Medical, Dental, and Med Spa Cleaning in NJ: What EPA Registration Actually Guarantees, and What to Require From Your Vendor

By Chris, Owner

Published August 31, 2026

A cleaning company tells you it uses hospital-grade disinfectants. The phrase does not identify the product or the organisms its label covers. "EPA-registered" is a verifiable property of a product, not a claim about a vendor. What determines whether disinfection actually happens in your practice is the registration number, the label, the contact time, and what the contract says the crew is responsible for. Ask for the first three and read the fourth.

Reading the bottle: registration number, label, and kill claim

Disinfectants are regulated as antimicrobial pesticides under FIFRA, and any product carrying a pesticidal claim must be registered before sale. Under 40 CFR 156.10(a)(5) it is a prohibited misleading statement to imply a pesticide is endorsed by a federal agency, or to call one safe or nontoxic to people and pets even when qualified by "when used as directed."¹

The registration number. A primary number has two parts, company and product, as in EPA's example, 6767-3.² A supplemental distributor's number adds a third, such as 262-598-10007, and is a duplication of the basic registered product. EPA's lists publish only the first two sets, so a bottle reading 12345-12-2567 matches a list entry of 12345-12.³ The establishment number printed alongside it identifies the production facility, not the product's claims.

The label is the controlling legal document. Using a registered pesticide inconsistently with its labeling is a federal offense under FIFRA 12(a)(2)(G), and FIFRA 2(p) extends "labeling" to technical bulletins the label references.⁴ Contact time, dilution, surface type, and use site are legal requirements, not suggestions.

Kill claims are approved one organism at a time. A registrant wanting a claim for a public health microorganism beyond the product's basic efficacy testing must submit testing for that organism, so an approved claim exists only in complete form: organism, product, contact time, surface.⁵ Hold that against "kills 99.9% of germs." No organism is named, so nothing in it can be looked up. That is reasoning from the per-organism rule, not an EPA statement about the phrase.

List B is tuberculocidal; bloodborne pathogens moved to List S

EPA maintains lettered lists of registered products grouped by the organism they carry an approved claim against. List B is the tuberculocidal list, covering Mycobacterium tuberculosis.⁶ The bloodborne pathogen list, covering HIV, HBV, and HCV, is List S, created February 26, 2024 by consolidating four older lists (C, D, E, and F) now retired and redirected to it.⁷

Other active lists cover Clostridioides difficile spores (K), Candida auris (P), norovirus through a feline calicivirus surrogate (G), and MRSA and/or VRE (H), where a listed product may cover only one.⁸ List Q is different in kind, covering pre-approved emerging viral pathogen claims usable only once EPA activates that guidance for an outbreak.⁹

Inclusion means EPA reviewed laboratory data demonstrating the product kills the named organism and that the label carries directions for it. It does not mean endorsement, exhaustiveness, or that the product works as applied in your building.⁸ If a label does not include disinfection directions for a pathogen, EPA has not reviewed any data on whether the product is safe and effective used that way.

To check a product, search the first two number sets on the relevant list page, then return to the label and confirm it carries directions for that pathogen. The Pesticide Product Label System holds approved labels searchable by registration number, independently of the manufacturer.¹⁰

Why no contract can name a single contact time

Contact time, sometimes called dwell time, is how long the product must stay on the surface undisturbed for the claim to hold, and it is set per product and per organism. Under 40 CFR 158.2220 an applicant must demonstrate through testing that the product is efficacious when used according to label directions, so a different dilution, organism, or exposure time is a different dataset.¹¹ A single approved label routinely specifies a different contact time for each organism it covers, and a vendor that substitutes products can change the required contact time even when the cleaning scope does not change.

EPA instructs that the surface remain wet the whole time.¹² CDC adds the operational rule: if the surface is no longer visibly wet and the contact time has not passed, reapply, and do not wipe or blow it dry faster.¹³

Volume delivered to the surface is a separate constraint from the clock. In testing across ten ready-to-use towelette products, the area wiped significantly affected how much liquid was released per square foot, with higher log reductions at one to two square feet than at eight.

"Hospital disinfectant" has a definition. "Hospital-grade" does not.

"Hospital disinfectant" is an EPA registration category. Per EPA's Pesticide Registration Manual it is a general or broad-spectrum disinfectant that is also effective against the nosocomial bacterial pathogen Pseudomonas aeruginosa.¹⁴ "Hospital-grade" and "hospital-level" are a different matter: they do not appear in EPA's registration categories or in its product performance test guidelines, and no efficacy requirement attaches to them.

If a vendor means the registered claim, you have learned that the product passed testing against S. aureus and P. aeruginosa, the entire content of the category, and nothing about which product it is or what else its label covers. EPA's position is that a product can only be identified by its registration number, and EPA does not license companies that provide cleaning services.¹⁵

CDC's dental guidance ties the low- and intermediate-level distinction to a label claim: low-level disinfectants are EPA-registered without a tuberculocidal claim, intermediate-level disinfectants with one.¹⁶ Killing M. tuberculosis is a benchmark for how well a disinfectant kills organisms generally, not a sign that TB spreads on surfaces.

Drawing the line at instruments and reprocessing

The line between housekeeping surfaces and clinical-contact surfaces, and how it affects scope and price, is laid out in the medical and dental housekeeping section of our pricing guide.

The boundary is also jurisdictional. A cleaning vendor works on noncritical environmental surfaces, EPA territory. High-level disinfection and instrument reprocessing are FDA-regulated device territory and are the practice's own responsibility, under an EPA and FDA memorandum of understanding CDC describes directly.¹⁷ In a contract the line should be named rather than implied: instruments, sterilization equipment, items that contact mucous membranes or breach skin, sharps, and regulated medical waste sit outside routine janitorial scope unless separately defined and separately scoped with matching bloodborne pathogen protections, which is uncommon.¹⁸

New Jersey adopts the federal standard, then adds four things

New Jersey sets no distinct environmental-cleaning standard for medical, dental, or med spa practices, for different reasons in each. Dentistry adopts the federal one by incorporation by reference: N.J.A.C. 13:30-8.5 requires dental licensees to comply with OSHA's bloodborne pathogens standard at 29 CFR 1910.1030 and with CDC's recommended infection control practices for dentistry.¹⁹

Who can act on a failure. That places the federal standard inside the licensure rule, enforceable through the dental licensing board as well as OSHA.

A training duty of its own. N.J.A.C. 13:30-8.5A, adopted in 2021, requires licensed dentists to provide or make available infection prevention training every biennial renewal period to personnel involved in patient-related sterilization, patient care, or maintaining equipment, on topics including methods ensuring environmental surfaces are safe.²⁰ Whether an outside janitorial crew counts as "personnel" is not resolved in the rule text, and no Board guidance addresses it. The duty sits on the dentist, so a vendor whose staff work in operatories creates an oversight question the practice owns.

Med spas. New Jersey has no med spa license and no med spa cleaning rule; regulation follows the service performed. N.J.A.C. 13:35 carries no general cleaning or infection-control rule for a physician's office, and 13:35-4A.4 reaches only offices doing surgery beyond minor surgery, special procedures, or anesthesia, requiring only a written policy.²¹ The Board of Cosmetology's rules are prescriptive: implements processed with an EPA-registered tuberculocidal disinfectant or an FDA-registered autoclave,²² floors in a licensed shop cleaned daily.³⁹ The exemption at N.J.S.A. 45:5B-7 lists physicians, nurses, and other practitioners, and an esthetician doing facials in the same suite is not among them, so those services stay within the cosmetology rules and carry a tuberculocidal standard the medical services do not.²³ Where both coexist, identify which regime attaches to which service.

Regulated medical waste. Under N.J.A.C. 7:26-3A a generator registers annually with NJDEP, completes a six-part New Jersey tracking form for each shipment, and retains each form three years.²⁴ Red-bag waste moves on a state manifest the generator signs, and a cleaning contractor cannot lawfully absorb it into general waste removal.

Put the operating rules in the contract

In a 2017 letter of interpretation on contracted workers, OSHA treats bloodborne-pathogen protections as a joint responsibility whose allocation "should be specified through contractual agreements."²⁵ A practice can require the following.

Products by registration number. The EPA registration number of every product the crew brings in, plus membership on the lists matching your risks, for example List B and List S. Notice before a substitution is a drafting choice rather than a mandate.
Contact time governed by the approved label. The defensible clause names a product and an organism: the vendor shall use the named EPA registration number according to its label directions, including the label's contact time for that organism, and keep the surface visibly wet for that duration.
Safety data sheets on file. Under 29 CFR 1910.1200(e)(2) an employer whose chemical use may expose another employer's employees must already have written methods for on-site SDS access, so this tracks an existing duty rather than asking a favor.²⁶
Execution against a written cleaning schedule. OSHA's housekeeping provision at 29 CFR 1910.1030(d)(4) requires the employer to implement a written cleaning and decontamination schedule based on location, surface type, soil type, and the procedures performed there.²⁷ That duty sits on the practice; requiring the vendor to execute and document against it is how the practice discharges it.
Training records in the federal format. From 1910.1030(h)(2): dates, contents, trainer names and qualifications, attendee names and job titles, retained three years.²⁷
A scope exhibit by area and owner. Four columns cover it: area, task, frequency, and owner (vendor or clinical staff), with the clinical exclusions above written in.
Crew protections owed by the vendor. Bloodborne pathogen training at hire and annually, a written exposure control plan covering the assigned crew, hepatitis B vaccination at no cost, and PPE at no cost are the vendor's obligations as the crew's employer. Whether the standard reaches a given crew is task-based rather than title-based: OSHA defines occupational exposure as reasonably anticipated skin, eye, mucous membrane, or parenteral contact with blood or other potentially infectious materials, and includes saliva in dental procedures.²⁸
Proof of workers' compensation coverage. New Jersey employers not covered by federal programs must carry it or be approved for self-insurance.²⁹ No standard sets dollar amounts for other coverage, and a figure quoted as the industry standard for healthcare cleaning came from a broker rather than a regulator.
Completion records, described accurately. Visit logs, checklists, and audits are useful contract controls modeled on CDC program elements. Federal law does not impose a general office-based requirement that a cleaning vendor maintain a visit log.

What you cannot contract away is your own site-specific training duty. OSHA's 2017 letter on contracted workers places it with the host, and OSHA's position is that legal responsibility cannot be subcontracted, only specified in a contract.³⁰

Bergen Commercial Cleaners writes the cleaning checklist into the contract by room type, documents each visit, keeps those clinical items outside routine crew scope, and approves scope changes before they take effect.

Five claims no agency can back

Vendor claim	What the agency says, and what to accept instead
"We are OSHA certified."	OSHA does not accredit or certify organizations or individuals, and an OSHA card is course completion.³¹ A vendor can say named crew members completed OSHA 10-hour or 30-hour Outreach training.
"We are OSHA compliant."	Not false by definition, but nobody can issue it: compliance is determined retrospectively by inspection. Ask for the exposure control plan, training records in the federal format, and the SDS program.
"Our cleaning is HIPAA compliant."	HHS and OCR state they do not certify persons or products as HIPAA compliant.³² HHS also addresses janitorial services by name: a business associate contract is generally not required where the service does not involve use or disclosure of protected health information.³³ A vendor offering one as a selling point is worth a question.
"CDC approved" or "CDC compliant."	CDC does not endorse commercial organizations, and publishes guidance rather than a standard a company is adjudicated against.³⁴ "Our written procedures follow CDC guidance" is accurate and checkable.
"We guarantee a sterile environment."	Sterility is defined for items processed through a validated process and is described as a probability function, not a state an occupied room can be in.³⁵ Environmental surfaces are noncritical under Spaulding, needing low-level disinfection, and surface products are registered as disinfectants, not sterilants.³⁶

Real third-party credentials do exist. CIMS, from ISSA, certifies organizations; CHEST, from the Association for the Health Care Environment, certifies individual technicians.³⁷ Both are trade credentials, not government approval.

Frequently asked questions

Is List B the bloodborne pathogen list?

No. List B is the tuberculocidal list. List S covers HIV, HBV, and HCV, and replaced retired Lists C, D, E, and F in February 2024.

What is the difference between a disinfectant and a sanitizer on a label?

EPA defines a sanitizer as reducing the bacterial population by significant numbers without eliminating all bacteria, and a disinfectant as destroying or irreversibly inactivating bacteria, fungi, and viruses, though not necessarily spores. If your scope calls for disinfection and the cart holds a sanitizer, the two do not match.

Does New Jersey license commercial cleaning contractors?

No. There is no state board or registration program for janitorial or building maintenance work, and the Contractors' Registration Act reaches residential home improvement only.³⁸ A vendor advertising a New Jersey contractor license for commercial janitorial work is describing something that does not exist.

Getting a straight answer from a vendor

If you are evaluating a proposal, ask for the registration number of every product the crew will bring in, the labeled contact time for the claim that matters most in your treatment rooms, and a scope exhibit showing who owns each surface. Our medical and dental office cleaning scope is built around those questions, and the answers should be the same whoever you hire.