BioStat International, Inc.

rED Cap™ is a web-based product developed by Biostat International, Inc. for managing multi-site clinical research studies securely and safely over the Internet.

rED Cap™ is 21 CFR 11 compliant and supports HIPAA guidelines. It is designed as a standard-based, extensible platform. In particular, it is ODM v1.2.1 and ODM v1.3.1 compliant Clinical Data Warehouse.

rED Cap™ facilitates secure protocol configuration, study events and visit management, design of electronic Case Report Forms (e-CRFs), annotated e-CRFs, subject profiles.

rED Cap™ provides tools for dynamic and interactive entry validation, dynamic data flow controls based on entered data and automatic calculated fields.

rED Cap™ provides tools for queries and query resolutions, data query management tracking, convenient and centralized query workflow via the Query Station.

rED Cap™ provides re-tool capability while the study is active and ongoing to make protocol, visit, forms updates;

rED Cap™ export study defintion and/or study data into ODM XML format or Excel data sets;

rED Cap™ facilitates secure document exchanges, user and user role managment and dynamic reporting using standard web browsers.

rED Cap™ makes sure that all communications between our clients and our server are encrypted using strong 256-bit SSL certificate. No account information, documents or data are transmitted over the Internet without our strong 256-bit SSL encryption.

rED Cap™ is designed to be easily customizable. It fully supports web page display and data segregation. It also supports a wide range of customizations from study to study. It can handle double data entry of paper CRFs, blinded third-party entry, and management of unscheduled visits for observational studies.

rED Cap™ has advanced web-based user profile and dynamic user permission management facilities. The server is protected by an enterprise network security firewall.

rED Cap™ has sophisticated and dynamic flags and status icons that makes it simple and intuitive to use and manage.

Server Architecture:

Enterprise Server with Advanced RAID, Dual 2.4GHz Octa-Core E5-2630 v3 Haswell Xeon
Server OS: Enterprise Linux CentOS 7.6
Database: MySQL Server 5.7
Web Server: Apache httpd-2.4 with 256-bit SSL commercial Certificate
PHP 5 and Database Abstraction Layer MDB2
Data files and database stored in file system encrypted using LUKS, the Linux Unified Key Setup standard
All rED Cap™ activities and database updates are replicated into a mirror server
Backup done using the time machine mechanism to separate hard disk encrypted using LUKS, the Linux Unified Key Setup standard

Client Architecture:

Recent Web Browser on Windows (Chrome 70+, IE 11+, Microsoft Edge 15+, Firefox 60+, Safari 10+) or Mac (Chrome 70+, Firefox 60+, Safari 10+).
HTML, Javascript, CSS and AJAX technologies.
Works with Apple IPAD, Microsoft Surface and other new mobile devices and technologies.
All communication to the server are encrypted and protected.

HIPAA Privacy & Security Best Practices

In rED Cap™ all privacy and security provisions of the HIPAA guidelines are carefully addressed. These provisions are implemented in the system using a number of key technologies and best practices:

Authentication: Assurance of identity of person or originator of data.

Secure Login: The rED Cap™ application uses the industry standard to authenticate the identity of users that log into the system.
The rED Cap™ application fully support configrable password aging. It support hacking detection by disabe the access for a configurable amount of time after a series of consecutive failed logins.
Encrypted Passwords: The application uses the industry standard SHA256 hash to protect user passwords. Each user is assigned a unique activation code and a user must explicitly activate the account and set the password.
Secure Connection: Using HTTPS and SSL in the rED Cap™ server with a strong 256-bit SSL certificate.

Integrity: Verify integrity and prevent unauthorized modification of data and documents.

All database updates and changes are logged using an application-level logging API.

Authorization: Ensure users have the permissions to perform certain actions.

Security Roles & Permissions: A permssion system is implemented at both the server level (protecting the application) and at the application level (protecting specific functions), regulating access to only the authorized users and roles.

Availability: Ensure information is available to authorized parties.

Secure Firewall: The rED Cap™ application is deployed with placement of the database server behind the firewall on the network to protect access from the outside.

Confidentiality: Protect data and documents from unauthorized disclosure.

Confidentiality Agreements: All BSI developers and employees are required to sign a confidentiality agreement, acknowledging they understand and continue to follow all company security policies.

Auditing: Track who, when, where, what and how accesses and updates to data and documents are made. Audit trails are stored in our secure database server.

Audit trails: rED Cap™ system captures and logs all activities and events. rED Cap™ system has about 200 events that it tracks. All activities are logged in the database for easy audit, analysis and report.
Tracking document uploads and downloads: The system captures, stores and allows reporting of all uploads and downloads. User name, user's browser, user's Internet IP, date and time, exact action taken. All is available for auditing.