OBJECTIVES : Real-world evidence (RWE) is an accepted method to supplement a product’s evidence base. It is often analyzed retrospectively (e.g. from electronic medical records), but this can lack granularity – especially for medical devices that fall under procedure or diagnosis-related group (DRG) codes. Prospective collection of RWE at site-of-service can facilitate device-specific endpoint assessment. The General Data Protection Regulation (GDPR) and higher regulatory requirements for patient data collection, however, require a privacy-by-design concept to be employed. Here we describe a workflow for GDPR-compliant device-specific RWE collection as part of quality improvement initiatives.

METHODS : Initial literature review identifies clinical and quality markers relevant as endpoints to the investigated technology. During a round table including clinical experts, GDPR specialists, data scientists, and software developers, these endpoints are scored on their clinical impact, privacy sensitivity, analytic value, and feasibility for collection. Only endpoints meeting a predefined cut-off are considered quality markers for the quality improvement initiative. Finally, an RWE data collection app is designed to collect the identified quality markers using the principles of data protection by design. This includes either longitudinal, pseudonymized data or single-time point, anonymized data collection.

RESULTS : Using this approach relevant clinical markers were identified in a GDPR-compliant manner and did not raise objections from compliance of participating sites. The data collection app design ensured that no patient rights were violated while maintaining minimum requirements on patient information and consent. The pilot programme collected data on over 5,000 procedures. This is the largest single data set available for the tested monitoring technology. While previous studies recorded only adverse event data, this programme was the first to collect patient outcomes in sufficient quantity for analysis.

CONCLUSIONS : GDPR and RWE are not mutually exclusive. Careful design aligned with data protection standards can facilitate RWE collection of efficacy and safety data at minimal patient risk.