All REDCap projects begin in Development mode. After the project is developed and tested, it must be moved to Production mode before collecting "real" data, as part of the standard lifecycle of a REDCap project.

Per regulations

  • For research projects, be sure to obtain approval from the proper regulatory offices, such as the SBU IRB, RDRC, and others.
  • For QA/QI projects, be sure to complete the "QA vs. Research" application so the project is properly designated and vetted. All QA projects are expected to be authorized by a departmental QA board or the SBM Chief Quality Officer and to follow appropriate ethics and processes (for example, a quality plan document defining goals, metrics, and endpoints). For more, review SBU's Quality Improvement SOP and Requirement 2 below.

Benefits to moving your project to Production

  • Moving a project to Production helps ensure long-term accessibility, data protection, compliance, and a limited degree of support for your REDCap project.
  • When you make changes in Production, REDCap offers built-in checks to safeguard against unintentional data loss (for example, from deleting a field, changing a field type, altering a multiple-choice option, or rewording a field prompt):
    • A "summary of changes" page becomes available, previewing all the fields that are added, removed, and modified, and drawing attention to changes that could corrupt or delete data.
    • Changes considered higher-risk are forwarded to the REDCap Support Team for approval before they take effect. The vast majority of change requests are approved (or answered) within 1 business day.
    • Each approved revision to the data dictionary (instruments and/or field definitions) is archived, tracked, and can be compared with other revisions in a detailed view.
  • The number of Production projects is reported weekly and is cited to justify continued support for REDCap at Stony Brook.
  • Retention of data is not guaranteed, and data recovery services are not offered, for projects in Development mode. Data in Production and Post-Production projects remains secured.
Projects that capture "real" data in Development mode do so at their own risk. Because of the higher risk of data loss or corruption, and their unverified status, REDCap administrators are unable to help restore user access, track down lost data, and so on for Development-mode projects.

Requirements for Move to Production

All projects submitted for Production status must meet basic documentation requirements, to verify compliance and enable administrative oversight. Before submitting your request, please use this checklist so your project can be approved quickly.

  1. Accurate purpose. Under "Modify Project Settings," select an accurate Purpose for your project. Projects labeled "Just for Fun" are not moved to production in this system.
    REDCap Project Setup page: the Modify project title, purpose, etc. button (1) opens Modify Project Settings, where the Purpose of this project menu (2) lists Practice / Just for fun, Operational Support, Research, Quality Improvement and Other

    Why this is required: it helps the REDCap team understand the project and know which requirements to look for.

  2. Appropriate approvals.
    • A) Research projects: an approved IRB number is required (under Project Setup, "Modify Project Settings").
      Modify Project Settings with Purpose set to Research, the P.I. name and email filled in, and an arrow pointing to the IRB number field
    • B) QA/QI projects: a copy of the approval letter or email signed by the Office of the CQO, acknowledging that the project can be conducted, is required. Attach the original approval email by dragging and dropping it into a new message in Outlook, address it to REDCapAdmins@stonybrookmedicine.edu, and CC your faculty project director. (Only original emails sent by the approver are accepted; we can't accept forwarded emails.) For more guidance, review the SBU standard operating procedures for QA/QI projects.
    • C) Small-scale, low-risk operational projects (not research, QA, or clinical): in "Project Setup > Modify project settings," provide a description of the project's purpose, the expected number of records, the planned completion date, and a faculty-level supervisor. Before a study collecting patient data can be considered for this category, it must be submitted to the IRB for review and, if categorized as "Not Research," also submitted for QA/QI evaluation with the appropriate responses.
    Clinical projects: SBM REDCap is not approved for use in clinical care or operations, because of auditing and support concerns, regardless of whether the data will be used for research at some point in the future. REDCap may only be used to capture data in QA/QI projects, research studies, and small-scale, low-risk internal survey projects with well-defined endpoints, as described above.

    Why this is required: it verifies that the project operates aboveboard and has received approvals from institution-sanctioned regulatory bodies such as the IRB and the Office of the Chief Quality Officer (CQO). It also makes sure shared IT resources go to projects that meet compliance requirements and align with institutional missions.

  3. Faculty access. The faculty-level director or P.I. has been granted access with User Rights privileges to the project.
    • If they have not logged in to REDCap before, please have them complete a quick, one-time login to set up their account.
    • Once they have logged in to REDCap @ SBM and confirmed their email address, they can be added from the "User Rights" page.
    User Rights grid with the Principal Investigator role highlighted and a check in the User Rights column

    More on the user onboarding process is in our access guide.

    Why this is required: it helps keep projects from becoming "orphaned" through employee turnover, so projects stay available to the right people. It also confirms the project director knows about and takes part in the project. (Project directors and PIs are ultimately responsible for safeguarding the data collected in their studies.)

  4. Flag identifiers. HIPAA-controlled PHI fields (names, dates, MRNs, and so on) are flagged as "identifiers." This includes age fields, unless the age field is validated as an "integer" and all entries are expected to be under 90 years old. Use the "Check for Identifiers" link in Project Setup.
    Design your data collection instruments step in Project Setup, with an arrow pointing to the Check For Identifiers link

    Why this is required: it guards against a data breach by placing PHI fields in a higher sensitivity tier, where only users with "full data set" permissions can export data from these fields (through "Data Exports, Reports, and Stats"). It also lets administrators monitor how many projects capture sensitive data elements, and which ones.

  5. Documented team member. The requestor is listed as a P.I. or study team member on the project's IRB protocol.
    The Contacts tab of the study record in the IRB system, listing the study team

    Why this is required: it verifies the link with the IRB record and confirms the requestor is a documented member of the study team. Also, per IRB guidelines, everyone with access to the study data through REDCap is considered "engaged in research" and should be listed on the protocol as a member of the study team.

Submitting your request

When you're ready, click Request for Move to Production at the bottom of the Project Setup page to submit your project for review.

The Move project to production button at the bottom of the Project Setup page

It usually takes 1 to 2 business days to approve a move to production request that meets all of the requirements above.

Please note: this process checks only for the documentation required to move to production. For a technical review of your project design, or for suggestions on how best to design your project, get in touch with the REDCap support team at REDCapAdmins@stonybrookmedicine.edu. In your message, include any project documentation, such as an IRB protocol or QA project plan, and your REDCap project ID (PID) if it exists.