Pseudonymization of clinical trial data in an EDC

These words are used loosely, and mixing them up causes real problems in ethics submissions and data sharing agreements. Pseudonymised data has direct identifiers replaced by a code and can be re-linked by whoever holds the key. Anonymised data cannot reasonably be linked to a person by anyone, which is a high bar and an assessment of context, not a label. De-identified is mainly a US term, associated with HIPAA's Safe Harbor and Expert Determination approaches, and its meaning depends on the method used.

Clinical trials are almost always pseudonymised, not anonymised. The sponsor or site must be able to re-identify a participant for safety follow-up, to honour a withdrawal, to verify data against source and to let regulators inspect. That is a legitimate reason to keep the key, and it is also why the data stays under data protection law. For the wider legal picture, see GDPR compliant clinical trial software and HIPAA vs GDPR for clinical trial data.

A useful test: ask who holds the key and how it is protected. If an analyst, a monitor or a statistician can see names in the same screen as the clinical values, the study is not meaningfully pseudonymised, whatever the document says.

Coding the participant ID is the easy part. Most re-identification risk in a pseudonymised trial dataset sits elsewhere. Free-text fields are the biggest: an adverse event narrative that names a hospital, a relative or an employer, a medical history note with an unusual diagnosis, or a comment such as "same surname as the PI". Dates are next, because a precise date of birth, admission date and visit date together are often unique. Small cells matter too: in a rare disease study, a combination of site, age and diagnosis can identify one person on its own. Attachments and images can carry names in metadata or the picture itself.

The practical defences are procedural as much as technical. Write completion guidelines that tell site staff to keep names and contact details out of free text. Collect age or date of birth only as precisely as the analysis needs. Review narratives before sharing them. Decide before the study which exports go to whom, and whether a shared dataset needs further steps such as grouping rare categories. Capture's controls give you the structure, and the data management plan says how you use it. The data management plan template has a place for this.

Pseudonymization controls matter most for European and UK academic sponsors, hospital research offices running several studies, studies using sensitive categories of data and any study where analysts, statisticians or external partners should never see identity. If you are choosing a system across several of these, best EDC for European trials and GDPR and clinical trial software for European universities cover the wider checklist, and the audit trail guide covers the history side. Capture also carries 21 CFR Part 11-aligned controls. For the current statement of what is and is not covered, see the Security page.