that an unredacted master file be retained under the agency's standard retention schedule, separate from any redacted copy prepared for release.
5. How the decision is documented. Log who requested the redaction, who approved it, what was redacted, and the legal basis, so the file can withstand a later challenge or appeal.
6. How disputes are resolved. Build in a path for a records unit, agency counsel, or an outside examiner to weigh in when a redaction request is denied or when a requester challenges the result.

None of this requires new recording hardware. It requires a documented medical privacy redaction procedure that a records unit, a redaction vendor, or in-house staff can follow consistently, the same way agencies already document chain of custody for the recordings themselves. Agencies that already maintain a broader records-release framework, such as the one described in our overview of body camera redaction laws agencies must follow, can usually fold a medical privacy redaction procedure into that existing structure rather than building a separate process from scratch.

Common Mistakes That Undermine Medical Privacy Redaction

Even agencies that intend to handle medical privacy carefully run into predictable problems:

• Treating HIPAA as a blanket shield. As the 45 C.F.R. 160.103 definition shows, HIPAA generally does not bind a police department directly, so relying on it as the sole basis for withholding or redacting footage leaves a gap a records request can expose.
• No defined trigger for review. Without a rule specifying which footage categories require medical privacy redaction screening, sensitive clips slip through the ordinary release process unflagged.
• Redacting the only copy. Applying blur or mute directly to a master file, rather than to a working copy made for release, destroys the ability to verify later what the original recording actually showed.
• Inconsistent application across units. A medical privacy redaction procedure that patrol follows but the jail or records unit does not creates uneven protection depending on which part of the agency handled the request.
• No documentation trail. A redaction decision made verbally, with nothing written down about who approved it or why, is difficult to defend if a requester challenges the outcome months later.

Conclusion

SB 691 gives California agencies a concrete deadline, but the underlying problem is not unique to California. Any agency whose body-worn cameras capture medical or psychological care, in an ambulance, a jail medical unit, or the back of a patrol car during a crisis response, is already generating footage that deserves a defined medical privacy redaction procedure rather than an ad hoc decision made under deadline pressure. Washington's records-exemption approach and California's policy-mandate approach both point toward the same underlying discipline: decide in advance who can request redaction, what triggers it, how it is documented, and how the unredacted original is preserved.

Focal Forensics helps agencies and counsel build defensible medical privacy redaction procedures into existing body-worn camera workflows, and handles the blurring, muting, and documentation that a compliant release requires. Learn more about our video redaction services or reach out to discuss how your agency's policy should handle footage involving patient care.

Phone: 303-900-3585 · Email: info@focalforensics.com

Sources

• RecordingLaw.com: California SB 691, Body Camera Policies Must Add a Patient Redaction Process
• California State Association of Counties: 2026 Legislative Session, Key Developments in Administration of Justice Policy Area
• Cornell Law School Legal Information Institute: 45 C.F.R. 160.103, Definitions (Covered Entity)
• FindLaw: Revised Code of Washington 42.56.240, Public Records Act Exemptions
• Justia: California Civil Code Section 56.10, Confidentiality of Medical Information Act
• Scientific Working Group on Digital Evidence: Video and Audio Redaction Guidelines, document 18-M-001