IQVIA fined $7.8 million for failing to properly anonymize health data

IQVIA's Italian division created a large database containing health data of approximately one million patients aggregated from 800 general practitioners. Although pseudonymization was applied via unique codes instead of names, the codes combined with detailed demographic and medical data allowed potential re-identification of individuals. The company also processed data without appropriate legal grounds or informing patients, breaching GDPR requirements. Furthermore, IQVIA lacked defined data retention policies, retaining records dating back to 2001. For a small subset of 3,300 patients, identifiable information such as names and tax IDs was included. The Italian Data Protection Authority imposed a €7 million fine and mandated corrective actions within 120 days. IQVIA maintains it uses robust safeguards and is working to align with regulatory guidance.

The poor anonymization practices exposed approximately one million patients to the risk of re-identification, potentially compromising their sensitive health information. The processing without legal basis and lack of patient notification violates GDPR, exposing IQVIA to regulatory penalties and reputational damage. Inclusion of personally identifiable information for a subset of patients further increases privacy risks. The prolonged retention of data without defined limits exacerbates compliance issues.

The Italian Data Protection Authority has ordered IQVIA to bring its data processing practices into compliance within 120 days. IQVIA is cooperating with the authority and has begun adopting measures to align with GDPR requirements. Organizations handling similar data should ensure proper anonymization techniques that prevent re-identification, establish clear legal bases for processing, inform data subjects, and implement strict data retention policies. Since this is a regulatory enforcement action rather than a software vulnerability, no software patch is applicable.