Health data of one million patients exposed; Iqvia faces a fine of 7 million
According to the Data Protection Authority, it would have been possible to identify and re-identify individual patients using information contained in a database. The company reserves the right to lodge an appeal
From year of birth to gender, including diagnoses, symptoms, prescriptions, tests, vaccinations and location data. Information on health of one million patients treated by 800 GPs, stored in a database maintained by Iqvia Solutions Italy, was reportedly not anonymised. For this very reason, the company – part of a multinational group active in healthcare data analysis and clinical research – was fined seven million euros by the Italian Data Protection Authority. The dataset is said to have been used for studies commissioned by pharmaceutical companies, and is reported to have included identifying information such as names, tax codes, addresses and contact details of over 3,300 patients, of whom more than 3,000 had their health data included as well.
The story
According to the Data Protection Authority’s analysis, the code assigned to each patient would have made it possible to track them over time and, thanks to the information contained in the database, it would therefore have been possible to isolate and re-identify individual patients ‘by reasonable means’.
The authority also accuses the company of processing health data without a suitable legal basis and without adequately informing patients. Furthermore, Iqvia is said not to have defined the retention periods. The data, in fact, dated back as far as 2001. Finally, according to the Data Protection Authority, no data protection impact assessment was carried out and no adequate security measures were put in place.
In a statement, the Data Protection Authority has clarified that, should the company wish to continue its activities, it must bring its data processing practices into line within 120 days, in accordance with the Authority’s requirements. Otherwise, the anonymisation must be carried out independently by the doctors, in accordance with the safeguards set out by the Data Protection Authority.
Iqvia’s response
Iqvia has announced that it ‘reserves the right to appeal’. In its defence, the company explained that the dataset referred to by the Data Protection Authority is not used in the provision of clinical research services and is not related to the conduct of clinical trials on behalf of sponsors.
