Skip to main content

Post Audit Review: IQVIA Limited

This report provides the formal closure of the remote data sharing audit of IQVIA Limited in June 2022.

Audit summary

Purpose

This report provides the formal closure of the remote data sharing audit of IQVIA Limited between 20 and 30 June 2022 against the requirements of:

  • the data sharing framework contract (DSFC) CON-290392-M1B6L-v2.01
  • the data sharing agreements (DSA) DARS-NIC-13925-Q7R2D v7.6, v9.2 and v10.3 
  • the organisation’s own policies, processes and procedures 

This DSA covers the provision of the following datasets:

Dataset Classification of data Dataset period
Emergency Care Data Set (ECDS) Pseudo/Anonymised, Non-sensitive 2017/18 - 2020/21_Q04
Hospital Episode Statistics (HES) Critical Care Pseudo/Anonymised, Non-sensitive 2008/09 - 2020/21_Q04
HES Statistics Accident and Emergency  Pseudo/Anonymised, Non-sensitive 2007/08 - 2020/21_M12
HES Admitted Patient Care Pseudo/Anonymised, Non-sensitive 2005/06 - 2020/21_Q04
HES Outpatients Pseudo/Anonymised, Non-sensitive 2005/06 - 2020/21_Q04

The Controller is IQVIA.
Further guidance on the terms used in this post audit review report can be found in version 1 of the Data Sharing Remote Audit Guide. 
 

Post audit review

This post audit review comprised of a desk-based assessment of the action plan and supporting evidence supplied by IQVIA on 20 March 2023.

Post audit review outcome

Based on the evidence provided by IQVIA, the Audit Team has closed all the findings. Therefore, no further action is required by the Audit Team and IQVIA.

Updated risk statement

Based on the results of this post audit review the risk statement has been reassessed against the options of Critical - High - Medium - Low.

Original Risk Statement: Medium

Current Risk Statement: Low

Data recipient’s acceptance statement

IQVIA has reviewed this report and confirmed that it is accurate.

Status

The following table identifies the 2 agreement nonconformities, 1 observation, 5 opportunities for improvement and 2 points for follow-up raised as part of the original audit. 

Ref Finding Link to area Update Designation Status
1 IQVIA’s Independent Scientific Ethical Advisory Committee (ISEAC) did not meet requirements as outlined within the ISEAC Terms of Reference (ToR) v3, including:
  • although IQVIA provided an agenda for the 2018 Annual General Meeting (AGM), the Audit Team was unable to confirm the AGM was held as no minutes were available. Furthermore, no AGMs were held in 2019 and 2020 at the direction of the ISEAC Chair
  • no annual report was produced by ISEAC between 2018 and 2020
  • the annual review of ISEAC ToR had not been conducted in 2019 and 2020
  • no ISEAC Standard Operating Procedures (SOPs) were in place prior to 2021
 Use and Benefits

IQVIA confirmed that all four points in the finding have been considered and the updated ToR v7.0 has been created to reflect these changes. 

The following supporting items were provided to the Audit Team:

  • The ToR v7.0 approved in November 2022
  • ISEAC annual reports for 2021 and 2022, with supporting AGM meeting minutes
  • ISEAC Standard Operating Procedures (SOPs) v3.0 (approved in November 2022) 
 Agreement nonconformity Closed
2 IQVIA to ensure that all stakeholders have sight of the DSA, especially the ISEAC committee who should review the DSA when changes are made. For example, a protocol was approved to support a PhD study, which was not permitted by the DSA. Use and Benefits

The DSA has been updated and IQVIA confirmed that the points in the findings have been considered.

IQVIA confirmed that quarterly Hospital
Treatment Insights (HTI) Management meetings now have a standing agenda item so that in the event there are changes with the DSA, these changes are shared with all stakeholders, including the ISEAC committee. 

When a subsequent DSA is approved, this will be shared with ISEAC. It should be noted that ISEAC will no longer be used as an approval mechanism for HTI studies. 

Copies of minutes from quarterly HTI management meetings in November 2022 and March 2023 which included DSA updates were supplied to the Audit Team.

 Agreement nonconformity Closed
3 IQVIA to agree with DARS a suitable timeframe for maintaining a record of exports for monitoring and audit purposes. IQVIA could not provide any auditable trail of exports from its research environment prior to July 2021. It should be noted that the generated logs from the system installed in July 2021 are only retained 12 months which is generally shorter than the research projects being conducted. Access Control

The DSA has been updated and IQVIA confirmed that a record of all exports is kept for a period of 3 years from the date of export in agreement with NHS England.

A copy of the latest application, DARS-NIC-13925-Q7R2D-v12.1, was supplied to the Audit Team.

 Observation Closed
4 IQVIA should update the protocol to include:
  • who is involved in the research including details of users accessing and processing the data
  • the responsibility of each party
  • the clause specified in the DSA around contracts with external organisation
  • a statement that the work is a joint collaboration between IQVIA and a third-party and any direct outputs must include reference to this
 Operational Management

The ISEAC Application Protocol form has been updated and IQVIA have considered all suggestions made by the Audit Team. 

The protocol has been updated to include: 

  • the Chief Investigator and name of all teams involved
  • the roles and responsibilities of each party
  • the clause specified in the DSA around contracts with external organisations
  • a statement that the work is a joint collaboration between IQVIA and a third-party. A copy of the latest ISEAC Application Protocol v3 (March 2023) was supplied to the Audit Team
 Opportunity for improvement Closed
5

IQVIA should consider making it easier for the public to locate publications that have been produced using HTI data, for example, by including a HTI data category on its bibliography. IQVIA should also declare on its website which protocols have been approved by ISEAC and the date of their approval.

 Use and Benefits

A release register is now available on the IQVIA website of all studies approved by ISEAC since 2017: https://www.iqvia.com/-/media/iqvia/pdfs/uk/hti-release-register_sep2022.pdf   

IQVIA also intend to improve the search/tag functionality on the website. This is due to be completed by the second quarter of 2023/24. 

 Opportunity for improvement Open, but not for follow-up
6 IQVIA should update the processing section of the Record of Processing Activities (ROPA), dated May 2022, to remove University College London as a Processor. Operational Management The Audit Team observed that the ROPA was updated in July 2022 during the original audit.  Opportunity for improvement Closed
7 IQVIA should include the ISEAC and HTI processes in its future internal audit programme to ensure it is fully compliant with the requirements of the DSFC, DSA and IQVIA’s own policies and procedures. Operational Management

ISEAC is now being audited by the IQVIA UK Information Security Management System team in addition to the HTI as part of the ISO 27001 audit plan.

A business improvement review was performed in November 2022 with the aim to verify the effectiveness of ISEAC in terms of reviewing studies and meeting the NHSE requirements and compliance with the DSA and DSFC. 

The ISEAC Business Improvement Review report from November 2022 was supplied to the Audit Team. 

 Opportunity for improvement Closed
8 IQVIA should ensure that future honorary contracts are signed by a representative of IQVIA. The honorary contract template had previously been approved by the Data Access Advisory Group.  Operational Management

IQVIA confirmed a member of their staff has been assigned as responsible for ensuring honorary contracts are signed by a representative of IQVIA. 

Training presentation slides to support these roles and responsibilities were supplied to the Audit Team. 

 Opportunity for improvement Closed
9 At the post audit review, the Audit Team will review evidence of the outputs for the 4 protocols approved between January 2018 and December 2020 that are in progress. Use and Benefits

IQVIA confirmed outputs have been produced for two out of the four protocols. It had not been possible to produce any outputs for two protocols due to current version of DSA not allowing processing of data. 

Two posters submitted for publication between March and April 2023 were supplied to the Audit Team.
 

 Follow-up Open, but not for follow-up
10 At the post audit review, the Audit Team will confirm whether the information requested in the special conditions in v10.3 of the DSA has been provided to DARS. This is subject to IQVIA being allowed to restart processing data. Use and Benefits

IQVIA confirmed that information requested in the special conditions in v10.3 of the DSA have been provided to DARS. 

A copy of email communications between IQVIA and DARS was supplied to the Audit Team.   

 Follow-up Closed

Disclaimer

NHS England takes all reasonable care to ensure that this audit report is fair and accurate but cannot accept any liability to any person or organisation, including any third party, for any loss or damage suffered or costs incurred by it arising out of, or in connection with, the use of this report, however such loss or damage is caused. NHS England cannot accept liability for loss occasioned to any person or organisation, including any third party, acting or refraining from acting as a result of any information contained in this report. 

Last edited: 21 July 2023 3:35 pm