Short answer
At the federal level, EPA registers disinfectants and makes label directions binding. OSHA protects the staff who use them. Health care sites must meet federal infection control rules. States add rules on reporting certain diseases and license rules for schools, child care and care homes. Some states also have license rules for people who apply disinfectants for a living. Local health departments often lead the response during an outbreak. Your type of site decides which layers apply.
Why no single agency sets the rules
When an illness spreads through a building, site managers want to know what they must do. The honest answer is that it depends on three things. What kind of site do you run? Which germ is involved? And where are you?
Disinfection sits where public health, product rules, worker safety and site licensing meet. EPA decides which products can make which claims. OSHA protects the people using them. State and local health departments track and respond to outbreaks. Licensing agencies set cleanliness standards for schools, child care programs and care homes.
Mapping those layers before an outbreak helps you respond quickly. It also helps you explain your choices to parents, residents, families, staff and inspectors.
It helps to tell rules apart from guidance. A rule, such as a product label or a license standard, is something you must follow. Guidance, such as a CDC fact sheet, describes good practice. It may become expected when an agency adopts it or an inspector relies on it. Your map should mark which is which.
EPA and the product label
Under federal law, disinfectants that claim to kill germs count as pesticides. EPA explains that under FIFRA, a disinfectant must be registered with EPA before it can be sold or handed out in the U.S. More than 4,000 germ-killing products are currently registered, according to EPA.
Registration comes with an approved label. The label lists the germs the product has been shown to kill and how long it must stay wet, called contact time. It covers how to apply and mix it, what protective gear to wear and what to watch out for. Using a product in a way that goes against its label breaks federal law. That is why people in this field so often say "the label is the law."
EPA also keeps lists that help sites find products with certain claims. List G is for norovirus. List K is for C. difficile spores. List N is for the virus that causes COVID. States also register pesticides and can limit certain products.
Watch for claims that go beyond the label. A company or sales sheet may promise protection that lasts for weeks. It may claim to kill germs not listed on the label. Those are claims EPA has not approved. Ask for the registration number and read the label yourself before you rely on any promise.
OSHA rules for the staff doing the work
OSHA does not tell you which product to use against a germ. But it does require you to protect the workers who use it. Private employers are covered by federal OSHA or a state plan. Public schools and government buildings are covered only where a state plan includes public workers.
Health care workers may also be covered by extra OSHA rules, based on the germ and the setting. The breathing protection rule applies where respirators are needed.
Remember that outbreaks often bring in temporary staff, volunteers or workers from other departments to help clean. The same chemical safety training and protective gear rules apply to them. A short, well-planned briefing at the start of each shift is often the most practical way to cover everyone.
- Hazard Communication, 29 CFR 1910.1200, for training and safety data sheets on every disinfectant
- Protective gear, 29 CFR 1910.132, for a written review of dangers and the right gear
- Respiratory Protection, 29 CFR 1910.134, when respirators are required
- Bloodborne Pathogens, 29 CFR 1910.1030, where blood or certain body fluids are present
- The General Duty Clause for known dangers that no specific rule covers
Extra federal layers for healthcare facilities
Hospitals, nursing homes and many other health care providers that take Medicare and Medicaid must meet federal conditions. These include keeping a program to prevent and control infections. Inspectors review cleaning practices as part of those rules.
Products used to disinfect certain medical devices are regulated by FDA instead of EPA, based on the product and how it is meant to be used. Sites should follow device makers' instructions for cleaning devices for reuse. They should use products with the right FDA clearance.
CDC guidelines for cleaning to control infection in health care are not rules on their own. But accrediting groups and federal inspectors often use them as the measure of good practice.
What do state health departments and licensing agencies require?
State health departments set rules on which diseases must be reported. Many require sites such as schools, child care programs and long-term care homes to report possible outbreaks. Some spell out what counts as an outbreak for reporting.
Long-term care homes get special focus. Norovirus and other illnesses spread easily among residents who share dining rooms, bathrooms and caregivers. State license and inspection agencies often have detailed rules for cleaning during outbreaks in those homes.
Child care license rules often spell out how to sanitize and disinfect diapering areas, toys and food surfaces. School health rules may cover cleaning after illness. Some states also regulate paid companies that apply certain germ-killing products, through their pesticide license programs. This is most common for fogging or treating large areas. Check with your state's lead pesticide agency if you use an outside company.
The local health department during an outbreak
Local health departments are often the most important contact during an active outbreak. They may look into cases and suggest or require cleaning steps. They may advise on keeping sick people away and decide when an outbreak is over.
Their advice can go beyond what state or federal rules require. In some cases, they have legal power to require certain actions. Follow their advice, write it down and ask questions if something is unclear.
Local building and fire codes can also matter if you plan to use fogging machines or store large amounts of disinfectant. Some products can catch fire or eat through materials, and they have storage limits.
Keep a simple log of every contact with the health department during an outbreak. Note the date, the person you spoke with and what they suggested. Advice may change as the investigation goes on. If it does, the log shows when and why your cleaning approach changed.
Facility types against the layers
Your type of site decides which layers matter most. The list below is a general starting point. Your own map should include specific agencies and contacts.
Buildings with more than one use may carry more than one set of rules. Take an office building with a child care center on the ground floor. Part of the space has license duties that do not apply to the rest.
- Offices and business buildings: EPA labels, OSHA or state plan and local health department advice
- Gyms and fitness centers: add local health rules for pools, locker rooms or personal services where they apply
- Public schools: EPA labels, state plan coverage if any, state education and health rules and the local health department
- Child care programs: add state child care license rules on cleanliness
- Long-term care and assisted living: add state license and inspection rules and, where they apply, federal conditions for Medicare and Medicaid
- Clinics and hospitals: add federal Medicare and Medicaid conditions, accreditation standards and FDA rules for cleaning devices for reuse
Walking a childcare outbreak through the map
When vomiting and diarrhea spread through a child care center, take the layers in order. The state child care license rules come first. They may require possible outbreaks to be reported to the local health department. The health department may then look into it. It may suggest a chlorine-based product or another product from EPA's List G. That product is applied for its label contact time to diapering areas, toys, bathrooms and food surfaces.
The OSHA layer comes next. Review the chosen product's label and safety data sheet with staff under the center's chemical safety program. Provide gloves, gowns and eye protection for vomit cleanup. Then go back to the license rules for details. For example, toys that children put in their mouths may need to be cleaned, disinfected and rinsed before reuse.
Write down each step and the health department's advice. Then you can show a license inspector what was done and why. Families will have questions too. A short letter can describe the illness, the steps taken and when sick children may return, based on the health department's advice. That letter often matters to them as much as the cleaning itself.
Keeping your regulatory map current
Advice on specific germs can change, sometimes quickly. EPA lists are updated as products are added or removed. Health departments change their advice as they learn more. Pick someone to review your map at least once a year and after each major outbreak.
Keep contact details for your local health department, state license agency, state pesticide agency and OSHA or state plan office with your outbreak plan. Note the date you last confirmed each rule.
Rules vary by state and county; verify with the local authority. Your local health department is usually the best first call during an active outbreak. Your license agency can confirm rules for your type of site.
