Sales reps are no longer simply the people who sell you your phaco machines, C-arms and endoscopes. The rapidly advancing technologies in surgical devices mean they've also become the people who guide you, your surgeon and your OR staff through the implementation and usage of the equipment. Oftentimes this necessitates your rep's presence in the OR during surgery. But what does this mean for patient privacy?

HIPAA's basics
First, you must contend with HIPAA privacy rules, which are intended to prevent the disclosure of protected health information without a patient's authorization or other written permission to individuals not considered healthcare providers. Certainly, having a sales rep in the OR could be construed as encompassing the perioperative technical assistance provided by a non-medical professional. But while medical device manufacturers fall under the broad definition of healthcare providers, and neither HIPAA rules nor relevant case law require authentication of a sales rep's role in the OR, prudence dictates that the surgeon document in the chart or medical record the clinical need for the professional's presence in the OR.

It's fairly simple to meet the federal burden: As long as you exercise good-faith documentation of a sales rep's OR presence, you're in the clear. But HIPAA's rules represent only the minimum standard for health privacy protections.

Principles of privacy
This was established in the case of Sanchez-Scott v. Alza Pharmaceuticals, in which a breast cancer patient visited her oncologist for a breast exam. The physician entered the room with a sales representative and introduced him as "a person ' who was looking at [the doctor's] work." The examination proceeded while the salesperson observed.

After the plaintiff discovered the salesperson's status, she brought suit claiming intrusion based upon an invasion of privacy; but the suit was dismissed as a matter of law. On appeal, the court defined intrusion as having two elements (and concluded that the plaintiff's complaint sufficiently fulfilled both): the intrusion into a private place, conversation or matter, and in a manner that is highly offensive to a reasonable person.

What does this mean for you? Well, the physician's exam room is analogous to the OR in that medical staff and others may have full access, but patients still have some expectations of privacy. It's just the details that vary. To determine whether intrusion exists, five factors must be considered:

• the degree of intrusion;
• the context, conduct and circumstances surrounding the intrusion;
• the intruder's motives and objectives;
• the setting into which the intrusion occurs; and
• the expectations of those whose privacy was invaded.

In Sanchez-Scott, the court concluded that the plaintiff's complaint had been improperly dismissed. The rep's intrusion was highly offensive, the court ruled, based on the patient's allegations that she didn't know the salesman's true identity and that she didn't consent to the presence of a non-medical professional during her examination.

You can see that, based on this case, a healthcare industry representative's unauthorized presence in the OR may constitute an invasion of privacy and that a patient may be able to sue you if this were the case. Standard general informed consents, such as those routinely signed by patients before surgery, may not be sufficient. Rather, you must obtain express, specific consent to protect against liability for the presence of non-medical professionals, perhaps especially sales reps. When it comes to a non-medical professional's presence in the OR, your written authorization should include at least the following:

• the procedure at which the non-medical professional will be present and the person's title;
• additional protected health information, or PHI, to be used or disclosed;
• who may make the use or disclosure;
• the purpose for the non-medical professional's presence and for the use or disclosure of the PHI;
• an expiration date or event that relates to the purpose of the authorization;
• the individual's signature; and
• statements regarding the individual's right to revoke the authorization, the ability of the covered entity to condition treatment or benefits on whether the authorization is signed, and the potential for PHI to be redisclosed by the recipient.

Express and specific patient consent may afford some protection, but it doesn't necessarily absolve healthcare reps of liability for actions that may be construed as falling more appropriately within the province of a trained physician. If your state's privacy laws are more specific than HIPAA's, they become the standard. Also, you need to be aware of state law protections against unlawful practice of medicine. The definition varies by state, but generally, as noted by Michael H. Cohen in Complementary and Alternative Medicine: Legal Boundaries and Regulatory Perspectives, each state statute defining the term relies on one or more of these criteria:

• diagnosing, preventing, treating and curing disease;
• holding oneself out to the public as able to perform the above;
• intending to receive a gift, fee or compensation for the above;
• attaching such titles as MD to one's name;
• maintaining an office for reception, examination and treatment;
• performing surgery; and
• using, administering or prescribing drugs or medicinal preparations.

Ensure that a patient gives informed consent specifically regarding the presence of a sales rep in the OR. If it could reasonably be assumed that he's there to practice medicine, you could violate practice of medicine laws. Consult your counsel for details on your state's laws.

The presence of reps in ORs is a necessary but precarious byproduct of the advancements of medical technology and services. It could expose your facility staff to civil and criminal penalties ranging from improper disclosure of protected health information and invasion of privacy to unlawful practice of medicine and falsifying business records. To reduce this liability and promote patient safety, adopt specialized consent forms and a written policy that establishes pre-requisites for representative visits and limits their presence in the OR during surgery to teaching- or analysis-related tasks.