Click here to open the filter panel
B
Biotechnology
B
Broad consent
B
Business associate agreement (BAA)
C
Central imaging
C
Central laboratory
C
Chemistry, Manufacturing and Controls (CMC)
C
Clinical outcome assessment (COA)
C
Clinical research
C
Clinical study
C
Clinical trial
C
Clinical trial agreement (CTA)
C
Clinical trial phases
C
Clinical Trials Information System (CTIS)
C
Clinical trial site
C
Clinical Trials Regulation (CTR) 536/2014
C
Clinician-reported outcome (ClinRO)
C
CNIL (Commission nationale de l'informatique et des libertés)
C
Codes of conduct
C
Consent
C
Contract research organisation (CRO)
Click a letter to view all its definitions
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Term of the Day

Natural history study

A natural history study is a preplanned observational study intended to track the course of a disease over time, identifying demographic, genetic, environmental and other variables that correlate with its development and outcomes in the absence of intervention, or under standard of care. Designs may be retrospective (chart review of existing records) or prospective (longitudinal follow-up of a cohort or registry).

Natural history data is particularly important in rare and paediatric diseases, where randomised placebo-controlled trials may be infeasible or unethical. The FDA (guidance on rare disease natural history studies, 2019) and the EMA accept well-designed natural history studies to define endpoints and biomarkers, identify patient subgroups, estimate sample sizes and, in some cases, serve as external or historical control arms for single-arm trials supporting orphan products.

Because they are non-interventional, natural history studies fall outside the CTR and are governed by national law (for example France's MR-003 or MR-004 reference methodologies) and by the GDPR. They typically involve secondary use of medical records, long-term follow-up, genetic data and small populations in which anonymisation is rarely achievable, so pseudonymisation, a DPIA and a robust research legal basis under Art. 9(2)(j) are essential. Registries maintained by patient organisations or academic consortia raise additional questions of joint controllership and data access governance.

P

Protected health information (PHI)

Protected health information (PHI) is the term used by the US HIPAA Privacy Rule (45 CFR 160.103) for individually identifiable health information that is created, received, maintained or transmitted by a covered entity or its business associate, in any form or medium. Health information is individually identifiable if it relates to the past, present or future physical or mental health of an individual, the provision of healthcare, or payment for healthcare, and identifies the individual or could reasonably be used to identify them. Electronic PHI (ePHI) is PHI in electronic form and is the subject of the Security Rule. Employment records held by an employer and education records under FERPA are excluded, and information about a person deceased more than 50 years is no longer PHI.

The Privacy Rule lists 18 identifiers whose removal is the basis of the Safe Harbor de-identification method: names; geographic subdivisions smaller than a state (with limited ZIP code exceptions); all elements of dates except year (and ages over 89); telephone and fax numbers; email addresses; Social Security numbers; medical record numbers; health plan beneficiary numbers; account numbers; certificate or licence numbers; vehicle identifiers; device identifiers and serial numbers; URLs; IP addresses; biometric identifiers; full-face photographs; and any other unique identifying number or code. PHI may be used and disclosed without authorisation for treatment, payment and healthcare operations, for public health and certain other listed purposes, and otherwise generally requires the individual's written authorisation; the "minimum necessary" standard applies to most uses.

PHI is narrower than data concerning health under the GDPR in one respect and broader in another: it covers only information held within the HIPAA perimeter of covered entities and business associates, so health data held by a wellness app developer or a pharmaceutical sponsor is not PHI, but within that perimeter it includes payment and demographic information that the GDPR would classify as ordinary personal data. In a transatlantic clinical trial, the US site holds PHI and needs a HIPAA authorisation or IRB waiver to disclose data to the sponsor, while the EU site holds health data governed by Art. 9 GDPR; the sponsor's coded dataset is de-identified or a limited data set under HIPAA yet pseudonymised personal data under the GDPR. Drafting consent forms, contracts and breach procedures that respect both classifications is a core task in global trials; see iliomad's HIPAA services.