Medical Facility Cleaning Services: What to Require Before You Sign

The short answer. Require six things before you discuss price: W-2 employees rather than subcontractors, dated bloodborne pathogen training records, named EPA-registered disinfectants with their contact times, a written room-specific schedule, signed per-visit logs, and certificates of insurance. A vendor who can produce all six within a day is a fundamentally different company from one who cannot — and the gap between them is almost never visible in the proposal.

Do I need a HIPAA business associate agreement with my cleaning company?

This is the question medical practices most often get wrong, in both directions — some demand a BAA that isn't required, others ignore a case where one genuinely is.

Generally, no. HHS guidance is explicit: janitorial services that clean the offices or facilities of a covered entity are generally not business associates, because the work doesn't involve the use or disclosure of protected health information, and any exposure that occurs while performing their duties — emptying a trash can, for example — is limited, incidental, and couldn't reasonably be prevented. HHS states that a business associate contract is not required with organizations whose access to PHI would be incidental, if at all (HHS FAQ 243).

The exception that does apply: if your vendor handles PHI disposal — document shredding, destruction of records — that is a business associate function and does require an agreement (HHS FAQ 577). Cleaning is not a BA function. Destroying records is.

The six requirements, and why each one matters

Why does medical cleaning cost more?

Because four things change, and each one is labor rather than a premium for the word "medical":

• Written, room-specific schedules. OSHA's Bloodborne Pathogens Standard (29 CFR 1910.1030) requires a schedule determined by location, surface type, soil present, and procedures performed. "Cleaned nightly" does not satisfy that.
• EPA-registered disinfectants at full contact time. Surfaces must stay visibly wet for the label duration — which takes longer than wiping.
• Trained personnel. Bloodborne pathogen training for anyone with occupational exposure, refreshed and documented.
• Documentation. Per-visit logs are a deliverable, and deliverables cost something to produce.

The result: healthcare facilities run roughly $0.14–$0.29 per square foot per visit against $0.09–$0.17 for standard office space (ISSA 2026). If a medical bid comes in at office rates, the honest reading is that you're being quoted an office program.

What belongs in a medical scope of work?

1. Every surface assigned, in writing. Cleaning vendor or clinical staff — one name per surface, no assumptions. This single document closes most compliance gaps.
2. The high-touch set named explicitly. Not "high-touch surfaces." Door hardware, light switches, check-in tablet, chair arms, exam table, counters, sink and faucet, cabinet pulls, restroom fixtures.
3. Product per surface, with contact time. Which EPA-registered product goes where, and how many minutes it stays wet.
4. Frequency per area. Daily, between patients, weekly, monthly rotation, quarterly.
5. What comes back after each visit. The log format, who signs it, where it's filed, how fast you can produce it.
6. Escalation. What changes after an illness event or a spill involving blood or OPIM.

For the room-level task list to build that scope from, use our medical office cleaning checklist; for the reasoning behind each frequency, see the medical office cleaning frequency guide.

The questions that separate vendors

Ask these five and listen to how fast the answers come, not just what they are:

1. "Are your cleaners employees or subcontractors?"
2. "When was this crew last trained on bloodborne pathogens — can you send the dated records?"
3. "Which EPA-registered disinfectant do you use in exam rooms, and what's its contact time?"
4. "Can I see a sample cleaning log from another medical account?"
5. "Who do I call at 7am when something's wrong, and will I get a person?"

A vendor built for healthcare answers all five without checking. One that isn't will hesitate on the third — because contact time is the detail that only matters if you actually train to it.

What you can do this week

1. Request dated BBP training records from your current vendor. One email, and it's the fastest way to find the most serious gap in your program. If the answer takes a week, that's the answer.
2. Time one exam-room turnover. Read the contact time on the label, then watch with a stopwatch. The gap between the label and the practice is the single most common real-world failure in medical facilities.
3. Check whether your BAA situation is right. If you're holding a signed BAA with a cleaning vendor who doesn't touch PHI disposal, it's likely unnecessary — and if you use them for shredding without one, that's a real gap. Two minutes with the HHS guidance above settles it.

How we're set up for it

Everything on that six-item list is standard in our medical office cleaning program, run through Purity Med: W-2 crews who are background-checked and bloodborne pathogen-trained, OSHA and CDC-aligned protocols, documented exam-room turnover, and clinical restroom sanitation — with logs you can hand an auditor. Larger healthcare properties run through hospital-grade janitorial at building scale.

You can browse the full service list or see how the operation works — we cover medical facilities across Miami-Dade and Broward, including Miami.

The bottom line

Price is the last question, not the first. Require the six, write the scope room by room, and get the HIPAA question right in both directions — no BAA needed for ordinary cleaning, one required if they destroy records. A vendor who clears that bar costs more per square foot and costs dramatically less on the day someone asks to see your documentation.