By submitting this pre-approval request you are taking responsibility for the security of any issued API tokens and all data accessible by those API tokens.
First Name
* must provide value
Last Name
* must provide value
Deprecated, hidden from survey
Phone number
* must provide value
E-mail
* must provide value
Department
* must provide value
Are you the principal investigator of the project?
* must provide value
Yes No
If No, please also provide contact information for the PI in the fields that will be shown below.
Please provide a short description of the work that will be supported, including the role the client software will play.
* must provide value
What IU REDCap project (or projects) will be accessed by the REDCap API?
* must provide value
If some or all of the projects don't exist yet, include the ones that exist and note that some projects don't yet exist.
Will the REDCap API be used to access protected health information (PHI) data?
* must provide value
Yes No
Will you be using the REDCap-ETL external module to export data?
* must provide value
Yes No
Will you be using the REDCap API solely to export data via REDCap-ETL?
* must provide value
Yes No
DEPRECATED as of 14-Oct-2022
Will you be exporting data via the REDCap-ETL module only to approved infrastructure? This includes the Research Database Complex and Regenstrief servers that are approved for protected health information (PHI).
If using the Research Database Complex, please be sure to review the
guidance on working with data containing PHI on the Research Database Complex.
Yes No
Will you be using the REDCap API to access IU REDCap data from Tableau?
Please be sure to review the
guidance on how to configure and secure Tableau workbooks to access data from IU REDCap.
* must provide value
Yes No
Will you be importing data into IU REDCap, exporting data from IU REDCap, or both?
* must provide value
Import only
Export only
Import and Export
The REDCap-ETL external module and Tableau both involve exporting data. If using either of these, make sure to select 'Export only' or 'Import and Export' above.
Will you be exporting data using a software client besides the REDCap-ETL external module and/or Tableau?
* must provide value
Yes No
Will you be using the REDCap API from a program that will run only on approved infrastructure? This includes the Carbonate cluster and Regenstrief servers that are approved for protected health information (PHI).
If using Carbonate, please be sure to review the
guidance on working with data containing PHI on Carbonate.
* must provide value
Yes No
Note: An SOP is not required if one of the following conditions holds:
Your project does not involve protected health information (PHI). You will only import data into IU REDCap, not export it. You will only export data via the REDCap-ETL external module to approved infrastructure, including the Research Database Complex, the Carbonate cluster, and Regenstrief servers approved for protected health information (PHI). You will only export data for use in Tableau. You will only run other API client software from approved infrastucture (as above). NOTE: If you plan to use the REDCap API only from another location, not listed above, that is approved for Protected Health Information (PHI), please include that in the comments at the end of this form and we will contact you to discuss including that other location in the list of places for which an SOP is not required in order to use the IU REDCap API.SOP Template
The owner of the IU REDCap software client has reviewed the
Information Security and Privacy Program Safeguards , particularly domain 8 (Identity and Access Control) and domain 9 (Information Systems Acquisition, Development, and Maintenance) for any applicability to this IU REDCap client and its hosting environment.
* must provide value
Yes No
The API token or tokens used by the software client will not be shared with others for any reason.
* must provide value
Yes No
REDCap API tokens will be stored on secure machines.
The software client and the IU REDCap API token might be stored on separate computers. In that case, the following requirements refer to the host that stores the IU REDCap API token.
All hosts must adhere to the
IU Security of Information Technology Resources policy . Note, in particular, the 'Procedures' section which specifies a set of technical requirements.
For laptops and other mobile devices, they will be secured according to Indiana University's
IT-12.1 Mobile Device Security Standard and any departmental mobile device policies relevant to the department sponsoring the use of the mobile devices.
All security incidents will be communicated to the IU REDCap administrators (redcap@iu.edu) and to Indiana University incident response (it-incident@iu.edu).
This includes compromised, unsecured, lost and/or stolen devices, computers, and API tokens.
* must provide value
Yes No
If the client software has a graphical, web-based interface, the owner of the client takes responsibility for the client being scanned by the
Indiana University application scanner . Scanning must be done before the application is put into production, at least twice a year, and before any major changes to the application.
* must provide value
Yes No
The client will only provide data to those who are allowed to see that data.
* must provide value
Yes No
Individual access to data is logged. IU REDCap identifies and logs access using the API token to determine identity. If the client does not use different API tokens for different user access, the client must separately log individual access.
* must provide value
Yes No
The SSL certificate of the IU REDCap application is validated on every request from the software client.
* must provide value
Yes No
All users will have met their specific research affiliate/institution mandated HIPAA training and research training before using the API software client.
* must provide value
Yes No
API tokens will be revoked when no longer needed.
For information about how to revoke an API token, please see:
Revoking API tokens .
* must provide value
Yes No
Which IT person or department have you conferred with to make sure that the computers that will host the API token(s) will follow all relevant policies?
* must provide value
Only using REDCap-ETL external module? Type 'module only'.
