PII handling and adverse event monitoring in patient surveys

Patient surveys that collect health information have specific obligations around personally identifiable information and the possibility of adverse event disclosure.

This article explains PII handling requirements for patient DCE studies, how to set up adverse event monitoring in SurveyEngine, and what to do when a respondent discloses an adverse event.

Ben White, 07.07.2026

The PII and adverse event challenge

Patient preference studies collect sensitive personal health information - diagnosis, treatment history, symptoms, functional status. This information is subject to strict data protection requirements under GDPR, HIPAA, and other frameworks. Mishandling patient data can result in regulatory sanctions, reputational damage, and a breach of participant trust.

In addition, some patient surveys create situations where respondents may disclose previously unreported adverse events - side effects, symptoms, or safety signals that have not been reported to the sponsor or regulator. In studies conducted in the context of a clinical development programme, there may be regulatory obligations to collect and report such disclosures.

Regulatory requirements for patient data

Under GDPR (EU/UK), health data is a special category of personal data requiring explicit consent for processing, lawful basis for collection, data minimisation, and documented data retention and deletion procedures. Sponsors conducting patient preference studies in support of drug development programmes must ensure the study is conducted under a GDPR-compliant data processing agreement.

HIPAA (US) requires that identifiable health information is protected under a Privacy Rule and Security Rule framework. Patient preference studies conducted in the US that involve covered entities (healthcare providers or insurers) or their business associates must comply with HIPAA.

Adverse event reporting requirements vary by regulatory framework and study context. Studies conducted in the context of a clinical trial must follow the trial's adverse event reporting procedures. Standalone patient preference studies may have contractual obligations to the sponsor to report adverse events disclosed during the study.

TLDR Quick links

SurveyEngine health resources

Ethics approval article

Open a free account

Setting up PII and adverse event handling in SurveyEngine

Step 1: Minimise PII collection. Collect only the data you need for the study. Rreview each question and remove any that collect PII that is not essential to the research objectives. Do not collect names, addresses, or contact details unless specifically required.

Step 2: Configure data encryption and access controls. SurveyEngine encrypts data in transit and at rest. Also consider automatically anonymising IP addresses. Configure project access controls so that only authorised team members can access the patient data. Use role-based access to restrict data export privileges.

Step 3: Set up the adverse event monitoring protocol. In the survey introduction, include a statement that the study is not a medical consultation and that respondents should contact their healthcare provider for any medical concerns. Define the threshold for what constitutes an adverse event disclosure in the context of your study. Ensure all members of your research team, and providers are briefed on the process for AE reporting. Even an innocuous non-interventional health study may trigger an Adverse Event.

Step 4: Add a real-time monitoring flag. If your study is in the context of a clinical development programme, add a question asking whether the respondent has experienced any new or worsening symptoms since starting treatment. Flag responses to this question for daily review by the pharmacovigilance team.

Step 5: Establish data retention and deletion procedures. Define how long patient data will be retained after the study ends and how it will be securely deleted. Document these procedures in the data management plan and ensure they are implemented in SurveyEngine's data settings.

Worked example - pharmacovigilance in a HEOR study

A HEOR study of treatment preferences in a rare disease includes a question asking whether the respondent has experienced any new symptoms in the past 3 months. The study protocol specifies that any response indicating a new or worsening symptom that could be treatment-related must be reviewed by the sponsor's pharmacovigilance team within 24 hours.

SurveyEngine's real-time notification system is configured to send an alert to the pharmacovigilance team whenever a respondent answers 'yes' to the symptom question. The alert includes the respondent's anonymised study ID and the text of their symptom description. The pharmacovigilance team reviews each alert and determines whether a formal adverse event report is required.