For several months, the Junta de Andalucía has been publishing on its website the personal and clinical data of 23 multiple myeloma patients from the Virgen del Rocío Hospital, waiting to receive an innovative CAR-T therapy, called Carvykti, and whose delay in administration has had a negative impact on the patients’ life expectancy, as EL PAÍS reported on Wednesday.
The data is part of three reports from the hospital’s hematology service prepared to launch an emergency procedure to purchase the therapy, which professionals supported in all cases by referring to the “situation of serious danger in which the patient’s life finds itself”, according to the document.
These documents were published on the website of the Regional Governing Council after the meetings of 18 June, 4 August and 8 October. Since then, and until the end of last week – when all sensitive information was hidden by the Council with black stripes – the data was available to anyone who consulted the agreements made by the Regional Executive.
According to health sources, it was the complaints from members of the Hematology Service of the Virgen del Rocío Hospital that led the Council to cover up this information. The request was made when health workers discovered that their reports had been published in full.
The information includes date of birth or age, gender, month of myeloma diagnosis, previous treatments received, patient evolution and relapses, and adverse reactions suffered, among other clinical data. Likewise, the documents in some cases made predictions about the evolution of the disease and the reduction of life expectancy due to delays in the administration of CAR-T therapy.
The publication of this type of data has not occurred so far in other autonomous communities and could violate European and Spanish data protection legislation. This provides that any information regarding people’s health deserves special protection by public administrations.
“According to legislation and jurisprudence, the key in these cases is whether the patient himself can recognize himself in the information disclosed and whether third parties can identify him. And in this case it seems clear that the data made public allows this. Not everyone will be able to do this, but the patients themselves and the people who are part of their family, social, professional environment…”, claims Samuel Parra, a lawyer specializing in data protection.
This expert sees another problem in the published information. The medical report included language such as that “delays” in receiving CAR-T therapy meant “a decrease in disease-free survival expectations of approximately 20% in the first two years” or “implies a decrease in their disease-free survival expectations from more than 40 months to approximately 34.”
“These are very sensitive estimates and data managed by doctors that may not have been transmitted in this way to patients. Or, if they have been, they do not want it to be known to other people, even if they are close to them. Including all this information was not necessary for the processing of the purchase of the medicine nor is it required by the Transparency Law,” adds Parra.
Román Salesio, director of the specialized consultancy Sibprodasa, believes however that the protection of patient data would not have been violated since “the published information is not sufficient to effectively identify patients, even if the date of birth may have been ignored in the disclosed information”.
In any case, the expert recalls, current legislation provides, among other security measures, “the anonymization of information before the publication of a file, which includes names, ages…”; respect the “principle of necessity”, according to which only “the data strictly necessary to achieve the purposes of the processing and transparency must be processed, avoiding personal or clinical details”; and the application of filters that make files containing confidential information “restricted access”.
A spokesperson for the Regional Council of Andalusia denies that “personal data have been published” and defends that “the documents include the clinical evaluation of various patients carried out by hematology specialists to activate the urgent or emergency path, which allows us to accelerate access to treatment for patients who are candidates for CAR-T therapy”.
“This process – continues the spokesperson – is activated to accelerate the authorization for the purchase of this therapy on an extraordinary basis, thus allowing the start of treatment”. The Council defends that “thanks to these procedures, 15 multiple myeloma patients have received this treatment so far in 2025 and an additional 14 patients have been authorized to complete the CAR-T manufacturing process.”
Confidentiality clauses
The published files also reveal information that pharmaceutical companies guard very jealously: the clauses that regulate the payments that governments make for the most innovative drugs. Information that companies and administrations never make public because they consider it confidential.
The price of Carvikty paid by the Andalusian government amounts to 367,120 euros per patient (including VAT), according to published documents. This figure is obtained by dividing the total of the 4,038,320 euros expected for the purchase of therapies for the 11 patients included in the third report. The amount per patient represents a 16% discount compared to the 436,800 euros (including VAT) of the official price made public by Janssen.
The final amount per patient, however, is subject to a system called “payment by results” under which this amount will be paid in full only to “those patients who survive and are free from progression” of the disease 50 months after starting treatment.
According to information published by the Council, the payment for Carvykti is divided into five installments. The first is paid at the beginning of the treatment and is the highest, since it amounts to 33% of the total price, while the fifth would be paid after 50 months and corresponds to 15%. The other three installments are paid 12, 24 and 36 months after administration. The payment by results formula provides that the last two installments are paid only if the patient progresses favorably and without relapses.
The Janssen company has not yet commented on the publication of the contractual clauses.
