HIPAA Awareness for Cleaning Crews in Clinical Space

HIPAA's Privacy Rule governs how protected health information is handled by covered entities and their business associates. Cleaning contractors working in medical facilities are not typically Business Associates under HIPAA — their work does not involve creating, receiving, maintaining or transmitting PHI in the course of providing cleaning services. But their crew has incidental access to PHI in a clinical environment, and how they handle that access matters.

What Incidental Access Means

A cleaning crew member working in a medical office after hours may encounter:

• Patient appointment boards or scheduling whiteboards visible in the clinic
• Patient charts or files visible on desks or in open folders
• Prescription slips or printed records on surfaces being cleaned
• Computer screens left unlocked with patient information visible
• Voicemail system indicator lights or visible patient messages

None of these situations require the cleaning crew to access, move, read, photograph or discuss the information visible to them. Incidental access is not a HIPAA violation. Deliberate access, disclosure or handling of PHI by cleaning crew is a different matter.

What HIPAA-Aware Cleaning Protocols Cover

A cleaning contractor with HIPAA-aware crew protocols has addressed the following:

• No access to patient records or devices. Crew do not open drawers, access filing cabinets, handle loose records or interact with computers, tablets or devices. If a device must be moved to clean a surface beneath it, it is moved minimally and replaced.
• No discussion of visible PHI. Crew do not discuss, photograph or communicate any patient information encountered during cleaning.
• Cleaning around protected areas. Surfaces containing PHI are cleaned in a way that minimises contact with the information itself — not by skipping the surface.
• Crew understand the expectation. This is covered in new-crew orientation before first entry to a clinical account.

Business Associate Agreements

Practice managers sometimes ask whether a cleaning contractor must sign a Business Associate Agreement. Under the HIPAA Privacy Rule, a Business Associate is an entity that performs functions or activities involving PHI on behalf of a covered entity. Cleaning services that do not involve creating, receiving, maintaining or transmitting PHI do not meet this definition. The consensus among healthcare compliance professionals is that standard cleaning contractors are not BAAs — but if your practice counsel has taken a different position, we will work within whatever agreement framework you require.

What to Ask Your Cleaning Contractor

A reasonable question to a cleaning contractor is: do your crews receive HIPAA-awareness training before entering clinical accounts? The answer should be yes, with a description of what that training covers. It does not need to be a formal HIPAA compliance certification — it needs to be a documented briefing on what crew may encounter and how they are expected to handle it.

This article is for general informational purposes and does not constitute legal or compliance advice. HIPAA questions specific to your practice should be directed to your legal counsel or compliance officer.