Access to data from the Norwegian Prescription Database
The Norwegian Prescription Database (NorPD) contains information about prescription drugs dispensed in Norwegian pharmacies. Over-the-counter drugs are not included.
The NorPD has its own website www.norpd.no where you can create reports on the number of users of a particular drug or drug category. These data are accessible from 2004, with an annual update in March/April for data from the preceding year.
Application for data
The Norwegian Institute of Public Health (NIPH), as the data controller of the NorPD, may disclose more detailed data from the NorPD for projects that are in accordance with the objectives stated in the NorPD regulation. All applications are evaluated by the NorPD Data Access Evaluation Group.
How to apply for statistical data (tabular data)
For more detailed statistical data (aggregated data / tabular data) than found on www.norpd.no it is possible to submit an application. Use the online application form Anonyme aggregerte data at helsedata.no (Norwegian only).
In case you cannot read Norwegian, please use the NIPH's online form. Choose the application form ‘Application for statistical data’. You will find links to the forms in the article Application for access to data at fhi.no
The application must include a precise description of the requested data, including metrics, period of time, drugs (ATC codes) etc. An empty table (shell table) showing the desired table layout (with only row and column names) should be attached. Statistical data from the NorPD are generally delivered in excel format.
How to apply for data for health analysis or research
(including linked data with other data sources)
In a research dataset each drug dispensed to each individual is presented in one data row. Use the online application form “Personidentifiserbare data” at helsedata.no (available in Norwegian only). You will be asked to log in with a Norwegian electronic ID. If you do not have an electronic ID, you will have to use the NIPH Application form. Choose the application form ‘Application for access to data’.
A completed list of required variables from the NorPD must be attached to the application (see below). You should only apply for variables that are necessary and justified by the research project's purpose. Research data from the NorPD are generally delivered as a semicolon separated txt.file.
Data from the NorPD can be linked to data from other health registries and other data sources with access to the full identity of the individuals in the study population. The data linkage will follow a standard procedure for linkage of data with the NorPD.
The data responsible institution must document the lawfulness of processing of the data. See the below section on legal requirements for more information.
If you have any questions, please contact the NorPD by e-mail: firstname.lastname@example.org, or by telephone: 21 07 70 00 (switchboard).
Legal requirements for the disclosure of data from the NorPD
Disclosure of anonymous data / tabular data does not require any special legal permission, cf. the NorPD regulation § 5-1. This also applies to the preparation of anonymous tabular data based on linked data from registries listed in the NorPD regulation § 5-3, first paragraph.
Ensuring the anonymity of a research dataset from the NorPD is difficult. See also the Norwegian Data Inspectorate’s website on the anonymization of personal data.
An anonymous dataset will need to have few and roughly categorized variables, usually resulting in limited value for research and health analysis.
It is not possible to determine in advance that a dataset is actually anonymous. Anonymization requires analysis of the dataset focusing on the limitation of unique combinations of variables in the dataset, e.g. that variables and combination of variables applying for less than 5 individuals shall not be displayed. This is challenging with prescription data with many unique combinations. Research datasets from NorPD are normally regarded as indirectly identifiable personal data.
Disclosure of indirectly identifiable data from the NorPD must be in accordance with the NorPD regulation § 5-2, and § 5-3 for data linkage. The Data responsible institution is responsible to ensure that all processing of personal data in the project is according to GDPR. This includes assessing whether it is necessary to carry out a Data protection impact assessment (DPIA) prior to the processing.
Before the application for data (applicable for NorPD research file only and for linked NorPD data) can be evaluated by the NIPH we ask you to submit the following:
- Documentation of the lawfulness of processing of special categories of personal data cf. GDPR art. 6 (1) a-f and art. 9 (2) a-j, and if necessary the basis laid down by Union Law of Member State law (to which the controller is subject) cf. GDPR art.6 (3) and art.9 (2) g-j.
- Copy of the consent form (if the project is based on informed consent in accordance with GDPR article 4 number 11) or decision from a competent authority on exemption from statutory confidentiality for all personal data to be processed in the project, and copy of the corresponding application.
- The application for and the advance approval of the project from the Regional Committees for medical and health research ethics (REK) for health research projects
- Information about planned ‘purpose limitation’, ‘data minimisation’, ‘storage limitation’ and ‘integrity and confidentiality’ (i.e. that the personal data will be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage) in the project.
If the project has carried out a DPIA, this will normally be included in the DPIA, and a copy of the DPIA, approved by the responsible institution, can be submitted.
We recommend that you contact your data protection officer if you have any questions regarding this.
About the implementation of the General Data Protection Regulation in Norway – July 2018
A new Personal Information Act came into force in Norway 20 July 2018. This means that the General Data Protection Regulation was made applicable in Norwegian law. In this connection, the previous requirement of a license from the Data Inspectorate was removed.
Advance approval from REK for health research projects as well as a confidentiality exemption from REK (cf. Health Research Act § 35) or the Directorate of Health (cf. Health Personnel Act § 29b) is however still required, unless the project is based on informed consent in accordance with GDPR article 4 number 11.
According to the regulations, the NorPD has a:
- 30 days delivery deadline for statistical data and research file from NorPD only. For more complex statistical data longer delivery deadlines must be expected. The delivery deadline will be agreed with the applicant.
- 60 days delivery deadline for linked NorPD data. The 60 days delivery deadline applies from the date when NorPD has received all necessary documentation and all data files from the other data sources.
The current cost of obtaining information from the Norwegian Prescription Database is NOK 1025 per hour’s work, excluding VAT.
According to Norwegian legislation, a decision about data delivery can be challenged. Any complaints should be sent to the Norwegian Institute of Public Health. If the institute does not respond satisfactorily, the appeal can be sent further to the Ministry of Health and Care Services for a final decision.
All publications and presentations that use data from the Norwegian Prescription Database must refer to it as the source.
If acronyms or abbreviations are required, please refer to NorPD (in both English and Norwegian).
All publications should include "The Norwegian Prescription Database" in the title or abstract text to highlight the register in PubMed searches