Uncategorized

11 Oct 2026 ECS Web

5 Signs Your Eugene Medical Office Cleaning Falls Short of HIPAA

Here’s a small test you can run tomorrow morning before the first patient checks in.

Walk to the reception desk and look in the wastebasket underneath it. Then walk to the back and check the bin beside the printer. Then open the dumpster behind the building.

If any of those three places contains a patient’s name, a date of birth, an appointment schedule, a lab requisition, a specimen label, or an insurance explanation of benefits, you have a problem. Not a hypothetical one. A real one, sitting in a public container, where the wind can take it and any neighbor walking past can read it.

Most Eugene and Springfield practice managers we talk to are confident about their HIPAA posture when it comes to software, email encryption, and staff training. They’ve done the risk analysis. They’ve signed business associate agreements with their EHR vendor and their billing company. And then the cleaning crew shows up at 6:30 p.m. and nobody has asked a single question about them.

That’s the gap this article is about.

Over the next few thousand words, I’ll walk through five specific signs that your medical office cleaning in Eugene isn’t holding up its end of the HIPAA bargain. Not because the crew is lazy, and not because the contract is cheap. Usually it’s because the cleaning company was hired to clean an office, and a medical office is a different animal entirely.

We’ll cover what HIPAA actually requires (and the parts people get wrong), how to spot each problem, and what to do about it. There’s a self-audit checklist near the end, plus answers to the questions practice managers ask us most often. If you read the whole thing and recognize three or more of the five signs, you’ll know exactly where to start.

First, What HIPAA Actually Says About Cleaning

Let’s get one thing out of the way, because it trips up a lot of smart people.

HIPAA does not contain a cleaning standard. There’s no regulation that says “mop with a quaternary ammonium solution at 200 parts per million.” There’s no federal rule requiring a specific brand of disinfectant in an exam room. If you go looking for the HIPAA-approved mop bucket, you’ll be looking for a long time.

What HIPAA does contain is a set of obligations about protecting protected health information from unauthorized access, and cleaning operations touch those obligations in four or five places.

The parts of HIPAA that reach your janitorial crew

The Security Rule’s physical safeguards. At 45 CFR 164.310, the rule requires covered entities to limit physical access to their facilities while ensuring authorized access is allowed. It also requires policies and procedures for disposing of electronic protected health information and the hardware and media that hold it. That means if your cleaning company throws away a decommissioned laptop, an old label printer, or a stack of CDs, you have a problem. It also means your cleaning vendor needs to be part of how you control physical access, not an exception to it.

The disposal provision. The Security Rule specifically calls out disposal at 164.310(d)(2)(i). The Privacy Rule’s safeguard standard at 45 CFR 164.530(c) uses broader language about reasonable safeguards to protect PHI from intentional or unintentional use or disclosure. Both of those get tested the moment a bag of trash leaves your building.

Incidental disclosures. Your exam room whiteboard has a patient’s name on it. Your scheduling screen stays awake overnight. Your checkout counter has a sign-in sheet. A person walking through the building after hours can see all of that. HIPAA allows incidental disclosures, but only when you’ve applied reasonable safeguards and the disclosure can’t be reasonably prevented. A cleaning crew wandering freely through a treatment area at 9 p.m. with zero training on what they’re looking at is not a reasonable safeguard. It’s an unaddressed risk.

Business associate arrangements. Whether your cleaning contractor needs to sign a BAA depends on what they actually do. If they handle PHI on your behalf, or dispose of it, they may be acting as a business associate and rules apply to them directly. Many practice managers sign one anyway as a precaution, and that’s a defensible choice. What isn’t defensible is nobody ever asking the question. A documented decision beats an undocumented assumption every single time.

OSHA sits right next to HIPAA here

This is the part that gets skipped. The federal bloodborne pathogens standard exists to protect workers with occupational exposure to blood or other potentially infectious materials. Oregon has its own version of that rule through Oregon OSHA, since Oregon runs a state plan.

If your cleaning contractor’s staff is handling anything that could be contaminated — red bags, sharps containers, specimen transport bins, mop water from a procedure room — they need their own written exposure control plan, their own training records, and their own protective equipment. If the crew isn’t being trained on that, you’ve got an occupational safety problem layered on top of a privacy problem. Both can end up in a file with your name on it.

What this means in practice

HIPAA doesn’t tell you which chemical to buy. It tells you that you have to protect information, control who gets physical access, and dispose of records properly. Cleaning is one of the few functions in your clinic that touches all three at once, every single night.

Which brings us to the five signs.

Sign #1: Unrestricted Access to Patient Information — With No Paperwork Behind It

Start here because it’s the easiest to check and the most common failure.

Ask yourself a simple question: who had a key, code, or badge to your building in the last twelve months? Not who has one now. Who had one. If the answer takes more than thirty seconds, you’ve found sign number one.

Cleaning companies have a structural problem with access. The industry runs on part-time and evening labor, and turnover is famously high — many building service contractors see front-line turnover that would make a restaurant manager wince. That means people cycle through your building constantly. Some of them leave. Some of them leave on bad terms. And master keys, alarm codes, and door fobs have a way of not coming back.

What to ask, specifically

Does every person who enters my building after hours go through a background check before their first shift, or after?
Are they drug screened? Is that a one-time screen at hire, or ongoing?
Is there a written key and code control policy with a log of who holds what?
What happens within 24 hours of a termination? Who collects the key, and do you rekey or reprogram?
Are there subcontractors? If so, whose background checks cover them?
Does your company carry general liability and workers’ compensation coverage, and are they bonded?

If the answer to any of those is fuzzy, you’re relying on luck.

The confidentiality piece nobody documents

Background checks handle the “who” question. They don’t handle the “what do they know” question.

Your cleaning techs will see things. They’ll see a patient name on a whiteboard. They’ll see a chart left on a counter. They’ll see a sticky note on a monitor that says “call Mrs. Alvarez re: biopsy results.” In an ordinary office, none of that matters. In a clinic, it’s PHI, and it’s protected.

Does your cleaning company have a written confidentiality policy that employees sign? Do they get trained — with a signature and a date — on what constitutes PHI and what to do if they encounter it? Do they know they’re not allowed to text a photo of your break room to a friend, which sounds absurd until you remember someone has done exactly that at some point?

Honestly, most commercial cleaning contracts in Lane County don’t include any of this. Not because the companies are shady, but because their customers never asked and their standard operating procedure was written for warehouses and law offices.

A ten-minute audit you can do this week

Pull your access control list and compare it to your current cleaning roster.
Ask your vendor for a copy of their confidentiality policy and training sign-in sheets for the people assigned to your building.
Ask for a certificate of insurance dated within the last twelve months.
Confirm in writing whether they consider themselves a business associate for your practice, and whether a BAA is in place.
Walk the building at 7 p.m. and see what a person standing in your hallway can read from a doorway.

That last one is humbling. Do it anyway.

Sign #2: Trash Leaves the Building Without a Disposal Policy

This is the sign that’s most likely to end up in a complaint, and it’s almost always invisible until it isn’t.

Here’s the mechanism. A medical assistant finishes a room turnover and wipes down the exam table. She uses a paper towel, drops it in the bin, and moves on. Later, a patient checks out and gets handed a printed visit summary. They read it in the car, decide they don’t need it, and drop it in the trash can by the front door.

At 6:30 p.m., a cleaning tech walks through with a 44-gallon bag on a cart. He dumps the front-door bin, the reception bins, the printer bin, the break room bin, and the exam room bins into one bag. He ties it off. He wheels it out through the front lobby — past anyone standing outside — and tosses it in a dumpster that may or may not be locked.

That visit summary is now in an open container in a parking lot.

The paper towel problem nobody wants to talk about

Clinics generate an enormous amount of paper waste that isn’t technically PHI but is proximate to it. Gowns. Towel wrappers. Gloves. Gauze packaging. And on the flip side, they generate a smaller amount of paper that absolutely is PHI: printed schedules, specimen labels, requisition forms, prescription printouts, insurance denials, and the occasional sticky note with a name on it.

If your cleaning crew is consolidating everything into one stream with no instruction about what to look for, you’re counting on the odds. That works until it doesn’t.

The practical fix is boring: lockable, clearly labeled shred bins in the areas where PHI gets printed, placed next to — not instead of — regular waste. Your clinical staff handles the sorting. Your cleaning company handles the pickup, with a documented chain of custody if they’re the ones taking it off site.

Sharps, red bags, and things that aren’t your janitor’s job

There’s a hard line here, and it’s worth saying plainly.

Regulated medical waste — sharps containers, red bags, anything saturated with blood or other potentially infectious material — needs to go through a licensed medical waste hauler under Oregon’s rules. That is not a general janitorial function. It never should be.

If your cleaning crew is pulling red bags out of an exam room and carrying them to the dumpster, stop that today. Not because they aren’t capable, but because they aren’t trained for it, aren’t equipped for it, and aren’t covered for it if something goes wrong.

What your cleaning company should be doing is simpler. They should know the difference between a red bag and a regular bag. They should know never to reach into a trash can with bare hands or compress a bag. They should know exactly whom to call if they find a sharps container in the wrong place. And the answer should be somebody on your staff, with a documented procedure, not a shrug.

Dumpster and loading dock details

A few small things that matter more than they sound like:

Is the dumpster locked, and is it positioned where a passerby can’t reach in?
Is there a schedule for how often it’s emptied, and is it emptied after the last pickup of the week?
Are there any bins near an exterior door that could be tipped by wind?
Does your building share a dumpster with another tenant? If so, whose trash is whose?

If you’re in a multi-tenant building off Coburg Road or near the RiverBend campus in Springfield, shared waste infrastructure is common. It’s also where a lot of PHI exposure happens, because nobody owns the problem.

Sign #3: No Documented Training, No Logs, and No Way to Prove Anything

This sign separates “we clean well” from “we can demonstrate we clean well.” They are different things, and only one of them helps you when someone asks for evidence.

What “documented” actually means

When we say documentation, we mean a trail you could hand to an Oregon OSHA inspector, an accrediting surveyor, or a plaintiff’s attorney without flop sweat. That looks like:

Training records. Names, dates, topics covered, who delivered the training, and a signature or initials from each attendee. Not a slide deck in a shared folder. Records.
Task checklists with timestamps. “Exam rooms 1–6: disinfected high-touch surfaces, restroom restocked and logged, 7:12 p.m., initials MW.” Something that shows the work happened on a specific date.
Chemical records. Safety data sheets on site or on a tablet, dilution ratios for any concentrate, and proof that staff were trained on the products they use.
Equipment maintenance logs. Vacuum filters changed when they’re supposed to be. Batteries maintained. Mops laundered or replaced on a schedule, not when they start smelling.
Corrective action records. When something went wrong — a missed room, a complaint, a spill — what happened next, and when.

Why this is the hardest sign to spot

Because an undocumented good job looks exactly like a documented good job when you’re walking through at 8 a.m.

The break room is clean either way. The restroom smells fine either way. The difference only shows up when something goes sideways: a patient complains, an inspector visits, an employee gets sick, or a breach gets reported. That’s when you discover whether you have a partner or a vendor with a mop.

Turnover makes it worse, and turnover is a fact of life

Building service contractors deal with a lot of churn on the front line. It’s a part-time, evening, frequently minimum-wage job. Companies that handle it well do three things: they invest in training anyway, they document that training so the investment survives the employee, and they build continuity into the schedule so the same faces show up at your building.

Continuity is underrated. A tech who has been in your building for two years knows that the bin under the check-in desk sometimes has patient labels in it, and knows to slow down there. A rotating crew does not.

Ask your vendor what their average tenure is for the crew assigned to your facility. Ask how many of the people who clean your building tonight will be the same people in six months. If the answer is “we can’t really guarantee that,” you’ve found sign three.

Sign #4: Disinfectants Are Being Used Wrong — Or the Wrong Ones Are Being Used

Here’s where the cleaning industry earns its reputation for invisible shortcuts. The products on the shelf may be completely appropriate. The way they’re applied often isn’t.

Dwell time is the detail that gets skipped

Every EPA-registered disinfectant has a contact time on the label. It might be one minute. It’s often ten. It might be longer for specific pathogens.

Contact time means the surface has to stay visibly wet for that entire period. Wet. Visible. For the full duration.

Now think about how a typical cleaning round actually works. Tech enters the exam room, sprays the counter, wipes it dry immediately, moves to the next room. The product was on the surface for four seconds. That’s a cleaning wipe-down, not a disinfection. It removes grime and some organisms. It does not deliver the kill claim printed on the bottle.

This is the single most common gap we find in medical offices that have switched cleaning companies, and it’s the one that’s hardest for a practice manager to see. The rooms look clean. They smell clean. The counter is dry and shiny. The label on the jug says “kills 99.9%.” Everything appears fine.

The fix is operational, not chemical. It means building realistic time per room into the schedule, using the right number of cloths, and having supervisors who check. It also means choosing products with shorter contact times where possible, so the math actually works.

Cross-contamination and the mop bucket problem

Watch a cleaning cart in a busy clinic and you’ll learn a lot in five minutes.

Is the same rag used on the restroom faucet and the exam room counter? That’s how a bathroom organism ends up on a surface a patient touches.
Is the mop water changed between the restroom and the treatment area? If it’s the same bucket, the answer is no.
Is the microfiber sorted by color, with a written standard for which color goes where? Color-coded systems exist for a reason.
Are the cloths laundered at the right temperature, or just run through a home-style wash and air dried?
Is the vacuum a HEPA unit with a sealed system, or does it exhaust fine dust back into the room?

None of these are exotic requirements. They’re basic infection control practice that a medical-grade cleaning program builds in as a standard, not as an upsell.

Hospital-grade, EPA-registered, and the green question

“Hospital-grade” isn’t a regulated term, but it’s generally used to mean an EPA-registered disinfectant with claims against the organisms that matter in a clinical setting. That typically includes efficacy against organisms like Staphylococcus aureus, Pseudomonas aeruginosa, and often Mycobacterium tuberculosis, which pushes a product into intermediate-level disinfection territory.

Green cleaning creates a real tension here, and anyone who tells you otherwise is selling something. Eco-friendly products certified by Green Seal are excellent general-purpose cleaners. They’re better for indoor air quality, better for the staff using them every night, and better for the environment. But “gentle on the environment” and “kills C. diff spores” are not the same claim.

The honest answer is that a good medical cleaning program uses both. Green Seal certified products for general cleaning, glass, and floors. EPA-registered hospital-grade disinfectants, applied with correct dwell time, for high-touch clinical surfaces. If a cleaning company tells you their all-green product line replaces hospital-grade disinfection everywhere, ask to see the label claims. Then ask again.

Carpet in a clinic: why we use encapsulation and not hot water extraction

This one comes up constantly, so let’s address it directly.

At Executive Cleaning Services, we don’t do hot water extraction. The only carpet cleaning method we offer is encapsulation. That’s a deliberate choice, and here’s why it matters in a medical setting.

Hot water extraction — what most people call steam cleaning — pushes a lot of water into the carpet and pulls most of it back out. Done well, it’s effective. It’s also disruptive. Dry times commonly run six to twelve hours, sometimes longer in humid weather or in a building with a poorly balanced HVAC system. During that window, a room is unusable, the humidity climbs, and the carpet backing and adhesive take on moisture. In a clinic where you’re trying to keep exam rooms in service and where you’re already thinking about moisture and indoor air quality, that’s a real cost.

Encapsulation works differently. A polymer solution is applied to the carpet, and it bonds to soil particles as it dries. The soil crystallizes into a brittle residue that gets vacuumed away. Water use is minimal, and dry time is typically under an hour. There’s no soaking, no soaking-wet pad under a treatment table, and no shutting down a wing for half a day.

It’s also gentler on the carpet itself. Less water means less stress on the backing, the adhesive, and the fiber. For a clinic carpet that takes a beating from wheeled equipment and constant foot traffic, that adds years to its life.

The tradeoff, honestly stated: if a carpet has been deeply soiled with biological material or has gone years without service, a restorative extraction may be the better tool, and that’s a conversation worth having with a specialist. For routine maintenance in a working medical office, encapsulation gets the job done with a fraction of the water and disruption. We’d rather tell you that plainly than pretend one method covers every situation.

Sign #5: Your Cleaning Schedule Was Built for an Office, Not a Clinic

A standard commercial cleaning contract is designed around a simple rhythm: come in after everyone leaves, empty the bins, vacuum, wipe the break room, clean the restrooms, lock up. That rhythm is fine for a software company.

A clinic is not a software company.

Timing and patient flow

Think about what actually happens in your building between 5 p.m. and 7 a.m.

The last patient leaves at 5:40. The front desk reconciles payments until 6:15. The clinical staff finishes documentation and sterilizes instruments until 6:45. The cleaning crew arrives at 6:30.

Congratulations, you now have two groups of people trying to occupy the same space, and one of them is going to cut corners so they can leave.

Some clinics handle this by having the crew arrive at 9 p.m., after everyone is gone. That’s cleaner from a privacy standpoint but means the building sits dirty all evening, which matters if you have an evening clinic or after-hours urgent care. Others use an early-morning window — 5 a.m. to 7 a.m. — so the building is fresh when the first patient arrives, which means the crew is working against a hard deadline and sometimes gets pushed out mid-task.

There’s no universal right answer. There is a wrong answer: nobody ever thought about it, and the schedule is whatever the previous vendor proposed.

What high-touch actually means in an exam room

An office high-touch list is short. Door handles, light switches, the coffee pot, the copy machine. A clinic’s list is much longer, and it includes things a generic cleaning crew won’t think to touch.

Exam table levers, stirrups, and the underside of the table edge
Blood pressure cuff hoses and the counter where they sit
Otoscope and ophthalmoscope handles
The chair armrests patients grip while getting up
Checkout counter pens and clipboards
Waiting room chairs, especially the arms
The blood draw chair and the tourniquet drawer handle
Faucet aerators and flush handles in patient restrooms
Door push plates and the keypad at the staff entrance
The clipboard hanging on the exam room wall

If your cleaning crew is doing the same routine they’d do at an insurance office, most of that list never gets touched. Not out of laziness, but because nobody told them it was on the list.

Frequency, seasonality, and the flu season problem

A waiting room with twenty chairs might get wiped down once a night in July. In January, with respiratory season in full swing and people coughing into their hands before grabbing a chair arm, once a night may not be enough.

The same applies to restrooms. A five-person office bathroom gets a handful of users a day. A clinic restroom might see sixty. Frequency should follow traffic, not square footage.

Good cleaning contracts address this with a flexible frequency standard: high-touch surfaces daily at minimum, restrooms on a defined interval, and additional mid-day service during respiratory season. It costs more in January. It costs less than the alternative.

What the Gaps Actually Cost You

Fines get all the attention, and for good reason. Civil penalties under HIPAA run across tiers and are adjusted for inflation, and they add up fast when multiple violation categories are involved. But the fine is rarely the biggest number.

Here’s what a real incident tends to cost a practice:

The response itself. If PHI is disclosed, you’re looking at a risk assessment, legal fees, notification letters, potentially credit monitoring, staff time absorbed by an investigation, and a remediation plan. That’s months of distraction for a practice that needs its manager focused on patient flow and staffing.

Staff absences. You’ve probably seen the figures that circulate about office surfaces — numbers like 25,000 germs per square inch on a phone, roughly 300 touches per surface per day, thousands of bacteria on a keyboard. Those come from workplace germ studies and they’re worth taking with a grain of salt in terms of exact counts, but the direction is right. Surfaces in a working building get contaminated fast. In a clinic, they get contaminated with things that make people sick. One bad respiratory season that runs through your front desk staff costs more in temporary coverage and lost productivity than a year of professional cleaning.

Patient perception. Patients judge the whole practice in the first thirty seconds, and they judge it on things you might not notice anymore. Scuffed baseboards. Dust on the blinds in the waiting room. A restroom that smells like a restroom. Nobody files a complaint about it. They just don’t come back, and they don’t tell you why.

Review and referral damage. One review that mentions a dirty exam room does measurable harm in a market like Eugene, where patients choose practices partly based on what they read. You can’t clean your way out of a bad review, but you can prevent the conditions that produce one.

Survey and inspection readiness. If you’re accredited, you know the drill. If you’re not, you still answer to state licensing and, in some settings, Medicare certification. Environmental conditions show up in surveys more often than people expect, and “we asked the cleaning company to do better” is not a corrective action plan.

A Self-Audit Checklist for Eugene Medical Offices

Print this. Walk your building with it. Give yourself a grade on each line.

Access and personnel

I can produce a current list of everyone with after-hours access within five minutes.
Every person on that list has passed a background check before their first shift.
My cleaning vendor has a written confidentiality policy, signed by each tech assigned to my building.
Keys, fobs, and alarm codes are logged, and terminations trigger same-day collection.
I have a certificate of insurance from my cleaning vendor dated within twelve months.
I know whether my cleaning vendor is considered a business associate, and I’ve documented that decision.

Waste and disposal

Shred bins are present in every area where PHI is printed, and they’re locked.
The shred stream never mixes into general trash inside the building.
Trash leaves the building in closed bags, on a cart, not carried loose.
The dumpster is locked and positioned where it can’t be reached from the street.
Regulated medical waste goes to a licensed hauler, not the general dumpster.
My cleaning crew knows not to touch sharps containers and knows who to call if they find one.

Documentation

I can produce training records with names, dates, and topics for my cleaning crew.
I receive task logs or checklists with timestamps for high-touch disinfection.
Safety data sheets for every chemical used in my building are available on site.
I have a written record of the last corrective action taken on a cleaning issue.
I know the average tenure of the crew assigned to my building.

Chemicals and methods

Disinfectants used in my building are EPA-registered and applied with correct dwell time.
Microfiber is color-coded, and there’s a written standard for which color goes where.
Mop water is changed between restrooms and clinical areas.
Vacuums use HEPA filtration with sealed systems.
Carpet cleaning doesn’t leave rooms unusable for half a day.

Schedule and scope

My cleaning schedule was designed around patient flow, not a generic office template.
High-touch surfaces in exam rooms are on a written list that includes table levers, chair arms, and equipment handles.
Restroom frequency matches actual traffic, with extra service during respiratory season.

Most practices we audit pass the first ten or so and start losing points in the documentation and chemicals sections. That’s normal. It’s also fixable.

How Executive Cleaning Services Handles This Differently

If you’ve read this far and recognized your building, here’s the part where we talk about ourselves. We’ll keep it short, because the useful information is above and you can decide what to do with it.

Executive Cleaning Services is a locally owned commercial janitorial and facility cleaning company based here in Lane County. We serve Eugene, Springfield, Albany, Corvallis, Cottage Grove, Harrisburg, Tangent, and Veneta. Our clients are commercial offices, retail spaces, industrial properties, and — the category this article is about — medical facilities.

A few things that make a difference specifically for medical practices:

We build the program around your operation, not ours. Every account gets a customized cleaning plan built around your patient schedule, your exam room turnover, and your peak hours. Daily, weekly, or bi-weekly service, whichever fits. You’re not getting a template that was designed for a call center.

Compliance is built into the contract, not bolted on. We hire insured, bonded, background-checked, and drug-screened employees. We work within HIPAA and OSHA requirements, use hospital-grade disinfectants and modern equipment, and apply sterilization methods that go beyond what the state requires. Green Seal certified products are part of the mix for general cleaning, alongside EPA-registered disinfectants for clinical surfaces.

You get a person, not a phone tree. Every account has a dedicated account manager who functions as a cleaning concierge — someone who knows your building, your standards, and your staff by name. We also use logbooks and a communication system that keeps your team and our team in the same conversation instead of trading voicemails.

Managers and technicians are reachable around the clock. If a pipe bursts in a restroom at 2 a.m. or a patient vomits in the lobby at 4 p.m., you have someone to call. Large medical providers also get three free emergency cleanups on us.

Carpet cleaning that doesn’t shut you down. Certified technicians using the encapsulation method only — no hot water extraction, minimal moisture, dry times under an hour, and a lot less wear on your carpet.

The Clean Guarantee. Every service we provide is backed by it. If the work isn’t right, we come back and fix it. Simple as that.

We’re led by Mark Wood, and we’ve been building this team in the same community for over a decade. That’s not a marketing line — it’s the reason we answer the phone, and it’s the reason we’d rather tell you the honest tradeoff on carpet cleaning than sell you a service you don’t need.

If you want a free estimate, we’ll walk your facility, look at your schedule, and tell you what we’d change. No pressure, and no obligation to hire us.

Common Questions From Eugene Practice Managers

Does my janitorial company have to sign a HIPAA business associate agreement?

It depends on what they actually do. If they handle protected health information on your behalf — including disposing of it — they may be functioning as a business associate, and the rules would apply to them directly. If they’re purely cleaning and never touch PHI, the analysis is different. The important thing is that you made a documented decision. Many practices sign one anyway as a precaution. Talk to your compliance officer or attorney about your specific situation rather than relying on a general rule you read somewhere.

Can we just ask our current cleaning company to do all of this?

Sometimes, yes. If they’re a professional outfit with real training infrastructure, adding medical-grade protocols is a reasonable scope change. What usually kills it is documentation. Vendors that have never tracked dwell time, chemical dilution, or per-room task logs often can’t produce records retroactively, and asking them to build that from scratch requires a supervisor and a system they may not have. Ask for a sample log. If they can show you a real one, they can probably do the work.

How often should high-touch surfaces in a waiting room be cleaned?

Daily at minimum. During respiratory season, more often — a mid-day wipe of chair arms, door handles, and the check-in counter is worth the cost. The exact frequency should track how many people come through, not how big the room is. A 300-square-foot waiting room with 200 patients a day needs more attention than a 1,000-square-foot lobby with ten.

Is green cleaning enough for a medical office?

Green Seal certified products are excellent for general cleaning, glass, floors, and environmental surfaces, and they’re better for indoor air quality. For clinical high-touch surfaces, you generally want an EPA-registered disinfectant applied with the label’s contact time. The right program uses both, in the right places, rather than picking a side.

Why would I choose encapsulation over hot water extraction for carpet?

Because you’re running a clinic, not a hotel. Encapsulation uses very little water, dries in under an hour, and puts less stress on carpet backing and adhesive. Hot water extraction can be a better choice for heavily soiled or neglected carpet, but it takes rooms out of service for most of a day. In an exam room, that’s the difference between cleaning on a Tuesday night and canceling Wednesday morning appointments.

What should we do if a patient’s information ends up in the dumpster?

Treat it as a potential breach. Document what was found, where, when, and who found it. Determine whether the information was actually accessible and to whom. Then follow your practice’s incident response procedure and consult your privacy officer or legal counsel about notification obligations. After that, fix the process that allowed it — usually the missing shred bin or the unlocked dumpster, not the individual who made a mistake.

Our office is small. Does any of this apply to us?

Yes, with proportionality. A three-provider practice doesn’t need the same volume of documentation as a hospital system, but you still need shred bins in the right places, a cleaning crew that’s been trained on confidentiality, and a schedule that reflects patient traffic rather than square footage. The scale changes. The principle doesn’t.

How do we switch cleaning companies without disrupting patient care?

Do it as a transition, not a cutover. Give the new vendor a walkthrough during operating hours so they see realistic conditions. Set a two-week overlap for the first month if you can. Get the logbook and the task list in place before the first solo shift. And put the high-touch list in writing so nothing depends on verbal instructions passed through three people.

Where to Go From Here

If you take one thing from this article, make it this: HIPAA doesn’t hand you a cleaning checklist. It hands you a responsibility, and cleaning is one of the places where that responsibility either gets met or quietly doesn’t.

The five signs, one more time, compressed:

Unrestricted access with no paperwork. You can’t name everyone who has a key, and your vendor can’t produce background checks or a confidentiality policy.
Trash leaves the building with no disposal policy. No shred bins where PHI gets printed, open dumpsters, cleaning crews consolidating everything into one bag.
No documented training or logs. You can’t prove anything happened on any specific night.
Disinfectants used wrong. No dwell time, cross-contaminated cloths and mop water, and no clear answer about which products are EPA-registered and where they’re used.
A schedule built for an office. High-touch surfaces in exam rooms that never get touched, restroom frequency that ignores patient volume, and a cleaning window that collides with your staff.

Start with the checklist. Walk your building. Give yourself an honest grade. If you find two or three problem areas, you probably don’t need to fire anyone this week — you need to have a specific conversation with your vendor and see how they respond. Vendors who can produce logs, training records, and a written high-touch list are worth keeping, and you should pay them accordingly. Vendors who can’t produce any of that are telling you something.

And if you’d rather just have someone look at it with you, we’re happy to help. Executive Cleaning Services offers free estimates for medical offices, clinics, and other facilities across Eugene, Springfield, and the rest of Lane County. We’ll walk your space, look at your schedule, and give you a straight assessment — including the parts you might not want to hear.

Give us a call, or visit ecseugene.com to set up a walkthrough. Your patients won’t notice a clean clinic. They’ll notice a dirty one, and they’ll remember.