Click here to open the filter panel
F
Fairness and transparency
F
Federated learning
F
Filing system
F
First-in-class drugs
F
Food and Drug Administration (FDA)
F
Fundamental rights impact assessment (FRIA)
G
General Data Protection Regulation (GDPR)
G
General-purpose AI model (GPAI)
G
Genetically modified organism (GMO)
G
Genetic data
G
Global public health security
G
Good clinical practice (GCP)
H
Health data warehouse (HDW)
H
High-risk AI system
H
HIPAA (Health Insurance Portability and Accountability Act)
H
Human oversight (AI Act)
H
Human subjects protection review board
I
Incapacitated subject
I
Information Commissioner's Office (ICO)
I
Informed consent
Click a letter to view all its definitions
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Term of the Day

Natural history study

A natural history study is a preplanned observational study intended to track the course of a disease over time, identifying demographic, genetic, environmental and other variables that correlate with its development and outcomes in the absence of intervention, or under standard of care. Designs may be retrospective (chart review of existing records) or prospective (longitudinal follow-up of a cohort or registry).

Natural history data is particularly important in rare and paediatric diseases, where randomised placebo-controlled trials may be infeasible or unethical. The FDA (guidance on rare disease natural history studies, 2019) and the EMA accept well-designed natural history studies to define endpoints and biomarkers, identify patient subgroups, estimate sample sizes and, in some cases, serve as external or historical control arms for single-arm trials supporting orphan products.

Because they are non-interventional, natural history studies fall outside the CTR and are governed by national law (for example France's MR-003 or MR-004 reference methodologies) and by the GDPR. They typically involve secondary use of medical records, long-term follow-up, genetic data and small populations in which anonymisation is rarely achievable, so pseudonymisation, a DPIA and a robust research legal basis under Art. 9(2)(j) are essential. Registries maintained by patient organisations or academic consortia raise additional questions of joint controllership and data access governance.

C

CNIL (Commission nationale de l'informatique et des libertés)

The Commission nationale de l'informatique et des libertés (CNIL) is the French independent administrative authority responsible for enforcing the GDPR and the French Data Protection Act (loi Informatique et Libertés of 6 January 1978, as amended). Established in 1978, it is one of the oldest and most influential data protection authorities in Europe, and among the most active in enforcement: its restricted committee has imposed fines exceeding EUR 100 million on major platforms, particularly for cookie violations, and regularly sanctions healthcare providers and software vendors for inadequate security.

The CNIL is especially significant for health research because French law maintains a prior-formality regime for processing of health data for research, study or evaluation purposes (Art. 66 and following of the French Act). Processing that conforms to one of the CNIL's reference methodologies may proceed on a simple declaration of conformity: MR-001 for interventional research requiring consent (including clinical trials), MR-002 for performance studies of in vitro diagnostics, MR-003 for research not requiring consent (non-interventional studies with information and non-objection), MR-004 for studies not involving the individual (reuse of existing data, health data warehouses), MR-005 and MR-006 for access to the SNDS national health database, and MR-007 and MR-008 for the national health data system by health establishments and companies. Processing outside a methodology requires a CNIL authorisation after an opinion from the CESREES ethics and scientific committee. The CNIL also authorises health data warehouses, issues guidance on hosting of health data (HDS certification) and publishes security recommendations widely used across Europe.

For a non-French sponsor, running a trial in France therefore means aligning the protocol, informed consent form and DPIA with MR-001 (which prescribes, for example, the legal basis, retention of two years after the last publication, and information content), appointing an Art. 27 representative if established outside the EU, and being prepared for CNIL inspections. iliomad's regulations centre summarises MR-001, MR-003 and MR-004.