HIPAA Allows Info Sharing With Device Manufacturers

SAN DIEGO -- Under the federal Health Insurance Portability and Accountability Act, physicians are permitted to share protected health information with medical device companies, according to Robert M. Keenan, a health lawyer based in Atlanta.

The Department of Health and Human Services Office for Civil Rights, which is responsible for enforcing HIPAA privacy regulations, recognizes the need for disclosures to device manufacturers who are counseling physicians about patient care and thereby acting as health care providers. Under these circumstances, a special authorization or business associate agreement is not needed.

"Historically, physicians share information with device companies," Mr. Keenan said during the annual meeting of the American Health Lawyers Association. "Sales representatives may be experts on the use of a device, and it's common for surgeons to ask them questions about how to implant a device."

The Office for Civil Rights has provided specific guidance on this issue. For example:

PIA manufacturer's representative may be present in the operating room to provide support and guidance regarding the appropriate use, implantation, calibration, or adjustment of a medical device.

PIA manufacturer's representative may view films or patient records to provide consultation, advice, or assistance with a particular patient's treatment.

PIA "covered provider" under the HIPAA law may share protected health information--but only the necessary minimum amount--with a device company, so that the company can receive payment for health care services.