Statement of Appropriate Use

The affirmation

By using the Stony Brook Medicine installation of REDCap (accessed at redcap.stonybrookmedicine.edu), I affirm that I understand and will abide by all policies, regulations, and laws that apply to my projects and their data, including those mandated by the Stony Brook Medicine HIPAA Privacy Office, the Stony Brook University IRB, and any project sponsors. I understand that if I am in violation of any of these institutional, State, or Federal regulations, I will be subject to disciplinary action from the appropriate authorities.

In addition, I understand and agree to the following practices:

Keep my account information private

1. My login credentials are created for me and me alone. I will safeguard these credentials and will not share them with anyone else, nor will I attempt to log in using credentials belonging to someone else.
2. I will configure My Profile in REDCap (upper-right corner) using only my own organizational email address and not anyone else's. If I do not have an organizational email address (for instance, ending in stonybrook.edu or stonybrookmedicine.edu), I will make a request for one before using REDCap.

Keep user access privileges to my project accurate and up to date

1. If there are Projects in which I have the ability to grant and revoke access to other users, I will obtain training in how to manage user access in REDCap and keep all user access rights up to date according to the policies governing my Project.
2. I will only add users who are authorized to access my projects and will not assign more access than is appropriate to each user (Principle of Least Privilege). If any user is leaving (or getting reassigned from) my project, I will disable their project access once their study participation is complete.
3. I understand that REDCap system administrators cannot change, add, or remove user access to any of my Projects, because user rights in REDCap Projects are self-managed. To ensure my project isn't “orphaned” when I leave, I understand that I can grant access to a colleague or project director after they log in to set up their account.

Protect human subject & other regulated data

1. I will ensure I have the appropriate and up-to-date training and certifications (ex: CITI, HIPAA, Responsible Conduct of Research) before I begin working on my REDCap data collection projects.
2. If I am a faculty director or principal investigator of a study or project, I will ensure members of my team are appropriately (ex: IRB, CITI, HIPAA, RCR) trained and certified before handling sensitive data in REDCap.
3. I will conduct all project activities according to the institutional policies and processes that govern my project (IRB, Division of Regulatory Affairs, HIPAA, etc.), including ceasing all activities in Projects whose approval period has lapsed.
4. I will handle sensitive and regulated (ex: PHI) data I have downloaded from REDCap onto my devices, local workstation, servers, etc. with utmost care, and with the understanding that once sensitive data leaves my REDCap project, it becomes solely my responsibility to protect this data from unauthorized access. I will not save such data onto mobile devices unless they are approved by Stony Brook Medicine.
5. I will mark all fields categorized as Protected Health Information (PHI) — including names, dates, addresses, and MRNs — as “identifiers,” to document the number of sensitive data elements in the project and elevate the user privileges required to export/download these elements.

Abide by audits and investigations

1. I understand that REDCap administrators are obligated to grant access to regulatory authorities such as the Office of Research Compliance, the HIPAA Privacy Office, the Information Security Office, and funding agencies for purposes of audits and investigations, if it is requested and deemed reasonable.

If I leave my project, my position, or the University

1. I understand that I can grant access to another authorized team member prior to leaving my position to ensure the project isn't “orphaned” or left without a project manager after my departure.
2. I understand that if I leave Stony Brook University (SBU), I must obtain permissions from SBU to take data with me to my new organization. Unless otherwise agreed upon, only de-identified data can be transported to another institution, and only with permission from the University.

Cite REDCap

I agree to cite REDCap on any publication that has benefited from its use. Suggested citation language:

• Paul A. Harris, Robert Taylor, Robert Thielke, Jonathon Payne, Nathaniel Gonzalez, Jose G. Conde, Research electronic data capture (REDCap) — A metadata-driven methodology and workflow process for providing translational research informatics support, J Biomed Inform. 2009 Apr;42(2):377–81.
• PA Harris, R Taylor, BL Minor, V Elliott, M Fernandez, L O'Neal, L McLeod, G Delacqua, F Delacqua, J Kirby, SN Duda, REDCap Consortium, The REDCap consortium: Building an international community of software partners, J Biomed Inform. 2019 May 9 [doi: 10.1016/j.jbi.2019.103208].