HIPAA Awareness for Cleaning Crews in Clinical Space

The Health Insurance Portability and Accountability Act's Privacy Rule protects individually identifiable health information. Cleaning crews working in clinical environments have incidental access to protected health information (PHI) — patient names on whiteboards, charts left in exam rooms, appointment schedules visible at the front desk. Managing that exposure is a compliance obligation for the facility, and it starts with what the cleaning contractor does and does not do.

What "HIPAA-Aware" Cleaning Means in Practice

HIPAA does not prohibit cleaning crews from working in clinical spaces. It requires that the practice take reasonable steps to protect PHI from unnecessary disclosure. For cleaning operations, reasonable steps include:

• Minimum necessary exposure: Cleaning crews should not read, record, or discuss patient information they encounter incidentally. A crew member who notices a patient name on a whiteboard should not engage with that information beyond what is unavoidable in cleaning the surface around it.
• No workstation access: Cleaning crews should not access computers, tablets, or any electronic device that may contain PHI — including to move them for cleaning. Devices should be moved by clinical or administrative staff if repositioning is required.
• Physical record handling: Paper records on desks or in open chart holders should not be moved or disturbed during cleaning. The scope should note which surfaces around records are cleanable without touching records and which are not.
• Verbal discretion: Any PHI encountered during cleaning — overheard conversations, visible information — should not be discussed among crew members or with anyone outside the facility.

Business Associate Agreements

Under HIPAA, a cleaning contractor who has access to PHI as part of providing a service may qualify as a business associate, requiring a Business Associate Agreement (BAA). Whether a BAA is required for a cleaning contractor depends on the nature of their access — incidental exposure during cleaning generally does not trigger BAA requirements, but facilities with stricter compliance interpretations or specific accreditation requirements may require one.

If your facility's compliance officer or legal counsel requires a BAA with your cleaning contractor, raise this requirement during the scope walkthrough. A contractor who has worked in clinical environments for any length of time will have encountered this request and can discuss how to address it.

What to Include in the Cleaning Scope

A HIPAA-aware cleaning scope for a clinical facility should note:

• Surfaces adjacent to patient records or workstations: what is cleaned and how
• Computer equipment: noted as "position only moved by practice staff"
• Patient areas cleaned after discharge vs. between patients: sequence matters for PHI exposure management
• Any photography prohibition: crews should not photograph the facility interior, including for quality control purposes, without specific written authorization

Training Documentation

If your facility is audited for HIPAA compliance, auditors may ask about business associates who have access to PHI. Documentation of your cleaning contractor's HIPAA awareness training — even a brief orientation document — strengthens your compliance position. Ask your contractor what documentation they provide.

→ Request a written scope that addresses HIPAA-aware protocols for your Forest Lake facility