Clinical studies and disability data governance: what life sciences sponsors must track

Summary: Proposed cuts to the United States Centers for Disease Control and Prevention (CDC) National Health Interview Survey (NHIS), reducing its questions from 482 to 150, threaten to widen an already significant undercount of people with disabilities. For sponsors conducting clinical studies that rely on federal survey data as a real-world-evidence benchmark or health-equity reference, this shift creates measurable gaps in external comparator data, complicates cross-border data benchmarking and may affect the reliability of regulatory submissions. Sponsors operating under the General Data Protection Regulation (GDPR), Regulation (EU) No 536/2014 on clinical trials (EU CTR) and ICH Good Clinical Practice (GCP) guidelines should audit their dependence on US federal public health datasets now.

What is the NHIS and why does it matter for clinical studies?

The National Health Interview Survey (NHIS) is the United States' flagship annual household health survey, administered by the CDC's National Center for Health Statistics (NCHS) since 1957, collecting population-level health data used by researchers, regulators and policymakers. For sponsors running clinical studies, the NHIS serves as a reference population dataset, enabling external control arms, health-equity analyses and real-world-evidence (RWE) submissions to agencies including the US Food and Drug Administration (FDA) and the European Medicines Agency (EMA).

In August 2026, the NCHS proposed a major overhaul of the NHIS. The redesign would reduce the adult questionnaire from 482 questions to 150, eliminating items on hearing aids, cognition, fatigue, mobility supports such as wheelchairs and scooters, and a range of functional disability indicators. The surveyed household panel would be reduced to approximately 25,000 households. A Department of Health and Human Services (HHS) spokesperson confirmed the motivation is cost reduction, as reported by STAT News on 1 October 2026.

For life sciences organisations, the implications extend well beyond domestic US health policy. Any sponsor using NHIS data as a benchmark population, an external comparator or a health-equity stratification layer in a clinical study protocol should treat this as a material data governance event.

The iliomad data-dependency framework for clinical studies

Iliomad's data-dependency framework helps sponsors systematically identify, document and mitigate reliance on third-party public health datasets within the data governance architecture of a clinical study. The framework operates across three sequential layers.

Layer 1: Dataset audit. Sponsors identify every external public health dataset referenced in the clinical study protocol, the statistical analysis plan (SAP) or the integrated summary of efficacy and safety. Each dataset is classified by jurisdiction, update frequency, collection methodology and governance stability.

Layer 2: Regulatory impact assessment. For each dataset, the sponsor assesses the regulatory consequence of degraded data quality or discontinuation. Under EU CTR Article 25, sponsors must ensure that participant data is collected in a manner consistent with the protocol and scientifically valid. Where a reference population dataset loses validity through redesign or truncation, the sponsor must document the impact and notify the relevant ethics committee and competent authority.

Layer 3: Contingency mapping. For datasets assessed as high-dependency or high-risk, the sponsor identifies alternative sources, including European Health Data Space (EHDS) repositories, national registries and proprietary real-world datasets, and documents the transition pathway.

This framework is particularly relevant for sponsors operating decentralised clinical trials (DCTs), in which remote data collection already amplifies dependence on external population references for protocol feasibility and statistical power calculations.

How does the NHIS redesign affect cross-border data benchmarking under GDPR?

The GDPR does not directly regulate US federal health surveys, but it does govern how European sponsors and contract research organisations (CROs) process personal data derived from or compared against those surveys. The intersection arises in three practical scenarios.

Scenario 1: External control arms. Where a sponsor uses NHIS aggregate data to construct a synthetic or external control arm under an EU-authorised clinical study, the protocol must describe the reference dataset's collection methodology. If that methodology changes materially, Article 58 of EU CTR requires the sponsor to notify the Member State competent authority of a substantial modification.

Scenario 2: Health-equity submissions. EMA's reflection paper on the use of real-world data in regulatory decision-making encourages sponsors to document the representativeness of reference populations. Removing disability-related questions from the NHIS will deepen existing undercounts. Research cited by STAT News indicates the survey already missed an estimated 75 per cent of people with intellectual and developmental disabilities before the proposed cuts. Sponsors relying on NHIS disability prevalence figures in regulatory submissions must reassess the validity of those figures.

Scenario 3: Cross-border data transfers. Sponsors transferring clinical study data from the EU to the US, whether via standard contractual clauses (SCCs) under GDPR Articles 46(2)(c) and (d) or binding corporate rules (BCRs), must conduct transfer impact assessments (TIAs). A TIA evaluates not only the legal protections available to data subjects in the destination country but also the adequacy of data infrastructure. Systemic degradation of federal health data infrastructure is a relevant factor in assessing whether the US environment continues to support the scientific and regulatory purposes for which the transfer is made.

Focus: the example of France

In France, sponsors conducting clinical studies must submit a declaration or authorisation to the Commission Nationale de l'Informatique et des Libertés (CNIL) before processing health data. The CNIL's Méthodologie de Référence MR-001 (MR-001) governs standard research uses and defines the conditions under which reference population data may be incorporated into a study's data governance framework. Where a sponsor's protocol references a foreign public health dataset such as the NHIS, the CNIL expects the sponsor to document that dataset's provenance, completeness and governance in the Data Protection Impact Assessment (DPIA) prepared under GDPR Article 35. A material reduction in NHIS data quality may therefore require sponsors to update existing MR-001 declarations.

Focus: the example of the United Kingdom

In the United Kingdom, the Information Commissioner's Office (ICO) oversees data protection compliance for clinical studies conducted under the UK GDPR, which mirrors the EU GDPR following the UK's departure from the European Union. The ICO's guidance on research exemptions and the Health Research Authority's (HRA) Combined Review process both require sponsors to identify the basis on which external datasets are used and to confirm their scientific validity. Where NHIS data underpins a UK-authorised clinical study's comparator population, sponsors should review whether the proposed redesign triggers a protocol amendment notification to the HRA.

Focus: the example of the European Data Protection Board

The European Data Protection Board (EDPB), the body responsible for ensuring consistent application of GDPR across EU Member States, has issued guidance on the processing of health data for research purposes under Article 9(2)(j) GDPR. The EDPB's Opinion 3/2019 on processing of personal data through video devices, and more broadly its guidance on scientific research, confirms that data quality and representativeness are integral to the lawfulness of health research processing. Where a sponsor's scientific research purpose depends on population data that is no longer representative due to a survey redesign, the EDPB's framework implies a duty to reassess the legal basis and the DPIA.

Comparing the regulatory response obligations across jurisdictions

The table below summarises the key regulatory obligations triggered for sponsors when an external reference dataset used in a clinical study undergoes a material change.

‍

The nFADP is Switzerland's revised Federal Act on Data Protection, which entered into force on 1 September 2023 and aligns closely with GDPR principles.

Practical steps for sponsors relying on US federal health data

Sponsors should take the following actions in response to the NHIS redesign proposal.

1. Audit protocol dependencies. Review all active and planned clinical study protocols to identify where NHIS data is cited as a reference population, comparator dataset or health-equity benchmark.
2. Update DPIAs. Under GDPR Article 35 and the EDPB's guidelines on DPIAs, sponsors must review their impact assessments when the risk profile of a processing activity changes. A degraded external dataset constitutes a change in scientific validity risk.
3. Identify alternative data sources. European alternatives include Eurostat health statistics, national disease registries and the forthcoming EHDS, established under Regulation (EU) 2025/327 on the European Health Data Space, which creates a framework for secondary use of electronic health data across Member States.
4. Brief clinical operations teams. Clinical operations leads, site monitors and data managers should be informed of the dependency audit outcomes so that site-level data collection plans can be adjusted where necessary.
5. Engage legal and regulatory counsel. Where protocol amendments are required, sponsors should engage regulatory counsel early to avoid delays in ethics committee and competent authority timelines under EU CTR Articles 14 to 23.
6. Review SCCs and TIAs. Any standard contractual clauses in place for transfers of clinical study data to or from the United States should be reviewed to confirm that the TIA remains valid in light of changing federal data infrastructure.

Iliomad advises biotech and pharma sponsors, CROs and healthtech organisations on GDPR compliance, cross-border data transfers and clinical trial data governance across the EU, UK and Switzerland. If your clinical studies rely on US federal health datasets or require a DPIA review in light of changing real-world data sources, our clinical trials data protection team can help you audit your exposure and update your compliance framework.

Speak to iliomad about clinical trial data governance