Click here to open the filter panel
D
Decentralised clinical trial (DCT)
D
De-identification (HIPAA)
D
Differential privacy
E
Early termination of a clinical trial
E
Electronic case report form (eCRF)
E
Electronic clinical outcome assessment (eCOA)
E
Electronic data capture (EDC)
E
Electronic health record (EHR)
E
Electronic informed consent (eConsent)
E
Encryption
E
End of a clinical trial
E
Enterprise
E
Ethics committee
E
EU Artificial Intelligence Act (AI Act)
E
European Data Protection Board (EDPB)
E
European Data Protection Supervisor (EDPS)
E
European Health Data Space (EHDS)
E
European Medicines Agency (EMA)
E
EU-US Data Privacy Framework (DPF)
E
Explicit consent
Click a letter to view all its definitions
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Term of the Day

Natural history study

A natural history study is a preplanned observational study intended to track the course of a disease over time, identifying demographic, genetic, environmental and other variables that correlate with its development and outcomes in the absence of intervention, or under standard of care. Designs may be retrospective (chart review of existing records) or prospective (longitudinal follow-up of a cohort or registry).

Natural history data is particularly important in rare and paediatric diseases, where randomised placebo-controlled trials may be infeasible or unethical. The FDA (guidance on rare disease natural history studies, 2019) and the EMA accept well-designed natural history studies to define endpoints and biomarkers, identify patient subgroups, estimate sample sizes and, in some cases, serve as external or historical control arms for single-arm trials supporting orphan products.

Because they are non-interventional, natural history studies fall outside the CTR and are governed by national law (for example France's MR-003 or MR-004 reference methodologies) and by the GDPR. They typically involve secondary use of medical records, long-term follow-up, genetic data and small populations in which anonymisation is rarely achievable, so pseudonymisation, a DPIA and a robust research legal basis under Art. 9(2)(j) are essential. Registries maintained by patient organisations or academic consortia raise additional questions of joint controllership and data access governance.

E

Encryption

Encryption is the process of converting readable data (plaintext) into an unreadable form (ciphertext) using a cryptographic algorithm and a key, so that only those holding the corresponding key can recover the original. Symmetric encryption (for example AES-256) uses one key for both operations and is efficient for bulk data; asymmetric or public-key encryption (RSA, elliptic-curve cryptography) uses a key pair and underpins secure key exchange, digital signatures and protocols such as TLS. Encryption is applied at rest (disks, databases, backups), in transit (TLS for web and API traffic, VPNs, secure file transfer) and increasingly in use, through confidential computing and homomorphic encryption.

The GDPR names encryption expressly among the measures that may be appropriate to ensure security of processing (Art. 32(1)(a)) and as an example of data protection by design. Its legal effects are significant: a personal data breach involving properly encrypted data whose key was not compromised may be exempt from communication to data subjects under Art. 34(3)(a), and encryption with keys held exclusively in the EEA is one of the supplementary measures the EDPB accepts (Recommendations 01/2020) to make transfers to third countries lawful where the importer only stores or transports data. Encrypted data remains personal data, however, since decryption is possible; it is not anonymised.

For life sciences organisations, encryption is a baseline expectation of supervisory authorities, HDS-type health hosting certifications, NIS2, ISO 27001 and the cybersecurity requirements of the MDR. The decisive questions in DPIAs and vendor assessments are less whether encryption is used than how: which algorithms and key lengths, whether the cloud provider or the customer controls the keys (customer-managed or hold-your-own-key models), how keys are stored, rotated and revoked, whether end-to-end encryption protects data from the vendor itself, and whether laptops and removable media used by monitors and site staff are encrypted. Encryption of pseudonymisation key tables and of unblinding information deserves particular attention in clinical trials.