Transparency and Reporting for Retrospective Observational Studies

QR Code

The use of clinical information and biological samples collected during routine care—including outpatient visits, hospitalizations, and treatments (primary use)—has become an increasingly valuable resource for scientific research (secondary use), contributing significantly to scientific progress and the improvement of healthcare services.

Research Participation Agreement (Broad Consent)

During the course of clinical care, it is not always possible to predict precisely for which specific studies or research projects the information and biological samples collected may be used over time. Indeed, it is common for new scientific hypotheses and research questions to emerge years after the original collection of such data and samples.

For this reason, Centro Cardiologico Monzino has introduced a Research Participation Agreement, which is proposed to patients at the time of their first treatment. This is a formal informed consent document that outlines the broad objectives and research areas within which the Center may wish to use patients’ information and biological samples. Patients are free to decide whether to participate, decline participation, or participate subject to specific limitations.

This form of consent, referred to in contemporary bioethical literature as “Broad Consent” for the secondary use of data and biological samples, requires an explicit opt-in decision by the patient.

Monzino Data Governance Board

To balance the advancement of cardiovascular and metabolic research with the protection of patients' rights, every retrospective observational study involving Monzino patients must undergo review and approval by a dedicated Data Governance Board.

This independent multidisciplinary body assesses:

  • The scientific relevance of proposed research projects.
  • Consistency with the Scientific Research Participation Agreement signed by patients.
  • Potential ethical considerations and risks.
  • Traceability and security measures relating to the processing of clinical information and biological samples.

Study-Specific Right to Object

Once the authorization process has been completed, a summary of each approved retrospective observational study is published in this section of the website for the entire duration of the study.

This summary serves as a study-specific supplementary privacy notice pursuant to Article 14 of the European General Data Protection Regulation (EU) 2016/679 (GDPR) and is intended to increase patient awareness and participation by providing information on:

  • The objectives of the study.
  • The types of data and/or biological samples involved.
  • The processing activities carried out.
  • Any third parties with whom data and/or samples may be shared.
  • The roles and responsibilities of participating organizations.
  • The duration of the study.
  • Access arrangements for data and/or samples.

This approach enables data subjects to effectively exercise their right to object, following an opt-out model.

Control, Traceability, and Retention of Research Datasets

For research purposes, the Center employs advanced data coding and pseudonymization techniques, together with controlled and fully traceable access systems for research databases (datasets).

Upon completion of a study:

  • The dataset is closed.
  • Researchers can no longer access the dataset unless a new justified access request is submitted and approved by the Data Governance Board.
  • The dataset is retained for 25 years.

Legal Basis for Processing

As an IRCCS (Scientific Institute for Research, Hospitalization and Healthcare), Monzino may rely on the legal basis provided under Article 110-bis, paragraph 4, of the Italian Privacy Code for the secondary use of data for scientific research purposes, as an alternative to obtaining consent from data subjects.

However, as a matter of ethical principle, the Center prefers, whenever possible, to use data from patients who have previously provided consent. In such cases, the legal exemption serves as a supplementary legal basis alongside consent.

For each authorized study, the published summary specifies whether the exemption from consent has been used as the sole legal basis for all or part of the patient population involved.

Data Protection Impact Assessment (DPIA)

Regardless of the legal basis relied upon (consent or statutory exemption), Monzino:

  • Maintains a record of processing activities.
  • Conducts a Data Protection Impact Assessment (DPIA) for every proposed and authorized study.

As a matter of institutional policy, a summary of the DPIA findings is made publicly available within the study summary.

Data Controller

The Data Controller for the processing of personal data and biological samples is:

Centro Cardiologico Monzino
Via C. Parea 4
20138 Milan, Italy

For studies involving additional legal entities (multicenter studies or studies conducted with external partners), the respective roles are defined through specific contractual agreements, including:

  • Data Controllers
  • Joint Data Controllers
  • Data Processors

Where data are transferred outside the European Union, compliance with applicable European data protection standards is verified.

The Scientific Research Participation Agreement forms an integral part of the general privacy notice.

Exercising Your Rights

To exercise your rights regarding:

  • Access to personal data
  • Rectification
  • Erasure
  • Restriction of processing
  • Retention periods
  • Objection to processing
  • Data portability

or to obtain information on how to lodge a complaint with a supervisory authority, you may contact the Monzino Data Protection Office. For multicenter studies, Monzino will also act as an intermediary with other participating legal entities.

Email: privacy@cardiologicomonzino.it
Certified Email (PEC): direzione.sanitariaccm@legalmail.it