The pharmaceutical industry is facing mounting legal exposure for free diagnostic support programs, with compliance risk tied to how patient data is used to generate prescription leads. Executives cited multiple enforcement actions and warned that structuring matters—patients may benefit, but programs still must avoid Anti-Kickback violations when individual-level data drives downstream targeting. In parallel, regulators are tightening enforcement on data handling. Italy fined IQVIA €7 million for unlawfully processing identifiable health information from roughly one million patients, rejecting the company’s argument that patient codes ensured anonymity and highlighting re-identification risks through persistent linkage and free-text data. For biotech operators, both developments raise the bar for how clinical-data programs are designed, governed, and documented—especially when diagnostic results are paired with commercial outreach or when external analytics rely on privacy-sensitive records.