Italy fines IQVIA $7.8 million over health data that could be re-identified
Summary
Italy’s data protection authority fined IQVIA €7 million after finding its health-data practices could enable re-identification of about one million patients, and ordered the company to comply within 120 days.
Key points
- The Italian Data Protection Authority found IQVIA’s database contained health information from about one million patients across 800 general practitioners.
- Persistent patient codes combined with detailed medical and location data could enable patients to be tracked and re-identified.
- Records for 3,300 patients also included names, tax identification numbers, addresses, and contact details.
- The authority said IQVIA lacked an appropriate legal basis and did not inform patients; it also found no adequate data-retention periods, with records dating to 2001.
- IQVIA was fined €7 million ($7.8 million) and ordered to bring its practices into compliance within 120 days.
- IQVIA said it had taken steps to align with the authority’s guidance and reserved the right to appeal.
Article Details
- Event Type
- Data protection enforcement action
- Impact
- Italy's Data Protection Authority fined IQVIA €7 million ($7.8 million) and ordered it to bring its practices into compliance within 120 days. The authority found that health records for roughly one million patients could allow reidentification; records for 3,300 patients also contained direct identifiers. The article does not report an actual data exposure.