- Italy’s Garante fined IQVIA Solutions Italy €7 million over health data linked to about one million patients.
- The regulator found persistent patient codes and detailed medical information could allow re-identification.
- IQVIA has 120 days to address the requirements if it wants to continue the data processing activity.
The data protection authority of Italy has fined IQVIA Solutions Italy €7 million over its handling of patient health information. The regulator said the records encompassing the information of approximately 1 million individuals failed the anonymous data test.
The database contains data from about 800 general practitioners and health-related support studies. In some instances, the data assists pharmaceutical organizations, which raises concern about the way IQVIA gathers, stores, and operates the records.
Garante Says Patient Records Could Be Re-Identified
The Italian data protection authority, Garante, imposed the fine following the research into the practices of IQVIA concerning data processing. The authority made a decision on September 23, 2026, as a result of inspections that took place in April 2025. The database consists of medical data related to around one million patients and includes data collected from roughly 800 general practitioners in Italy.
IQVIA used the information for research involving medical treatments and health outcomes. Pharmaceutical companies also commissioned some of the studies. However, the Garante rejected the position of IQVIA that the records were anonymous. Each patient received a persistent code that allowed different records to connect over time.
The database includes various information concerning each patient. Among them are year of birth, gender, diagnoses, symptoms, prescriptions, tests, vaccination data, plus location details. The regulator found that this combination could help identify individual patients. It said reasonable means could allow someone to connect the records to specific people.
Therefore, replacing names with patient codes did not make the information anonymous. The persistent identifiers still allowed researchers to follow individual records across different periods. The decision also treated IQVIA as the data controller from the moment it collected information from doctors. That finding placed responsibility for the processing directly on the company.
More Than 3,300 Patients Had Direct Identifiers
The investigation uncovered another concern within the database. In the database, over 3,300 patients’ personal identification information was available. This identification information included patient name, tax ID, phone number, and home address. In addition, 3,000 of those patients had identifiable details besides their health information.
The Garante also found personal information inside free-text fields transferred from the systems of the doctors. Other recent healthcare data breaches have also exposed information belonging to millions of patients, including the hacker claims that the Alaxione breach exposed data of 6.8 million patients.
A special software was used to screen information into the database. This was important in terms of establishing new threats to privacy. Free-form text can contain unclassified information on the system. Also, such a field may contain details that make it possible to identify someone directly.
In addition, database records date back to 2001. IQVIA had not established clear retention periods for the information. The company also failed to complete a data protection impact assessment. Moreover, the authority noted some flaws in the security of the data.
Under the General Data Protection Regulation (GDPR), data related to health has an even higher level of protection. Article 9 specifies health information to be a category of personal data requiring special & strict conditions of treatment.
The Italian authority therefore considered the nature and scale of the information when assessing the case. The regulator also considered IQVIA’s cooperation during the investigation.
Regulator Found Problems with the Legal Basis
The Garante concluded that IQVIA lacked a suitable legal basis for processing the health information. It also found that the company did not provide patients with enough information about how it used their data. This raised concerns beyond the question of whether the records were anonymous. The authority also reviewed the issues of transparency, security, retention, and accountability.
According to GDPR regulations, entities dealing with sensitive personal data of individuals must comply to a range of safety measures. Health data can support research, but organizations still need an appropriate legal framework.
In the IQVIA case, the Garante pointed out multiple breaches of GDPR provisions; these included breaches related to the legality, transparency, minimization of data, security, and privacy by design. The authority also considered the number of affected patients. The sensitive nature of the information played a major role in determining the penalty.
Furthermore, the Garante noted that doctors had stopped sending the data from 2023. It also considered the cooperation of IQVIA during the proceedings. The €7 million penalty reflects the regulator’s view of the overall processing activity. The authority said the decision also accounted for the large number of people involved.
The case shows why organizations cannot rely on simple coding when handling sensitive records. A database may remove names while still allowing individuals to become identifiable.
IQVIA Gets 120 Days to Fix the Processing
The Garante has given IQVIA 120 days to comply with its requirements if the company wants to continue processing the information. The deadline starts after the authority notifies the company of its decision. IQVIA must make changes that address the regulator’s concerns. On the other hand, the physicians may opt to anonymize the information independently before passing it for subsequent processing.
The above method brings anonymization further upstream to the point of data provision by the doctors. That approach could reduce the amount of identifiable information entering external research databases. The decision also highlights a wider issue in health data research. Research organizations usually require detailed medical data to obtain useful studies.
The details can raise privacy implications at once, especially when the data points are interconnected. The combination of diagnosis, age, location, treatment history, and other records of the patient may lead to forming an unusual identity.
Thus, it is essential for organizations to analyze the effectiveness of their security and protection levels. Simply replacing names with codes may not meet that standard. The actions of the Garante signal the importance of conducting an impact assessment for data protection. Such assessments can help organizations identify privacy risks before large databases become operational.
For IQVIA, the next step involves changing its processing practices or ending the activity under the current arrangement. The decision of the regulator makes it clear that sensitive research data still requires strong privacy controls.
