Q&A: Protecting privacy when drug reps are visiting
Physician Practice Insider, September 8, 2015
Q: When a drug representative enters a facility, he or she can easily be exposed to protected health information (PHI). Would that fall under healthcare operations, or is the covered entity expected to get a business associate agreement (BAA) for every drug company rep that comes through the door? Also, what is the difference between a drug rep and a medical device rep? Is the device rep providing healthcare while the drug rep is simply selling a product?
A: The drug rep should not have access to any patient information. He or she may overhear information about patients, but this is considered incidental disclosure. Care should be taken to limit such disclosure, such as meeting with the drug rep in a private office, rather than in a busy clinic. Your organization does not need to have a BAA with drug representatives.
A medical device representative may have more involvement in a specific case, such as discussing a patient to determine the most appropriate implant.
Your organization should have a BAA with the medical device company, since it may have access to PHI to provide a service on your behalf. You may ask individual representatives to sign a confidentiality agreement, but this is not required.
This question was answered by Mary D. Brandt, MBA, RHIA, CHE, CHPS, a healthcare consultant specializing in healthcare regulatory compliance and operations improvement. This question originally appeared in the September issue of Briefings on HIPAA.
Related Products
Most Popular
- Articles
-
- Math can be tricky: TJC corrects ABHR storage requirement
- Air control equals infection control
- Don't forget the three checks in medication administration
- Residency coordinators’ responsibilities
- Study: Shorter shifts reduces residents’ attentional failures
- RPA Subscriber Exclusive: February issue of Residency Program Alert now available
- Note similarities and differences between HCPCS, CPT® codes
- OSHA HazCom updates include labeling, SDS requirements
- Practice the six rights of medication administration
- The consequences of an incomplete medical record
- E-mailed
-
- Air control equals infection control
- OSHA HazCom updates include labeling, SDS requirements
- Tip: Note new thyroid imaging codes
- Tim Porter-O'Grady sounds off
- Skills of effective case managers
- Q: Can you clarify the reporting of dates on the plan of care for diagnosis onset and exacerbation?
- Q&A: Defining Subacute
- Q&A: Are colleges sending students to our facility for rotations business associates?
- Note similarities and differences between HCPCS, CPT® codes
- Fracture coding in ICD-10-CM requires greater specificity
- Searched