Health-data and life-sciences giant IQVIA has been fined US$7.8 million over its failure to properly anonymise health data — an enforcement action reported by BleepingComputer on 5 October. The penalty stems from IQVIA's failure to meet anonymisation requirements for protected health information it processed. The precise regulator and scope of the anonymisation deficiencies are detailed in the underlying enforcement documents; the fine is notable both for its size — one of the larger privacy-enforcement actions against a healthcare analytics vendor — and for its object lesson: nominal "anonymisation" that does not satisfy a regulator's data-protection standard is itself a compliance exposure, independent of any confirmed downstream breach. Why it matters: for healthcare and data-analytics organisations, including Australian health-data handlers under the Privacy Act's de-identification expectations, the fine is a reminder that failed de-identification is treated as a regulatory failure in its own right, not merely as the enabler of a future breach.

• Source article