Staying Ahead of the Curve in Pharmacovigilance: Module VI Addendum II – Masking of Personal Data in Individual Case Safety (GVP)

In an era where patient safety and regulatory compliance are more critical than ever, staying informed about global pharmacovigilance trends is essential. The EMA and PRAC recently released the “Module VI Addendum II – Masking of Personal Data in Individual Case Safety (GVP).”

Our experts break down the key takeaways to help Marketing Authorization Holders (MAHs) and PV professionals understand what’s working and what needs attention.

What is the focus of the new EMA guidance in GVP Module VI Addendum II?
The guidance introduces a standardized masking policy for personal data in Individual Case Safety Reports (ICSRs), aimed at enhancing data privacy in pharmacovigilance. It was developed following an EPDS audit that identified the need for consistent pseudonymisation practices across EudraVigilance.

Which data elements must be masked in ICSRs?
A total of 13 data elements must be masked, including:

• Reporter’s personal details: title, given/middle/family name, organization, department, street, post code, telephone.
• Patient identifiers: medical record numbers (GP, specialist, hospital) and parent identification.

Which data elements must be left blank?

11 data elements must be left blank, such as:

• Sender’s personal details and address: title, given name, street, city, state, post code, country, telephone, fax.

Will this affect the EudraVigilance system or ICSR XML schema?
No. The technical implementation does not impact existing business rules or the ICSR XML schema.

Who can access pseudonymised ICSRs?
Only competent authorities and Marketing Authorization Holders (MAHs) will have access, and only through multi-factor authentication.

What data remains unmasked and why?
Critical data for signal detection remains unmasked, including:

• Patient demographics: name/initials, date of birth, age, sex, height, weight.
• Drug details, MedDRA-coded events, reaction outcomes, case identifiers, and literature references.

What actions should pharmacovigilance leaders take?
Leaders must:

• Update systems like Argus and global PV platforms to support auto-masking.
• Revise SOPs to incorporate null flavor codes (MSK, ASKU, UNK).
• Document implementation timelines and validate XML submissions.
• Ensure audit readiness for EMA or PRAC inspections.

When does this guidance take effect?
The effective date is July 25, 2025.