HIPAA Awareness for Cleaning Crews in Clinical Space

Published by Houlton Medical Office Cleaning  |  (866) 958-8773

HIPAA's Privacy Rule protects individually identifiable health information — the name, date of birth, condition, or treatment details that make a piece of information linkable to a specific patient. Cleaning crews working in medical and dental offices routinely have access to spaces where this information is visible, audible, or physically present. The question is not whether cleaning crews need HIPAA training equivalent to clinical staff — they do not — but whether they understand the minimum behavioral expectations that prevent inadvertent privacy incidents.

What HIPAA Requires of Business Associates and Vendors

A cleaning contractor with access to protected health information (PHI) is technically a business associate under HIPAA, and many healthcare attorneys recommend a Business Associate Agreement (BAA) before granting a cleaning company ongoing facility access. The BAA does not require the cleaning company to become a HIPAA compliance officer; it requires them to use PHI only for the purposes of performing their cleaning services and to report any unauthorized disclosure they become aware of.

Your HIPAA Privacy Officer should determine whether a BAA is required for your specific cleaning arrangement based on the degree of PHI access involved. In most cases, a cleaning company that has unrestricted access to your facility after hours should have a BAA on file.

What Crew Members Should and Should Not Do

The behavioral expectations for cleaning crews in clinical spaces are not complicated:

• Do not read visible patient information. A sign-in sheet left at the reception desk, an open chart on an exam room counter, a printed lab result on a physician's desk — none of these are for a cleaning crew member to read or photograph.
• Do not move, open, or access filing cabinets, drawers, or closed binders. Cleaning scope is limited to surfaces. If a surface is blocked by a file folder, the folder is moved carefully and replaced — not opened.
• Do not discuss patient information overheard during their work. If a crew member arrives early and overhears a patient conversation through a door, that information stays with them.
• Do not use personal phones to photograph inside clinical spaces. This is a blanket prohibition regardless of intent.
• Report visible PHI that appears to have been left insecurely. A sign-in sheet visible from a public area, an open door to a records room — these should be flagged to the practice's point of contact, not ignored.

Practical Steps for Practice Managers

Before the cleaning crew arrives, confirm that patient sign-in sheets are removed or secured, that visible lab results or charts have been closed, and that filing room doors are locked if access is not required for cleaning. A five-minute walk-through before the crew arrives is the most effective privacy control available and costs nothing.

When evaluating a cleaning contractor, ask directly: what HIPAA awareness training do your crews receive? A contractor who has never been asked this question is probably the contractor whose crew member photographs something they should not have.

← Back to home  |  Request a quote