Click here to open the filter panel
R
Randomisation and trial supply management (RTSM)
R
Randomised clinical trial (RCT)
R
Real-world data (RWD)
R
Real-world evidence (RWE)
R
Recipient
R
Record of processing activities (RoPA)
R
Restriction of processing
R
Right not to be subject to solely automated decision-making
R
Right of access
R
Right of information
R
Right of rectification
R
Rights of the data subject
R
Right to data portability
R
Right to erasure ("right to be forgotten")
R
Right to object
R
Right to restriction of processing
S
Scientific research purposes (Art. 89 GDPR)
S
Secondary use of health data
S
Security breach (security incident)
S
Security of processing
Click a letter to view all its definitions
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Term of the Day

Natural history study

A natural history study is a preplanned observational study intended to track the course of a disease over time, identifying demographic, genetic, environmental and other variables that correlate with its development and outcomes in the absence of intervention, or under standard of care. Designs may be retrospective (chart review of existing records) or prospective (longitudinal follow-up of a cohort or registry).

Natural history data is particularly important in rare and paediatric diseases, where randomised placebo-controlled trials may be infeasible or unethical. The FDA (guidance on rare disease natural history studies, 2019) and the EMA accept well-designed natural history studies to define endpoints and biomarkers, identify patient subgroups, estimate sample sizes and, in some cases, serve as external or historical control arms for single-arm trials supporting orphan products.

Because they are non-interventional, natural history studies fall outside the CTR and are governed by national law (for example France's MR-003 or MR-004 reference methodologies) and by the GDPR. They typically involve secondary use of medical records, long-term follow-up, genetic data and small populations in which anonymisation is rarely achievable, so pseudonymisation, a DPIA and a robust research legal basis under Art. 9(2)(j) are essential. Registries maintained by patient organisations or academic consortia raise additional questions of joint controllership and data access governance.

F

Fundamental rights impact assessment (FRIA)

A fundamental rights impact assessment (FRIA) is the assessment that certain deployers of high-risk AI systems must perform before putting the system into use, under Art. 27 of the EU AI Act, to identify the specific risks to the fundamental rights of the individuals or groups likely to be affected and the measures to be taken if those risks materialise. The obligation applies to deployers that are bodies governed by public law or private entities providing public services (which includes hospitals and healthcare providers in many Member States), and to deployers of high-risk systems used for creditworthiness assessment and life and health insurance pricing (Annex III, point 5(b) and (c)). Other deployers may perform a FRIA voluntarily, and providers are encouraged to support them.

The FRIA must describe the deployer's processes in which the system will be used in line with its intended purpose; the period and frequency of use; the categories of natural persons and groups likely to be affected; the specific risks of harm to those persons or groups, taking into account the information provided by the provider under Art. 13; the human oversight measures according to the instructions for use; and the measures to be taken if risks materialise, including governance arrangements, complaint mechanisms and redress. Once performed, the deployer notifies the market surveillance authority using a template the AI Office is developing; the assessment is updated when relevant elements change. Where a DPIA under Art. 35 GDPR already covers some of these elements, the FRIA complements it rather than duplicating it (Art. 27(4)).

For healthcare and life sciences, a hospital deploying an AI triage, diagnostic or resource-allocation system, or an insurer using AI to price health cover, will need a FRIA from August 2026, and the analysis should extend beyond data protection to non-discrimination (bias against age, sex, ethnicity or disability in training data), access to healthcare, dignity and the right to an effective remedy, drawing on the Charter of Fundamental Rights. Pharmaceutical and MedTech providers are not themselves obliged to run FRIAs for products they place on the market, but they must supply the information deployers need and will increasingly be asked for FRIA-ready documentation in procurement. Combining the FRIA, the DPIA and the MDR clinical evaluation into one integrated impact assessment is the approach iliomad recommends; see AI compliance services.