Question: Does our anesthesia group need to sign a business associate agreement (BAA) with the company that cleans our office and/ or shreds documentation? Virginia Subscriber Answer: According to the Department of Health and Human Services (HHS) Office for Civil Rights (OCR), janitorial services are not considered business associates “because the work they perform for covered entities does not involve the use or disclosure of protected health information, and any disclosure of protected health information to janitorial personnel that occurs in the performance of their duties” is limited in nature. The example used by the OCR is emptying trash cans. Your staff should make sure not to leave any patient information out in areas where the cleaning company has access, and all computers need to be turned off or inaccessible to anyone outside the clinical staff. However, the company that shreds documents should have a BAA as should anyone outside your group with access to protected health information (PHI). Tip: Provide staff training and check BAAs on a regular basis to ensure continued compliance. For further study: Go to this HHS HIPAA FAQ.