HIPAA’s Privacy Rule applies to covered entities and their business associates, which includes cleaning companies that access areas where protected health information is stored or visible. A janitorial company cleaning exam rooms, offices with paper charts, or areas with computer screens displaying patient data is a business associate under HIPAA. That classification requires a Business Associate Agreement (BAA) between your practice and the cleaning vendor, and it imposes specific obligations on how the cleaning company handles any PHI it encounters.
Beyond the BAA, compliant cleaning programs require that staff receive training on PHI handling, that personnel accessing clinical areas are bound by confidentiality provisions, and that the contract includes provisions for breach notification. In practice this means your cleaning vendor needs a documented privacy training program, background screening for staff assigned to your facility, and a clear escalation path if a breach occurs. Practices that skip the BAA requirement and treat janitorial as a commodity purchase create real compliance exposure during audits.
What HIPAA actually says about cleaning vendors
The HIPAA Privacy Rule defines a business associate as any person or entity that performs functions or activities on behalf of a covered entity that involve the use or disclosure of PHI. That definition is broad by design. A cleaning technician who enters a room containing open patient files, prescription labels, or an unlocked workstation displaying a patient record has exposure to PHI. That exposure, even if incidental, brings the cleaning company under the business associate definition.
The Office for Civil Rights at HHS has been consistent on this point. The rule does not require that a vendor actively read or copy PHI. The standard is access, meaning physical proximity where PHI could be viewed. Cleaning staff working in clinical environments routinely meet that standard.
The required response is a signed BAA before any cleaning work begins in areas where PHI is present. The BAA must specify how the cleaning company will safeguard PHI it encounters, how it will report breaches, and what happens to PHI (if the company somehow retains any) at contract termination.
The common misconception about HIPAA and cleaning
Many practices assume HIPAA governs digital records and IT vendors. The law covers any PHI in any format, including paper, physical labels, and verbal disclosures. A cleaning technician who photographs a patient name visible on a printout has committed a reportable breach. One who overhears a staff member discussing a patient and repeats that information has done the same.
This misconception leads practices to sign BAAs with their EHR vendors while handing a key to their janitorial company with no agreement at all. That gap is a direct compliance failure. OCR audits examine vendor relationships, and “we didn’t think our cleaning company counted” is not an accepted response.
The other common misread is that a BAA makes a practice automatically compliant. The BAA is a contract requiring specific behaviors. If the cleaning company does not actually train its staff, conduct background checks, or follow a breach notification process, the BAA provides no real protection.
What a BAA covers for cleaning companies
A BAA with a cleaning vendor should address several specific areas.
The agreement must describe the permitted uses of PHI. For a cleaning company, that means PHI may be incidentally encountered but may not be read, recorded, photographed, or disclosed. Staff are permitted to clean around PHI but not to interact with it.
The BAA must require the cleaning company to use safeguards to prevent unauthorized use or disclosure. In practice that means staff training, confidentiality agreements signed by each employee assigned to the facility, and documented protocols for what to do when PHI is visible.
The agreement must include breach notification requirements. If a cleaning technician sees that a file cabinet containing records was left open and unsecured, or if a staff member witnesses a colleague photographing a patient record, that is a potential breach. The vendor must notify the covered entity within the timeframe specified by the BAA, and that timeframe should align with the 60-day maximum set by the Breach Notification Rule.
The BAA should also address subcontractors. If the cleaning company uses subcontracted labor, those workers must be bound by the same requirements.
PHI exposure scenarios specific to cleaning staff
The scenarios where cleaning staff encounter PHI are predictable and worth naming directly.
Paper charts and sign-in sheets left on counters or nursing stations are the most common exposure point. A technician wiping down a counter has line-of-sight access to patient names, dates of birth, and appointment reasons. The fix is a protocol requiring staff to clean around documents rather than moving or reviewing them, paired with facility-side procedures for securing records before cleaning crews arrive.
Computer screens are a frequent risk in open office and nursing areas. Workstations left unlocked with patient records visible are a PHI exposure every time a cleaning technician enters the room. The cleaning company should instruct staff not to use or touch workstations and to report screens displaying patient data if the information appears to have been left unattended inadvertently.
Physical mail, prescription labels, lab result printouts, and patient wristbands left on surfaces all carry PHI. Cleaning staff should be trained not to discard any paper materials, even if they appear to be trash, without direction from facility staff.
Supply rooms and medication areas sometimes contain labels with patient names tied to prescriptions or specimens. Staff cleaning these areas need specific instructions about those materials.
For a detailed picture of how a compliant cleaning program operates in clinical settings, see our medical cleaning services and the healthcare facilities we serve.
What a HIPAA-conscious cleaning contract must include
The contract between a healthcare facility and its cleaning vendor should go beyond the BAA itself.
The contract should name the specific positions or roles that will access clinical areas and require advance notice of any personnel change. Facilities need to know who is on site. An anonymous rotating workforce is not compatible with HIPAA compliance.
Background screening requirements belong in the contract, not just in the vendor’s internal HR policy. The contract should specify the type of screening (criminal history at minimum), the recurrence interval, and what disqualifying findings look like.
Training documentation should be a contract deliverable. The vendor should provide records showing that each staff member assigned to the facility has completed privacy training. That training should cover what PHI is, what to do when it is encountered, and how to report a potential breach internally so the vendor can notify the facility.
The contract should define an escalation path for breach notification with specific contact names, not just job titles. If a breach event occurs at 11 PM during a scheduled cleaning, the cleaning company supervisor needs a direct number to reach someone at the facility.
Audit rights matter. The contract should give the facility the right to inspect training records, background check logs, and any incident reports generated by the cleaning vendor. This right is a standard expectation in Joint Commission surveys and OCR audits.
Why this matters during audits
Joint Commission surveys and OCR audits both examine vendor management. Surveyors and investigators ask for copies of BAAs, ask how the organization identifies which vendors require one, and ask for evidence that vendors comply with the terms.
A practice that produces a signed BAA but cannot show that its cleaning vendor actually trains staff or conducts background checks has a problem. The OCR’s enforcement priorities include documentation gaps, and a missing or non-functional BAA with a cleaning vendor is the kind of finding that results in a corrective action plan.
The cost of an OCR investigation is time and legal fees before any penalty is assessed. For small and mid-size practices, the corrective action process alone disrupts operations. A properly structured cleaning contract eliminates most of that exposure.
Does every cleaning company that enters a medical office need a BAA?
Any cleaning vendor that accesses areas where PHI is stored or could be visible needs a BAA. That includes exam rooms, nursing stations, offices with patient files, and any space with workstations displaying patient records. If the cleaning scope is limited to public-only areas with no PHI present, the analysis is different, but most medical office cleaning contracts include clinical areas.
What happens if a cleaning technician accidentally sees patient information?
Incidental exposure that results from standard cleaning activity is not automatically a reportable breach. HIPAA permits incidental disclosures that occur despite reasonable safeguards. The key is that the vendor has safeguards in place: training, protocols for cleaning around PHI, and instructions not to read or record what is seen. If the technician reads, copies, photographs, or discloses the information, that crosses into a reportable breach.
Can a practice just add HIPAA language to a standard cleaning contract instead of a separate BAA?
The BAA can be incorporated into the main services agreement as a specific section rather than a standalone document. What matters is that all required BAA elements are present: permitted uses of PHI, safeguard requirements, breach notification obligations, and termination provisions. A cleaning contract that mentions HIPAA without covering those specific elements is not a compliant BAA.
How often should cleaning staff complete HIPAA training?
HHS does not specify a required training interval, but the general standard for covered entity workforces is annual training. Cleaning vendors should apply the same standard to staff assigned to healthcare facilities. Training records should be retained and available for audit. New staff should complete training before their first shift at a medical facility, not at the next scheduled training cycle.