Healthcare Data Company Penalized for Inadequate Patient Record Protection

Italy's Data Protection Authority issued a €7 million fine to IQVIA for failing to properly anonymize health information from approximately one million patients despite claims of de-identification. Although the company replaced patient names with unique codes in records aggregated from 800 general practitioners, investigators determined the coding combined with detailed clinical and demographic information could reliably re-identify individuals. Beyond the anonymization failure, IQVIA also processed health data without proper legal authorization, failed to notify patients, and maintained records dating back to 2001 without defined retention policies.

The investigation uncovered a fundamental flaw in IQVIA's anonymization strategy. Although patient names were removed and replaced with codes, the combination of demographic details—including birth year, sex, location—with extensive clinical information such as diagnoses, prescriptions, and vaccination records created a dataset from which individuals could be reliably re-identified using standard analytical methods. This approach fell short of true anonymization standards required under European data protection law.

The violations extended beyond inadequate anonymization practices. IQVIA lacked a valid legal foundation for processing the health information and failed to notify the affected patients of data collection. Additionally, the company maintained records spanning over two decades without implementing any systematic data retention or deletion policies, storing information from 2001 onward with no defined endpoints.