Yes, it is illegal for pharma and device reps to collect PHI (protected health information). It's illegal for them to do so because they are not a covered entity, they are manufacturers. There's a big difference between the two.
http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/usesanddisclosuresfortpo.html.
Dealers/Providers are covered entities, along with their employees, and they are allowed to see, collect and utilize PHI when necessary (discussing patient outcomes, dispensing an Rx, etc.). Dealers/Providers are Medicare accredited healthcare providers and manufacturers (pharma and/or device) are not. Two entirely different entities with different roles in the Rx spectrum. Device/pharma reps detail the product in hopes when the Rx is sent to a provider it is branded with their product.
It is very illegal for Coloplast and Bard to collect Rx's and it will come to a stop very soon, just as it did with Hollister and Convatec in ostomy in late 2014. Do you think that Hollister made the decision to essentially stop collecting Rx's in the form of Secure Start because it was a wise business decision? No. They stopped because the OIG said enough is a enough. Manufacturers cannot and should not collect Rx's. Can you imagine a physician writing an Rx for a patient and sending the order to Merck or Pfizer? It's only generally accepted now because Coloplast and Bard were losing orders hand over fist to Cure and PECO, so they caused mass confusion for MAs (not a difficult thing to do, BTW).