Specialised cleaning · updated August 2026
Does Your Medical Office Cleaner Need a HIPAA Business Associate Agreement?
Only if the vendor creates, receives, maintains or transmits protected health information on your behalf — for example secure document destruction, records-room access as a service, or handling devices containing ePHI. Routine cleaning where PHI is merely incidentally visible does not trigger a BAA. A confidentiality agreement, documented workforce training and access controls are still expected.
The Citations That Settle It
| Provision | What it covers |
|---|---|
| 45 CFR §160.103 | Definition of “business associate” — the threshold question |
| 45 CFR §164.502(a) | Permitted uses and disclosures |
| 45 CFR §164.502(b) | Minimum necessary standard |
| 45 CFR §164.504(e) | Business associate contract requirements |
| 45 CFR §164.530(b) | Workforce training |
| 45 CFR §164.530(c) | Administrative, physical and technical safeguards |
| 45 CFR §§164.308, 164.310 | Security Rule administrative and physical safeguards |
| 29 CFR §1910.1030 | OSHA Bloodborne Pathogens — exposure control plan, HBV vaccination offer, training |
What a Compliant Vendor Maintains Regardless
- Time-stamped access control logs
- Signed confidentiality acknowledgements with annual refreshers, records retained
- Documented incident reporting procedure
- Chain-of-custody records where sensitive materials are involved
- General and professional liability insurance
- An OSHA bloodborne pathogens exposure control plan
Ask for the exposure control plan. It is short, it either exists or it does not, and its absence tells you a great deal about the rest.
New York Regulated Medical Waste
New York adds a layer that national HIPAA-cleaning content never mentions. Regulated medical waste is governed by ECL Article 27 Title 15, 6 NYCRR Subparts 360-10 and 360-17 and Part 364, Public Health Law §§1389-aa to 1389-gg, 10 NYCRR Part 70 and NYC Administrative Code §16-120.1. A Medical Waste Tracking Form is required, and RMW other than sharps must be bagged and then packaged in leak-proof rigid or semi-rigid containers.
That stream belongs to your licensed RMW vendor. A janitorial contractor should not touch sharps containers or red bags, and one offering to is a liability rather than a convenience.
The Practical Protocol
- Never move, read, photograph or discard paper
- Screen privacy protocol — monitors are not woken or repositioned
- Locked shred bins moved to collection, never opened
- Exam room terminal cleaning with EPA-registered disinfectants at labelled contact time
- Colour-coded microfibre preventing cross-contamination between restroom, clinical and administrative areas
Our full medical office protocol.
Last reviewed August 2026. Figures for prevailing wage and regulatory schedules change on 1 January and 1 July — we re-verify this page each cycle.
Want This Answered for Your Actual Space?
We publish the general answer because it is useful. For a number that applies to your building, send us the square footage and the nights you need.
Get a Price for Your Space
Written scope and fixed monthly price, usually within two business days.
We reply to every request. If your building needs a Certificate of Insurance or vendor registration, we handle that paperwork before the first night.
Ready for a Cleaning Contract You Can Actually Read?
Send us your square footage and how many nights you need. You get a written scope, a fixed monthly price, and the SLA in the same document — usually within two business days.