Italy fines IQVIA €7 million over patient health data privacy

Italy’s data protection authority, the Garante, has fined IQVIA Solutions Italy €7 million for the unlawful processing of health information belonging to approximately one million patients. The regulator rejected the company’s claims that the data was anonymous, determining instead that the information could be used to re-identify individuals.

The database, known as the Longitudinal Patient Database (LPD), was compiled from records provided by roughly 800 general practitioners. While IQVIA used the data for clinical research and studies commissioned by pharmaceutical companies, the Garante found that the use of persistent patient codes allowed for the linking of medical records over time. This combination of birth year, sex, diagnoses, prescriptions, and location data made it possible to single out specific patients.

In addition to the fine, the company has been given 120 days to bring its data processing methods into compliance if it intends to continue the activity. The investigation also noted that the database contained direct identifying information, such as names and tax identifiers, for more than 3,300 patients.