Türkçe / Turkish version >

Clinerion is committed to the trustworthy re-use of health data for research. De-identified and unlinked patient records remain inside the secure IT infrastructure of a hospital. Clinerion’s technology solution is permitted by the hospital to send queries to this de-identified, unlinked database, resulting in aggregated counts of matching patients. No additional ethics committee permissions for the data use are required.

For the responsible use and disclosure of health data without the need for patient consent, Clinerion follows the standards established by Health Insurance Portability and Accountability Act (HIPAA) (Safe Harbor and Expert Determination) and the European General Data Protection Regulation (GDPR) (EU 2016/679). However, Clinerion’s technology solution only receives and processes de-identified, unlinked patient data, and this data does not fall under GDPR, nor HIPAA.

The Clinerion Patient Network Explorer is regularly audited by an independent, third party expert and is confirmed to be fully compliant with data privacy regulations in the USA (HIPAA), the EU (GDPR) and Japan (APPI)

Privacy Standards

Patient Network Explorer was developed following “Privacy by Design” methodologies. Patient privacy is maintained through procedures and policies ensuring consistency with:

• Good Clinical Practice (GCP).
• Good Pharmacoepidemiology Practice (GPP).
• The Health Insurance Portability and Accountability Act (HIPAA).
• The European General Data Protection Regulation (GDPR) (EU 2016/679).
• The laws of Switzerland (Bundesgesetz über den Datenschutz (DSG)).
• The laws of Türkiye (6698 Kişisel Verilerin Korunması Kanunu (KVKK)).
• The laws of Japan (Act on the Protection of Personal Information (APPI))
• The security framework requirements of the ISO 27001 standard.
• The Electronic Health Record (EHR) Association's Developer Code of Conduct.

Operational Principles

• De-identification / unlinking: The Clinerion server is located within the secure hospital infrastructure. Patient data is stripped of all identifiers within the hospital’s own system.
• Aggregation: Patient Network Explorer queries only de-identified patient data. Results are in fully aggregated form – e.g. the count of candidates for a feasibility study.
• Data protection is enabled by de-identification / unlinking from identifers, two-way encrypted data transfer, encrypted storage, and access control mechanisms.
• Clinerion ensures that users understand and treat their access with appropriate regard for information security.
• All critical activities are covered by Standard Operating Procedures and best practice policies.
• All Clinerion personnel are under secrecy obligation and trained in this security framework structure.

For the responsible use and disclosure of health data without the need for patient consent, Patient Network Explorer follows the standard methods for Safe Harbor and Expert Determination established by HIPAA.

• Clinerion Privacy Policy >
• Clinerion System Security >
• Clinerion Data Security Policy >

Türkçe / Turkish version >

Links:

• Clinerion article: Scalability and patient data security in the age of clinical trial recruitment using electronic medical records: an infrastructure solution (World Pharma Today) >
• Press article: Clinerion patient recruitment system found compliant with privacy directives (Outsourcing Pharma) >
• Press release: Independent audit confirms Clinerion’s compliance to HIPAA and the EU Data Protection Directive. >
• Clinerion article: Maintaining Privacy when Searching for Patients Using Electronic Medical Records. (Journal for Clinical Studies) >