Transparency and Reporting for Retrospective Observational Studies

QR Code

The use of clinical information and biological samples collected during routine care—including outpatient visits, hospitalizations, and treatments (primary use)—has become an increasingly valuable resource for scientific research (secondary use), contributing significantly to scientific progress and the improvement of healthcare services.

Scientific Research Participation Agreement (Broad Consent)

During a patient's care journey, it is not always possible to predict precisely how clinical information and biological samples may be used in future research studies. Scientific questions and research opportunities often emerge many years after the original collection of data and samples.

For this reason, Centro Cardiologico Monzino has introduced a Scientific Research Participation Agreement, offered to patients at the time of their first treatment. This agreement is a form of informed consent that outlines the broad research objectives and areas within which the Center may wish to use patients' data and samples. Patients are free to decide whether to participate, decline participation, or participate with specific limitations.

This form of consent, known in contemporary bioethics literature as Broad Consent for the secondary use of data and biological samples, requires explicit patient authorization (opt-in consent).

Monzino Data Governance Board

To balance the advancement of cardiovascular and metabolic research with the protection of patients' rights, every retrospective observational study involving Monzino patients must undergo review and approval by a dedicated Data Governance Board.

This independent multidisciplinary body assesses:

  • The scientific relevance of proposed research projects.
  • Consistency with the Scientific Research Participation Agreement signed by patients.
  • Potential ethical considerations and risks.
  • Traceability and security measures relating to the processing of clinical information and biological samples.

Study-Specific Right to Object

Once the authorization process has been completed, a summary of each approved retrospective observational study is published in this section of the website for the entire duration of the study.

This summary serves as a study-specific supplementary privacy notice pursuant to Article 14 of the European General Data Protection Regulation (EU) 2016/679 (GDPR) and is intended to increase patient awareness and participation by providing information on:

  • The objectives of the study.
  • The types of data and/or biological samples involved.
  • The processing activities carried out.
  • Any third parties with whom data and/or samples may be shared.
  • The roles and responsibilities of participating organizations.
  • The duration of the study.
  • Access arrangements for data and/or samples.

This approach enables data subjects to effectively exercise their right to object, following an opt-out model.

Control, Traceability, and Retention of Research Datasets

For research purposes, the Center employs advanced data coding and pseudonymization techniques, together with controlled and fully traceable access systems for research databases (datasets).

Upon completion of a study:

  • The dataset is closed.
  • Researchers can no longer access the dataset unless a new justified access request is submitted and approved by the Data Governance Board.
  • The dataset is retained for 25 years.

Legal Basis for Processing

As an IRCCS (Scientific Institute for Research, Hospitalization and Healthcare), Monzino may rely on the legal basis provided under Article 110-bis, paragraph 4, of the Italian Privacy Code for the secondary use of data for scientific research purposes, as an alternative to obtaining consent from data subjects.

However, as a matter of ethical principle, the Center prefers, whenever possible, to use data from patients who have previously provided consent. In such cases, the legal exemption serves as a supplementary legal basis alongside consent.

For each authorized study, the published summary specifies whether the exemption from consent has been used as the sole legal basis for all or part of the patient population involved.

Data Protection Impact Assessment (DPIA)

Regardless of the legal basis relied upon (consent or statutory exemption), Monzino:

  • Maintains a record of processing activities.
  • Conducts a Data Protection Impact Assessment (DPIA) for every proposed and authorized study.

As a matter of institutional policy, a summary of the DPIA findings is made publicly available within the study summary.

Data Controller

The Data Controller for the processing of personal data and biological samples is:

Centro Cardiologico Monzino
Via C. Parea 4
20138 Milan, Italy

For studies involving additional legal entities (multicenter studies or studies conducted with external partners), the respective roles are defined through specific contractual agreements, including:

  • Data Controllers
  • Joint Data Controllers
  • Data Processors

Where data are transferred outside the European Union, compliance with applicable European data protection standards is verified.

The Scientific Research Participation Agreement forms an integral part of the general privacy notice.

Exercising Your Rights

To exercise your rights regarding:

  • Access to personal data
  • Rectification
  • Erasure
  • Restriction of processing
  • Retention periods
  • Objection to processing
  • Data portability

or to obtain information on how to lodge a complaint with a supervisory authority, you may contact the Monzino Data Protection Office. For multicenter studies, Monzino will also act as an intermediary with other participating legal entities.

Email: privacy@cardiologicomonzino.it
Certified Email (PEC): direzione.sanitariaccm@legalmail.it

Fornisci il tuo feedback su BizChat

Come si redige un DPIA efficace?Quali rischi etici vengono valutati?Come viene garantita la sicurezza dei dati?

Rilascia qui i file