Cleaning crews in medical offices have access to the physical spaces where protected health information (PHI) is stored and displayed. Exam rooms may have printed patient information on countertops. Reception desks display patient records on screens. Filing areas contain physical records. A cleaning contractor operating in your facility is a Covered Entity’s business associate under HIPAA in limited circumstances — but regardless of the formal legal classification, your practice needs to know that the people cleaning your space have been briefed on what PHI is, what they are not permitted to do with information they encounter, and what to report if they observe a potential incident.
What Cleaning Crews Might Encounter
A cleaning crew working in a medical office after hours may encounter patient intake forms left in an exam room, printed schedules at the nursing station, patient-facing screens left on at the reception desk, and physical records in filing areas. None of these situations require the cleaning crew to act on the information, but they do require the crew to be trained not to read, photograph, share, or otherwise engage with any information they encounter during a cleaning visit.
Minimum Training Elements for Cleaning Staff
| Topic | What Cleaning Staff Should Know |
|---|---|
| What PHI is | Any information that identifies a patient and relates to their health, healthcare, or payment for healthcare. Names, dates, record numbers, photographs. |
| Prohibited actions | Reading printed patient information, photographing screens or documents, discussing patient information observed during a cleaning visit. |
| What to do if documents are found | Leave them in place. Do not move, read, photograph, or remove any document from a clinical area. |
| Screen etiquette | Do not touch or attempt to read computer screens. Clean around screens without disturbing them. |
| Reporting | If a crew member observes a potential security incident (unlocked medications cabinet, visible paper records in a trash container), they should report it to their supervisor, who reports to the practice manager. |
Business Associate Agreements
Whether a cleaning contractor is a “business associate” under HIPAA depends on whether they have access to PHI in the course of their services. Most cleaning contractors do not access PHI in the technical sense (they clean around it, not with it). However, if your practice’s legal counsel or compliance officer has determined that a Business Associate Agreement is appropriate for your cleaning contractor, we will execute one. Request this at the time of quote and we will route it to the appropriate contact on our side.
What We Do in Minneapolis Facilities
Crew members assigned to healthcare facilities receive HIPAA awareness training as part of their onboarding to clinical accounts. This covers what PHI is, prohibited actions, screen and document handling, and the reporting chain for potential incidents. The training is not a substitute for your practice’s own security policies — we expect to receive a site-specific briefing from your office manager before the first clean if you have specific protocols we need to follow.
Work With a HIPAA-Aware Cleaning Crew
Request a written quote. We discuss HIPAA awareness in our scope-of-work process.
Request a Free Quote (866) 958-8773