Privacy by design in clinical trial pre-screening

How data minimisation and pseudonymisation enable safer, smarter patient matching

Clinical trials are increasingly leveraging real-world clinical data to identify eligible patients earlier and more accurately. Instead of relying on patient self-referral or manual chart review by research coordinators, modern systems can proactively pre-screen electronic health records (EHRs) to surface potential eligibility signals.

However, this capability introduces a fundamental tension: clinical trial matching requires rich, sensitive medical data, while privacy regulations and ethical standards demand strict limits on what is collected, processed, and exposed.

Two core principles help mitigate this tension when applied correctly: data minimisation and pseudonymisation. This blog explores how these principles work in practice in clinical trial pre-screening, and how techniques such as masking and noise injection can preserve analytical utility while reducing identifiability.

Anchoring patient selection to real-world clinical events

Data minimisation should begin before any records are accessed. The first question is not what data do we need, but which patients should be considered at all.

Traditional pre-screening approaches often rely on broad diagnosis codes or demographic filters, producing large cohorts that require extensive manual review. A more privacy-conscious and clinically meaningful approach is to anchor selection to a triggering clinical event, something that has recently occurred or is imminent in the patient’s care journey.

Examples include:

• A scheduled consultation where treatment decisions are likely to be made

• Evidence of disease progression (e.g., worsening labs or imaging findings)

• A change in therapy line, suggesting treatment failure or intolerance

• A new specialist referral indicating diagnostic uncertainty or escalation

  
  

Grounding selection in real clinical events rather than static database queries reduces the number of patients processed, increases the proportion of genuinely relevant candidates, and demonstrates that data access is purposeful and proportionate.

Selecting only the relevant clinical documents

Once a potential patient cohort has been identified, the next step in minimisation is determining which parts of the electronic health record are actually needed.

A full EHR may include years of clinical notes, imaging reports, prescriptions, lab histories. Most of this content is irrelevant for any specific trial, and unnecessary review increases both privacy risk and operational burden.

Instead, document selection should be tightly aligned with protocol-specific eligibility criteria. For example, a respiratory drug trial might only require:

• The most recent pulmonary function test (PFT)

• The latest pulmonology consultation note

• A recent chest CT imaging report

• Relevant laboratory values (e.g., eosinophil count)

Older or unrelated documents, such as dermatology visits or decade-old routine blood tests, can be excluded entirely.

Pseudonymisation: separating identity from clinical meaning

Even with minimisation in place, clinical data remains inherently sensitive. Health records often contain direct identifiers such as names, dates of birth, and addresses, as well as indirect identifiers embedded in free-text notes.

Pseudonymisation mitigates this risk by replacing or transforming identifying fields so that individuals cannot be directly identified without separate information held elsewhere.

In clinical trial pre-screening, however, pseudonymisation must preserve clinical utility. The goal is not full anonymisation (which would often eliminate usefulness), but a controlled reduction in identifiability while maintaining meaningful structure in the data.

Masking and generalisation work together to remove or reduce identifying information while preserving the clinical context needed for eligibility matching. Masking focuses on eliminating or transforming direct identifiers, while generalisation reduces the specificity of data elements that could contribute to re-identification when combined with other variables.

Examples include:

• Removal of Phone numbers, email addresses, full home addresses

• Replace patient names with pseudo-IDs

• Replace exact birth dates with age ranges (e.g., 60–65 years)

• Group exact admission dates into broader periods such as weeks or months

The goal is to preserve medically relevant signals while avoiding uniquely identifiable combinations of attributes.

Noise injection: reducing identifiability in structured data

Noise injection modifies numerical values slightly to prevent re-identification through unique combinations of data points. This technique is especially relevant for structured clinical variables such as, Laboratory results , Vital signs , Risk scores, or dates.

Instead of exposing exact values, small controlled perturbations are introduced:

• Hemoglobin 12.3 g/dL → 12.1 or 12.5 (within a safe margin)

• Blood pressure values may be rounded or slightly adjusted

• Time intervals may be jittered by ±1–3 days

  
  

In clinical trial pre-screening, this approach works well because eligibility criteria are typically threshold-based rather than exact-match-based:

• Hemoglobin > 10 g/dL

• No prior therapy within 6 months

  
  

Small perturbations rarely affect eligibility classification, but they significantly reduce the risk of re-identification when combined with other attributes.

Instead of:

Oncology Consult, 21/05/2026 “John Doe, born 14 March 1958, living in Hasselt, first admitted on 3 February 2026 following progression of metastatic non-small cell lung cancer.

Hemoglobin: 12.3 g/dL, eGFR: 61 ml/min/1.73m²"

The pre-screening dataset may retain:

Oncology Consult, May 2026 “Male, 65–70 years, admitted 6 February 2026 following progression of metastatic non-small cell lung cancer.

Hemoglobin: 12 g/dL, eGFR: 63 ml/min/1.73m²"

The key principle is:

Preserve clinical meaning while removing direct re-identification pathways.

Conclusion

Combining event-driven patient selection, criteria-specific document retrieval, and robust pseudonymisation creates a pre-screening workflow that is both more efficient and more privacy-preserving than traditional approaches.

This approach not only improves compliance with data protection requirements but also strengthens trust with patients and institutions. In an environment where access to clinical data is increasingly scrutinised, demonstrably privacy-respecting pre-screening is becoming a practical necessity, not just an ethical preference.

The result is a system that is compliant by design, more targeted in execution, and better aligned with the long-term requirements of data-driven clinical research.