Source: https://www.fhi.no/en/op/data-access-from-health-registries-health-studies-and-biobanks/norwegian-prescription-database/Access-data-norpd/
Timestamp: 2019-04-24 12:51:51+00:00

Document:
The Norwegian Prescription Database (NorPD) contains information about prescription drugs dispensed in Norwegian pharmacies. Over-the-counter drugs are not included. The NorPD has its own website www.norpd.no where you can create reports on the number of users of a particular drug or drug category. These data are accessible from 2004, with an annual update in March/April for data from the preceding year.
The Norwegian Institute of Public Health (NIPH), as the data controller of the NorPD, may disclose more detailed data from the NorPD for projects that are in accordance with the objectives stated in the NorPD regulation. Application forms are available on the website of NIPH (see below). It is important to describe what the data will be used for (purpose) in the application. All applications are evaluated by the NorPD Data Access Evaluation Group.
For more detailed statistical data (aggregated data / tabular data) than found on www.norpd.no it is possible to submit an application. Choose the application form ‘Application for statistical data’. The application must include a precise description of the requested data, including metrics, period of time, drugs (ATC codes) etc. An empty table (shell table) showing the desired table layout (with only row and column names) should be attached. Statistical data from the NorPD are generally delivered in excel format.
In a research dataset each drug dispensed to each individual is presented in one data row. Choose the application form ‘Application for access to data’. A completed list of required variables from the NorPD must be attached to the application (see below). You should only apply for variables that are necessary and justified by the research project's purpose. Research data from the NorPD are generally delivered as a semicolon separated txt.file.
Data from the NorPD can be linked to data from other health registries and other data sources with access to the full identity of the individuals in the study population. To apply for linked data from the NorPD, you should also choose the application form ‘Application for access to data’. The data linkage will follow a standard procedure for linkage of data with the NorPD.
The data responsible institution must document the lawfulness of processing of the data. See the below section on legal requirements for more information.
Disclosure of anonymous data / tabular data does not require any special legal permission, cf. the NorPD regulation § 5-1. This also applies to the preparation of anonymous tabular data based on linked data from registries listed in the NorPD regulation § 5-3, first paragraph. Ensuring the anonymity of a research dataset from the NorPD is difficult. See also the Norwegian Data Inspectorate’s website on the anonymization of personal data. An anonymous dataset will need to have few and roughly categorized variables, usually resulting in limited value for research and health analysis. It is not possible to determine in advance that a dataset is actually anonymous. Anonymization requires analysis of the dataset focusing on the limitation of unique combinations of variables in the dataset, e.g. that variables and combination of variables applying for less than 5 individuals shall not be displayed. This is challenging with prescription data with many unique combinations. Research datasets from NorPD are normally regarded as indirectly identifiable personal data.
Disclosure of indirectly identifiable data from the NorPD must be in accordance with the NorPD regulation § 5-2, and § 5-3 for data linkage. The Data responsible institution is responsible to ensure that all processing of personal data in the project is according to GDPR. This includes assessing whether it is necessary to carry out a Data protection impact assessment (DPIA) prior to the processing.
Documentation of the lawfulness of processing of special categories of personal data cf. GDPR art. 6 (1) a-f and art. 9 (2) a-j, and if necessary the basis laid down by Union Law of Member State law (to which the controller is subject) cf. GDPR art.6 (3) and art.9 (2) g-j.
Copy of the consent form (if the project is based on informed consent in accordance with GDPR article 4 number 11) or decision from a competent authority on exemption from statutory confidentiality for all personal data to be processed in the project, and copy of the corresponding application.
Information about planned ‘purpose limitation’, ‘data minimisation’, ‘storage limitation’ and ‘integrity and confidentiality’ (i.e. that the personal data will be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage) in the project. If the project has carried out a DPIA, this will normally be included in the DPIA, and a copy of the DPIA, approved by the responsible institution, can be submitted.
We recommend that you contact your data protection officer if you have any questions regarding this.
A new Personal Information Act came into force in Norway 20 July 2018. This means that the General Data Protection Regulation was made applicable in Norwegian law. In this connection, the previous requirement of a license from the Data Inspectorate was removed. Advance approval from REK for health research projects as well as a confidentiality exemption from REK (cf. Health Research Act § 35) or the Directorate of Health (cf. Health Personnel Act § 29b) is however still required, unless the project is based on informed consent in accordance with GDPR article 4 number 11.
According to the regulations, the NorPD has a 30 days delivery deadline for statistical data and research file from NorPD only and a 60 days delivery deadline for linked NorPD data when datafiles from all data sources are available and necessary documentation is in place.
The current cost of obtaining information from the Norwegian Prescription Database is NOK 875 per hour’s work, excluding VAT.
According to Norwegian legislation, a decision about data delivery can be challenged. Any complaints should be sent to the Norwegian Institute of Public Health. If the institute does not respond satisfactorily, the appeal can be sent further to the Ministry of Health and Care Services for a final decision.
All publications and presentations that use data from the Norwegian Prescription Database must refer to it as the source.
If acronyms or abbreviations are required, please refer to NorPD (in both English and Norwegian).

References: § 5
 § 5
 § 5
 § 5
 art. 6
 art. 9
 art.6
 art.9
 § 35
 § 29