On September 23, 2026, Italy’s privacy regulator fined IQVIA Solutions Italy €7 million over a research database containing records for approximately one million patients of 800 family doctors. IQVIA said the records were anonymous. The regulator found that patients remained identifiable.
The database was supposed to let researchers follow patients’ medical histories without learning their identities. Software would remove identifying information before records left doctors’ systems. IQVIA would use the resulting histories for research, and pharmaceutical sponsors would receive aggregate study reports.
The investigation exposed two problems. The remaining clinical histories could still identify patients when combined with other information. Separately, the extraction software had allowed names and other direct identifiers to pass through.
The Database Connected Care Over Time
A research database of this kind brings together information collected during ordinary care so researchers can study patterns across many patients. Instead of recruiting patients for a new experiment, researchers can examine existing diagnoses, prescriptions, tests, and visits.
Keeping one patient’s records connected makes longitudinal research possible: researchers can follow changes over time. They can study treatment patterns or examine what happened after a prescription. Those questions require knowing that several records concern the same person. They do not necessarily require knowing that person’s name.
IQVIA’s Italian database, called Longitudinal Patient Data, preserved those connections through a patient code. According to the Italian decision, its tables included demographic information, prescriptions, diagnoses, examinations, and visits. One example shown to inspectors linked 34 prescription entries to the same patient.
The privacy objective was straightforward: preserve the medical history while preventing the organizations using it from identifying the patient.
Software Was Supposed to Remove Identity Before Transfer
An add-on installed in participating doctors’ practice-management software extracted the records. IQVIA commissioned the add-on’s installation and paid for the doctors’ software subscriptions.
IQVIA described the add-on as removing names, surnames, and addresses. It also described changing birth dates to the first day of the relevant month, preserving month and year while concealing the actual day.
The add-on assigned a randomly generated patient code. IQVIA said the code was generated without using the patient’s personal characteristics. It connected successive records for that patient without displaying a name.
IQVIA’s account of its processing described two subsequent paths. Extracted records entered a temporary database. One path produced files supplied to SIMG, the Italian association of general practitioners and primary-care doctors involved in the project. The other applied further privacy measures, standardized the information, and assigned an internal patient code before loading IQVIA’s final research database.
These were patient-level records, often called microdata: information about individual patients, even when their names had been removed. IQVIA held those records, and SIMG received separate extracts for scientific use. The published decision does not supply a complete inventory of the employees or contractors authorized to access each database.
Pharmaceutical Sponsors Received Study Results
IQVIA told investigators that it used the database for retrospective observational studies requested by pharmaceutical companies and supplied those companies with aggregate reports.
An aggregate result describes a group. For example, a report might state how many patients received a treatment or what percentage later underwent a test. That differs from supplying the sequence of prescriptions and diagnoses associated with each patient code.
This arrangement placed different protections at different stages. Removing identifiers was supposed to protect the records collected for research. Supplying aggregate results was supposed to keep pharmaceutical sponsors from receiving individual histories.
The published decision does not establish the minimum group size or other disclosure rules used for those sponsor reports. Its requirement for groups of at least 10 appears in a prospective alternative method for anonymizing records supplied to IQVIA. It does not establish that the existing reports suppressed every result involving fewer than 10 patients.
That distinction matters. A safeguard governing the final report cannot establish that the patient-level database used to prepare it was anonymous.
The Assessments Missed Information That Could Identify Patients
IQVIA supplied two assessments of re-identification risk, carried out by a company within its own group. They used a method called k-anonymity, which checks whether a person shares a selected combination of characteristics with a sufficient number of others. Age and location are examples of characteristics that can identify someone indirectly when combined.
The regulator’s objection was that this protection covered selected characteristics rather than everything in the record. Patients grouped together by age and location could still have distinctive diagnoses, medication patterns, or sequences of hospital admissions. Those remaining details could identify them if matched with information available elsewhere.
A persistent code preserved the connection among those details. Concealing the code’s connection to a name did not conceal the medical history itself. Hashing the code would not remove distinctive information elsewhere in that history.
The finding therefore rested on the information available to IQVIA and the means reasonably available to identify patients. A persistent identifier was part of that analysis; its presence alone was not the entire test.
The assessments also did not substitute for a data protection impact assessment, or DPIA. A DPIA examines the wider operation, its risks to people, and the measures needed to address them. IQVIA told inspectors that its DPIA was being prepared. The Garante found that it had not been completed and that this violated the GDPR.
Direct Identifiers Escaped Through Free Text
A separate failure emerged after the inspections. IQVIA discovered identifying information inside free-text fields extracted from doctors’ records, concerning patients and a limited number of doctors. The software had not removed it before transfer.
The Italian decision records directly identifying information for 3,370 patients, including health information for 3,080. It describes information such as names, dates of birth, tax identification numbers, addresses, email addresses, and telephone numbers; the EDPB’s account of the decision reports the same figures.
Those records reached IQVIA and were also sent to SIMG. IQVIA reported the incident as a personal data breach; SIMG subsequently confirmed that it had removed the identifying information at IQVIA’s request.
The regulator held IQVIA responsible for ensuring that its extraction process excluded the inappropriate information. Doctors were recording information for patient care. IQVIA needed to verify what its research software took from those records.
The published findings do not establish that identifying information appeared in pharmaceutical sponsors’ aggregate reports. They do establish an actual unauthorized flow of identifying information to IQVIA and SIMG. The case therefore involved both inadequate protection against re-identification and a concrete failure to remove direct identifiers.
The Anonymity Claim Left Required Protections Missing
The Garante’s announcement identifies failures extending beyond the anonymization method. IQVIA lacked an appropriate legal basis, had not adequately informed patients, had not established suitable retention arrangements, and had not implemented adequate security. Some records dated to 2001.
The regulator also treated IQVIA as responsible for the processing from collection at the doctors’ offices. IQVIA could not assess its obligations solely at the point when the transformed information reached its final database. Anonymizing personal information is itself a processing activity requiring a lawful basis.
The order allowed a route to continue under the requirements for personal health data. It also described an alternative involving independent anonymization by the doctors, with specified safeguards. Research could continue, but the information’s legal treatment had to match what the protections actually achieved.
France Involved Authorized Personal Health Databases
Several months earlier, CNIL fined IQVIA Operations France €5 million. Its May 26, 2026 decision concerned two different databases: LRX, drawing on pharmacy records, and EMR, drawing on doctors’ records.
CNIL had authorized their establishment in 2018 and 2021 respectively. These were regulatory authorizations to process personal health data, subject to safeguards. Replacing direct identifiers with codes reduced exposure while keeping the data subject to privacy requirements.
Investigators found that those safeguards did not work as required. Neither database had adequate regular analysis of connection logs to detect abnormal activity. EMR lacked multifactor authentication, had inaccurate patient information, and lacked an effective objection procedure.
CNIL also found that four inspected pharmacies had not informed customers about transfers to IQVIA. Pharmacy software transmitted data even when patients refused. CNIL expressly treated that design failure as a GDPR violation.
During the proceedings, IQVIA argued that the information was anonymous and that data-protection rules therefore did not apply. It invoked the European court’s SRB judgment of September 4, 2025 concerning whether coded information remains personal data for a particular recipient.
CNIL rejected the defense because the records combined unique patient identifiers with extensive clinical and demographic detail that could be matched with publicly available information. The code alone did not supply the whole explanation. The connected information made identification possible using reasonable means.
CNIL noted that IQVIA had previously accepted that it processed personal data and obtained authorizations on that basis. The anonymity defense did not remove the obligations attached to the actual processing. Security deficiencies were corrected during the proceedings; CNIL ordered further corrections to the outstanding EMR notice and objection arrangements.
