Italy’s data protection authority has fined IQVIA €7 million, approximately $7.8 million, over its handling of patient information. The IQVIA data privacy fine follows findings that health records described as anonymous could still allow individuals to be identified.
The regulator, known as GPDP, examined a database containing information about roughly one million patients. IQVIA’s Italian division assembled the records using data from approximately 800 general practitioners.
However, the authority concluded that replacing patient names with unique codes did not adequately anonymize the information.
Detailed Records Made Patients Potentially Identifiable
According to the regulator, each patient’s code allowed their records to be tracked over time. Combined with detailed medical and demographic information, that continuity created a risk of reidentification.
The database included birth years, sex, diagnoses, symptoms, prescriptions, tests and vaccination information. It also contained location data.
Consequently, investigators found that someone using reasonable means could single out individual patients and potentially establish their identities.
The findings concern inadequate anonymization and data-processing practices. They do not establish that attackers stole the database or that anyone actually reidentified the patients.
Regulator Finds Additional Problems With Data Handling
Beyond the anonymization weaknesses, GPDP found that IQVIA processed patient information without an appropriate legal basis. The company also failed to inform patients about that processing, according to the authority.
In addition, investigators found no properly established or applied retention periods. Some records dated back to 2001.
A smaller group of approximately 3,300 patients had directly identifying information in the database. Those records included names, tax identification numbers, addresses and contact details.
Together, these findings expanded the case beyond whether the coded health records met the standard for anonymous information.
IQVIA Receives 120 Days to Address Findings
Italian authorities investigated IQVIA’s practices in April 2025 and reached their decision in September 2026.
Alongside the IQVIA data privacy fine, the regulator ordered the company to bring its processing practices into compliance within 120 days.
IQVIA provides healthcare analytics, technology and clinical research services internationally. However, the decision concerns the specific dataset examined by the Italian authority.
The company said that dataset does not support its clinical research services or clinical trials conducted on behalf of sponsors.
Company Says It Has Taken Corrective Steps
In its response, IQVIA acknowledged the decision and said it reserves the right to appeal.
The company also said it continues to cooperate with the regulator and has already taken steps to align its practices with the authority’s guidance.
Meanwhile, IQVIA pointed to safeguards including pseudonymization and encryption as part of its approach to protecting healthcare information.
The central issue remains whether the records could identify individuals despite those protections. In this case, the regulator concluded that patient codes and detailed supporting information left that possibility open.
0 responses to “IQVIA Data Privacy Fine Reaches €7 Million Over Health Records”