What Clinical Trial Tokenization Links, What It Misses and What It Costs

On 7 August 2026, Frontiers in Pharmacology published a methods paper by authors from Bayer, Moderna, Merck, Datavant and others. It shows the full funnel of one tokenised trial linkage. ROSE was an optional sub-study of ConquerRSV, Moderna's phase 2/3 trial of an RSV vaccine in adults aged 60 and over. At the 109 US sites that took part, 10,994 participants agreed to have their records linked, 67 per cent of participants at those sites. Of those, 4,242, or 38.6 per cent, were linked to Medicare fee-for-service or selected commercial and Medicare Advantage claims. Uninsured participants could not be found at all.

That funnel is what the industry sells as "trial tokenization" or "clinical trial tokenization". It is privacy-preserving record linkage. A participant's name, date of birth, sex and ZIP code are turned into a one-way hashed code, the token. The same person can then be found in claims, electronic health records (EHRs) or mortality data without the sponsor holding the identifiers. Sponsors use it for follow-up after a trial closes, for checking external comparators, and for the cost evidence payers ask for. It has nothing to do with crypto-assets or blockchain, or with the tokens a language model counts.

How does tokenisation work in a clinical trial?

Three steps sit behind every vendor diagram.

Capture. After consent, the site collects identifiers outside the trial database. A 2024 practical guide by HealthVerity and Gilead authors says that in most trials a coordinator types them into a hosted web portal. ROSE used first and last name, date of birth, ZIP code and sex. Only tokens and study IDs left for linkage.

Hashing. The identifiers go through a salted one-way hash, so they cannot be recovered from the token. Datavant's white paper adds a second step. The hash is encrypted with a key specific to each data holder, so the same person carries a different token in every dataset. Tokens are transformed into the recipient's scheme when two datasets are matched. Several tokens are usually made from different combinations of fields, so an error in one field need not lose the match.

Matching. The tokens are matched against claims, EHR, laboratory, pharmacy or death data. The sponsor receives its trial IDs, the tokens and de-identified real-world records for the people found.

Matching is not exact, and the evidence on how inexact is thin. A 2025 systematic review by two Pfizer authors found only five studies, from 2013 to mid-2023, reporting precision and recall for this kind of linkage in health data. In 2022 Bernstam and colleagues tested tokens on 20,002 manually reviewed record pairs from one Texas data warehouse. A token built from first name, last name, sex and date of birth reached 99.9 per cent precision. The best recall, 95.5 per cent, needed Social Security numbers, which trial sites rarely collect. Four authors were Datavant employees and Datavant part-funded the work. It measured duplicates inside one institution, not a trial matched to an outside claims file.

What did the published linkages actually find?

Two tokenised trial linkages publish full denominators we could check. Two Medicare linkages, matched directly on identifiers rather than tokens, show what claims can and cannot measure.

Sources: the SEPRA ISPOR 2023 poster, Meinecke et al. 2026 for ROSE and CoreValve, and Fillit et al. 2024 for AD-LINE.

Three lessons repeat.

Yield is set by insurance and by what you licensed, not by the hash. ROSE could not find uninsured people. CoreValve's non-matches were mostly Medicare Advantage members, outside the fee-for-service file. SEPRA's licensed claims ran from 1 July 2017 to 31 October 2020, while enrolment ran from July 2018 to March 2021. The poster notes that some participants lacked a full baseline year in the licensed period.

Linked people differ from the rest. SEPRA's linked participants were 2.4 years younger on average than the whole trial. Fewer lived in the Northeast (10.7 against 13.1 per cent). That is modest. It is also the kind of comparison FDA asks sponsors to report.

Claims do not measure what the trial measured. The ROSE authors warn that endpoints captured passively in claims can differ from same-named endpoints in a monitored trial. A PCORnet analysis using Datavant tokens found that adding claims to EHR data raised the recorded prevalence of every clinical characteristic by 63 to 173 per cent.

The Meinecke paper is also clear about a gap: "No current regulatory guidance or consensus standard establishes a minimum acceptable linkage rate."

What the vendor case studies show, and what they leave out

Four case studies in our library involve tokenised data. They prove very different things.

Datavant's focal seizure study covers a 36-week phase IV study of 175 patients at 40 sites, for an anti-seizure drug it does not name. The case study PDF says each site tokenised its participants. The trial was linked to one claims partner from four years before the trial to one year after. The aims are payer evidence: baseline utilisation, total cost of care, and persistence at six and twelve months. It shows the design pattern well. It reports no match rate and no result, only that the dataset "is being used". It also plans to count seizures from claims, which record billed encounters and dispensings. A seizure that produces neither leaves no trace.

Datavant's COVID-19 vaccine study is the retrofit case. The sponsor of a 30,000-participant placebo-controlled phase III trial wanted long-term follow-up after the trial had started. The PDF says participants were re-consented through the CRO's e-consent platform and could opt out without leaving the trial. It then reports all 30,000 tokenised, which sits oddly with an opt-out. A graphic shows 27,930 overlapping with a national claims dataset, without saying whether that is this trial's result. No outcome is reported.

HealthVerity's account of Novo Nordisk's SEPRA trial is the most quantified, and its core numbers match the Novo Nordisk poster. Two claims in the vendor's blog go further than the data. It says similar baselines suggest "the trial population closely mirrors real-world patients". But the comparison was between the trial and the linked half of the same trial. That shows the linked half resembles the whole, not that the trial resembles patients outside it. The blog also claims about 0.2 per cent false positives and 3 to 5 per cent false negatives. It sets these against 1 to 3 and 9 to 42 per cent for traditional deterministic methods. Those figures are footnoted to a trade-magazine article and a paper on rare-disease claims data, not to a published evaluation of the product.

Norstella's oncology case explains the phrase "tokenized patient data". A manufacturer bought open and closed claims from several vendors and linked them with a third-party token engine. MMIT then appended plan ID, payer, formulary tier and coverage status to the tokenised records. The output went to market access and to field teams for prescriber campaigns. There are no numbers. It shows that tokenised patient data is also a commercial asset, and trial tokens can join the same ecosystem. Datavant's 2025 trend analysis lists "bridge follow-up into commercialization" among sponsors' reasons to tokenise. Your consent form should say whether that is allowed.

What tokenisation costs in consent, privacy review and operations

None of the papers or case studies above discloses what a linkage cost. The costs that can be traced are consent, time, privacy review and data.

Consent. US research sites are usually HIPAA covered entities, so making tokens from their records needs the participant's authorisation or an IRB waiver. 45 CFR 164.508(b)(3)(i) lets that authorisation sit inside the trial consent. Where research treatment depends on signing one part, the optional part must be clearly separated, with "an opportunity to opt in". In practice that is a separate tick box, plus a decision on whether decliners can still enrol. A third of participants at ROSE's sites did not consent. ROSE also ran as a separate protocol that began enrolling about ten months after its parent trial. The HealthVerity and Gilead authors report better response when linkage consent is asked at enrolment. They also warn that withdrawals must be honoured after the trial's consent systems are switched off.

The consent should name the uses. An IQVIA paper on tokenisation practice describes a sponsor that linked participants to a consumer credit-reporting database. It took race and ethnicity fields to show it had met diversity goals. Datavant reports psychiatric disorders as the commonest therapeutic area among the trials it tokenises, and flags the sensitivity of mental health data.

Time. Medidata reported at ISPOR 2024 on 11 trials for 5 sponsors, with more than 103,300 participants. The median time from contract to the start of identifier collection was 19 weeks: 27.5 for a sponsor's first deployment and 15 for later ones. That is a vendor measuring its own process.

Privacy review. The linked dataset has to stay de-identified. 45 CFR 164.514(b) offers two routes. Safe harbour removes 18 identifier types, including every date element except the year, which would wipe out admission and dispensing dates. So linkage relies on expert determination: a qualified person finds the risk of identification "very small" and documents the method. ROSE and SEPRA both obtained a privacy certification. Adding trial variables to de-identified claims raises the risk, and the IQVIA authors warn that each extra dataset makes the determination more restrictive. Trial fields can come back coarsened or deleted. Experts also disagree on method. The IQVIA authors list date-shifting as a fix. Datavant's white paper says it does not shift service dates, because the certifiers it works with doubt the method.

Data. A token is not data. Someone still licenses the claims or EHR records for a fixed window, as SEPRA's cut-off shows. Tokens also decay as people change name or address, so long follow-up needs periodic re-linkage. And converting one vendor's tokens to another's through a crosswalk is, the IQVIA authors say, often less accurate than tokenising the original identifiers again.

What binds: FDA, ICH, HIPAA and the GDPR

Position current at 12 October 2026.

FDA's August 2023 guidance is the one that bites, although it is written about non-interventional studies. Sponsors must be able to submit patient-level data for any real-world data they analysed, where 21 CFR 314.50 and 601.2 require it. Data owned by others should come with agreements that let FDA have it and inspect the source. A third party can file it in a pre-IND or drug master file instead, but FDA "does not currently accept links to external databases". Check your claims licence allows this before you build an endpoint on it.

The July 2024 guidance on EHR and claims data mentions linkage tokens once, under de-identification. It asks for the linkage algorithm, match rates, error rates and a comparison of linked and unlinked records. Devices get more room. The December 2025 device guidance says "a sponsor's inability to obtain participant-level data does not preclude FDA's evaluation". The two drug guidances above say no such thing.

For trials, ICH E6(R3) Annex 2 is the closest thing to a rule, and the EMA lists its EU effective date as 15 January 2027. Section 3.5.1(c) says "accurate matching to the individual should be assured", and that linkage and conflict resolution between sources should be pre-specified. Section 3.4.1 makes the sponsor responsible for oversight of linkage done by others. Where real-world data support key endpoints, sponsors may need source records to confirm events, and should consult regulators if data owners' terms prevent it. A sponsor used to verifying trial data against source documents cannot do that for a de-identified claims line. Our analysis of how E6(R3) assigns oversight of systems and external data covers that duty.

Europe starts from a different place. GDPR Recital 26 says pseudonymised data "should be considered to be information on an identifiable natural person". On 4 September 2025, in EDPS v SRB, the Court of Justice held that pseudonymised data is not personal data "in all cases and for every person". The case concerned the EU institutions' data protection regulation, whose definitions mirror the GDPR. The test is whether a recipient could reasonably identify people, for example by cross-checking with other data. A linkage vendor's business is cross-checking with other data. The Commission proposed in November 2025 to write the narrower reading into the GDPR. The EDPB and EDPS urged legislators not to adopt it, and the Parliament file still awaits a committee decision. For consent, Article 28(2) of the Clinical Trials Regulation lets sponsors ask at enrolment to use data outside the protocol for scientific purposes, withdrawable at any time. Where national identity numbers exist, tokens may not be needed: the methods paper describes a Nordic HPV vaccine follow-up linked almost completely that way.

What this means in practice

Work in the order the lead times force.

1. Decide what linkage is for before the protocol is final. Long-term safety, cost and external comparator checks need different data. Name each endpoint you will take from real-world data and check it exists in claims or EHRs at all. For an external comparator, tokens can also confirm your own participants are not in the comparator pool. Our note on what regulators have accepted for external controls sets out the bar.
2. Run a feasibility check with candidate data holders. Estimate how many likely participants each source covers, by age and insurance type. Uninsured patients, or Medicare Advantage members when you license only fee-for-service data, will not link.
3. Write the consent language now. A separate opt-in, named data categories, whether commercial use is allowed, how long identifiers are kept, and a withdrawal route that outlives the trial's systems. In the EU, align it with Article 28(2) and your GDPR legal basis. Adding it later means a separate protocol or a re-consent.
4. Negotiate contracts with FDA in mind. The licence should cover the full follow-up window, allow patient-level submission and allow source access for critical endpoints. Choose a token scheme the data sources you need already use.
5. Pre-specify the linkage. State the expected linkage rate, what you will do if you fall short, the linked-versus-unlinked comparison, a balance check by arm, and which source wins when trial and claims disagree. Put the reconciliation rules in the data management plan, next to the query workload they will create.
6. Commission the expert determination before linkage. Find out which trial variables will be coarsened while you can still change the analysis.
7. Report the whole funnel. Consented, tokenised, matched, analysable, and how the linked group differs from the rest.