IQVIA fined $7.8 million for failing to properly anonymize health data
Italy fined IQVIA $7.8 million for weakly anonymizing health data on about one million patients.
Italy's Data Protection Authority fined IQVIA €7 million, about $7.8 million, after finding its Italian division built a database on roughly one million patients by aggregating records from 800 general practitioners. Investigators said patient codes, combined with birth year, sex, diagnoses, prescriptions, tests, vaccinations, and location data, could track and reidentify people, while about 3,300 records also contained names, tax IDs, addresses, and contact details. The authority cited missing legal basis, failure to inform patients, and no retention limits, with records dating to 2001, and ordered compliance within 120 days. IQVIA said the dataset is not used for clinical trials, cited pseudonymization and encryption, and reserved the right to appeal.
- Italy's GPDP fined IQVIA €7 million, about $7.8 million.
- The database covered roughly one million patients from 800 general practitioners.
- Codes plus clinical and location details could reidentify patients over time.
- About 3,300 records also held names, tax IDs, addresses, and contact details.
- IQVIA has 120 days to comply and said it may appeal.
- Organizations
- IQVIAItalian Data Protection Authority
- Countries
- Italy
From the original article
2 min read at bleepingcomputer.com
Italy's Data Protection Authority (GPDP) has fined IQVIA €7 million ($7. 8M) over poor data-processing practices that the agency says could have put roughly one million patients at risk of data exposure and de-anonymization. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.