Cleaning Crews or Janitorial Staff are not Business Associates.  Why?

They are not hired to create, receive, maintain or transmit patient information.  They are hired to clean your messy office.  They may come across PHI if you leave it out or accessible.  HIPAA requires that you lock up paper charts, password protect and enable auto-logoff on computers, and shred or store paper containing PHI in locked drawers.