Does HIPAA apply to your cleaning contractor?
HIPAA's Privacy Rule protects individually identifiable health information. Cleaning crews working in medical offices routinely encounter PHI — patient names on sign-in sheets, intake forms on counters, lab slips on desks, monitor screens left visible, and occasionally documents that have slipped under furniture. The question practice managers sometimes ask is whether their cleaning contractor is a "business associate" under HIPAA and whether a BAA is required.
The short answer: cleaning contractors are generally not business associates because they don't create, receive, maintain, or transmit PHI in their normal function. A cleaner who sees a name on a sign-in sheet while cleaning a counter is incidentally encountering PHI, not handling it in a covered business function. However, "incidental" doesn't mean "without responsibility." Your practice is responsible for ensuring reasonable safeguards are in place for any incidental PHI exposure that occurs during cleaning operations.
What reasonable safeguards look like for cleaning operations
The HHS Office for Civil Rights has articulated that reasonable safeguards for incidental PHI exposure include things like:
- Training cleaning staff not to read, photograph, or discuss any patient information they encounter
- Protocols for what crew members should do if they encounter visible PHI during cleaning — the correct answer is to notify the practice contact, not to move or handle the document
- Confirmation that cleaning crews understand not to access patient files, computer systems, or medical records storage areas beyond what is necessary to clean the room
- An agreement that crew members who incidentally observe PHI don't share it, including with their employer
What we brief our crews on
Every Roberts Medical Office Cleaning crew assigned to a clinical account receives a HIPAA-aware handling briefing before their first visit. The briefing covers:
- What PHI looks like in a clinical environment (patient names, dates of birth, diagnoses, appointment details)
- The instruction not to read, photograph, or discuss any patient information encountered
- What to do if PHI is visibly accessible in a non-secure location — notify the practice contact; do not move, photograph, or handle the document
- Computer screen awareness — don't look at patient records on screens, and if a screen is left on with patient information visible, notify the practice contact
- The specific contact name and number at your practice for any questions that come up during a visit
This briefing is documented in the account record. It's not a verbal instruction given once — it's part of crew onboarding for every new account and reviewed at the 30-day check-in.
Business Associate Agreements
Most cleaning contractors in non-business-associate roles do not need to sign a BAA. However, if your practice's compliance officer or legal counsel has determined that they want one, we can review that request. It's a conversation about what your BAA covers and whether the cleaning function fits within it, not a flat refusal.
Practical steps for practice managers
Regardless of contractor relationship type, practice managers can reduce HIPAA exposure risk from cleaning operations by:
- Securing patient files and sign-in sheets before the cleaning crew arrives
- Confirming that computer screens in patient areas are locked or turned off at end of day before cleaning begins
- Providing the cleaning crew with a specific contact name for any on-site questions
- Asking your cleaning contractor specifically whether they brief crews on PHI handling — and if they look blank when you ask, that's your answer