Click here to open the filter panel
#
510(k) premarket notification
A
Accountability
A
Accuracy
A
Adequacy decision
A
Ad hoc services
A
Adverse event
A
AI literacy (Art. 4 EU AI Act)
A
AI Officer
A
Analysis Data Model (ADaM)
A
Anonymisation
A
Appropriate safeguards
A
Article 29 Working Party (WP29)
A
Artificial intelligence (AI)
A
Authorised representative (EU AI Act)
A
Automated individual decision-making
A
Auxiliary medicinal product
B
Best-in-class drugs
B
Binding corporate rules (BCR)
B
Biobank
B
Biometric data
Click a letter to view all its definitions
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Term of the Day

Natural history study

A natural history study is a preplanned observational study intended to track the course of a disease over time, identifying demographic, genetic, environmental and other variables that correlate with its development and outcomes in the absence of intervention, or under standard of care. Designs may be retrospective (chart review of existing records) or prospective (longitudinal follow-up of a cohort or registry).

Natural history data is particularly important in rare and paediatric diseases, where randomised placebo-controlled trials may be infeasible or unethical. The FDA (guidance on rare disease natural history studies, 2019) and the EMA accept well-designed natural history studies to define endpoints and biomarkers, identify patient subgroups, estimate sample sizes and, in some cases, serve as external or historical control arms for single-arm trials supporting orphan products.

Because they are non-interventional, natural history studies fall outside the CTR and are governed by national law (for example France's MR-003 or MR-004 reference methodologies) and by the GDPR. They typically involve secondary use of medical records, long-term follow-up, genetic data and small populations in which anonymisation is rarely achievable, so pseudonymisation, a DPIA and a robust research legal basis under Art. 9(2)(j) are essential. Registries maintained by patient organisations or academic consortia raise additional questions of joint controllership and data access governance.

Q

Quasi-identifier

A quasi-identifier (also called an indirect identifier) is an attribute in a dataset that does not, on its own, identify an individual but that can lead to identification when combined with other quasi-identifiers or linked to external information. Classic examples are date of birth, sex and postcode: Latanya Sweeney's 2000 study showed that these three attributes uniquely identified 87% of the US population. In health data, further quasi-identifiers include dates of admission, visits or death, rare diagnoses or procedures, treating hospital, ethnicity, occupation, number of children, height and weight, and free-text fields.

Quasi-identifiers are the central concern of re-identification risk assessment. Direct identifiers (names, national identification numbers, email addresses, medical record numbers) are removed as a matter of course when data is pseudonymised; the residual risk comes from quasi-identifiers that allow singling out, linkage or inference, the three criteria of the Article 29 Working Party Opinion 05/2014 on anonymisation. k-anonymity and its refinements work by generalising or suppressing quasi-identifiers until each combination is shared by at least k records; differential privacy limits what can be inferred about any individual regardless of which attributes an attacker holds. Under US HIPAA, the Safe Harbor de-identification method is essentially a fixed list of 18 direct and quasi-identifiers to remove.

In clinical research, the quasi-identifiers in a trial dataset determine whether it remains personal data once coded, how much detail can be published in clinical study reports and the CTIS portal, and what generalisation is needed before data sharing. Full dates of birth, exact visit dates and verbatim adverse event terms are common findings in DPIAs: replacing them with age at enrolment, study day and coded terms is a low-cost application of data minimisation that materially lowers risk. The EDPB Guidelines 01/2025 on pseudonymisation and the EMA Policy 0070 anonymisation guidance both expect an explicit inventory of quasi-identifiers and a documented risk analysis.