{"id":4700,"date":"2026-03-20T16:51:00","date_gmt":"2026-03-20T20:51:00","guid":{"rendered":"https:\/\/health.uconn.edu\/clinical-research-center\/?page_id=4700"},"modified":"2026-06-02T10:04:10","modified_gmt":"2026-06-02T14:04:10","slug":"identifiers-in-redcap","status":"publish","type":"page","link":"https:\/\/health.uconn.edu\/clinical-research-center\/services\/informatics-core\/redcap-home\/guides-how-tos\/identifiers-in-redcap\/","title":{"rendered":"Identifiers in REDCap"},"content":{"rendered":"<div id=\"top\" class=\"identifiers-in-redcap\" style=\"max-width: 1100px;margin: 0 auto;line-height: 1.7;color: #1f2937\">\n<div style=\"text-align: right;margin-top: 14px\"><a href=\"\/\/health.uconn.edu\/clinical-research-center\/services\/informatics-core\/redcap-home\/\" style=\"background: #eef6f8;color: #1f2937;padding: 6px 12px;text-decoration: none;border-radius: 20px;font-size: 0.95em\">Back to REDCap Homepage<\/a><\/div>\n<div style=\"text-align: right;margin-top: 14px\"><a href=\"\/\/health.uconn.edu\/clinical-research-center\/services\/informatics-core\/redcap\/guides-how-tos\/\" style=\"background: #eef6f8;color: #1f2937;padding: 6px 12px;text-decoration: none;border-radius: 20px;font-size: 0.95em\">Back to Guides<\/a><\/div>\n<div style=\"background: #64C7C9;border: 1px solid #bae6fd;padding: 18px 20px;margin: 24px 0;border-radius: 6px\">\n<h2 style=\"text-align: center\"><strong>Using Identifiers &amp; PHI in REDCap<\/strong><\/h2>\n<\/div>\n<p style=\"font-size: 1.08em;margin-top: 0\">REDCap may be used to collect and store research data that includes identifiers or Protected Health Information (PHI).<br \/>\nBefore collecting identifiable data, study teams must understand institutional requirements, IRB expectations, and applicable HIPAA regulations.<\/p>\n<div style=\"background: #fef2f2;border-left: 6px solid #dc2626;padding: 14px 16px;margin: 22px 0;border-radius: 4px\"><strong>Important:<\/strong> The collection and storage of identifiable data in REDCap must be explicitly approved in your IRB protocol and supported by appropriate safeguards.<\/div>\n<div style=\"background: #f0f9ff;border: 1px solid #bae6fd;padding: 16px 18px;margin: 24px 0;border-radius: 6px\">\n<h2 style=\"margin-top: 0\">On this page<\/h2>\n<ul style=\"margin: 0;padding-left: 20px\">\n<li><a href=\"#hipaa\">HIPAA Responsibilities<\/a><\/li>\n<li><a href=\"#participant-id\">Participant ID Best Practices<\/a><\/li>\n<li><a href=\"#permitted\">Permitted Identifiers<\/a><\/li>\n<li><a href=\"#restricted\">Restricted Data<\/a><\/li>\n<li><a href=\"#irb\">Follow Your IRB-Approved Plan<\/a><\/li>\n<li><a href=\"#email\">Email Use &amp; Identifier Linkage<\/a><\/li>\n<li><a href=\"#separation\">When Identifiers Must Be Stored Separately<\/a><\/li>\n<li><a href=\"#storing\">If Storing Identifiers Is Required<\/a><\/li>\n<li><a href=\"#changes\">Changes Require IRB Approval<\/a><\/li>\n<\/ul>\n<\/div>\n<p><strong>Recommended Reading:<\/strong><br \/>\n<a href=\"https:\/\/www.sciencedirect.com\/science\/article\/pii\/S1532046418301345?via%3Dihub\"><br \/>\n<em>A beginner\u2019s guide to avoiding Protected Health Information (PHI) issues in clinical research \u2013 with how-to\u2019s in REDCap<\/em><br \/>\n<\/a><\/p>\n<hr style=\"margin: 30px 0\" \/>\n<h2 id=\"hipaa\" style=\"background: #329EB8;color: white;padding: 12px 16px;border-radius: 6px\">HIPAA Responsibilities<\/h2>\n<p>Compliance with HIPAA is a shared responsibility. Users collecting, storing, or sharing PHI in REDCap are responsible for:<\/p>\n<ul>\n<li>Using and disclosing only the <strong>minimum necessary<\/strong> PHI<\/li>\n<li>Ensuring PHI is accessible only to <strong>authorized individuals<\/strong><\/li>\n<li>Obtaining required <strong>authorizations, data use agreements, and BAAs<\/strong><\/li>\n<li>Following all applicable <strong>institutional, IRB, and regulatory policies<\/strong><\/li>\n<\/ul>\n<div style=\"text-align: right\"><a href=\"#top\">Back to top \u2191<\/a><\/div>\n<hr style=\"margin: 30px 0\" \/>\n<h2 id=\"participant-id\" style=\"background: #329EB8;color: white;padding: 12px 16px;border-radius: 6px\">Participant ID Best Practices<\/h2>\n<ul>\n<li>Avoid using names, initials, MRNs, or identifiable data in record IDs<\/li>\n<li>Use <strong>non-identifiable, coded IDs<\/strong><\/li>\n<li>Ensure IDs support longitudinal tracking without exposing identity<\/li>\n<\/ul>\n<div style=\"background: #eff6ff;border-left: 6px solid #2563eb;padding: 14px 16px;margin: 20px 0;border-radius: 4px\"><strong>Best practice:<\/strong> Record IDs should never contain PHI or directly identifiable information.<\/div>\n<div style=\"text-align: right\"><a href=\"#top\">Back to top \u2191<\/a><\/div>\n<hr style=\"margin: 30px 0\" \/>\n<h2 id=\"permitted\" style=\"background: #329EB8;color: white;padding: 12px 16px;border-radius: 6px\">Permitted Identifiers (With IRB Approval)<\/h2>\n<p>The following identifiers may be collected <strong>only if explicitly approved by the IRB<\/strong> and must be marked as Identifier fields in REDCap:<\/p>\n<ul>\n<li>Dates (except year)<\/li>\n<li>Names (including initials)<\/li>\n<li>Geographic subdivisions smaller than a state<\/li>\n<li>Phone numbers<\/li>\n<li>Fax numbers<\/li>\n<li>Email addresses<\/li>\n<\/ul>\n<div style=\"background: #fff7ed;border-left: 6px solid #ea580c;padding: 14px 16px;margin: 20px 0;border-radius: 4px\"><strong>Important:<\/strong> Fields not marked as identifiers will not be excluded from exports.<\/div>\n<div style=\"text-align: right\"><a href=\"#top\">Back to top \u2191<\/a><\/div>\n<hr style=\"margin: 30px 0\" \/>\n<h2 id=\"restricted\" style=\"background: #329EB8;color: white;padding: 12px 16px;border-radius: 6px\">Restricted Data (Not Permitted)<\/h2>\n<p>The following sensitive data types must <strong>not<\/strong> be stored in UConn Health REDCap:<\/p>\n<table style=\"border-collapse: collapse;width: 100%\">\n<tbody>\n<tr>\n<td>Medical Record Numbers (MRNs)<\/td>\n<td>Social Security Numbers<\/td>\n<\/tr>\n<tr>\n<td>Account Numbers<\/td>\n<td>IP Addresses<\/td>\n<\/tr>\n<tr>\n<td>Health Plan Beneficiary Numbers<\/td>\n<td>Biometric Identifiers<\/td>\n<\/tr>\n<tr>\n<td>Full-face Photographs<\/td>\n<td>Audio\/Video Recordings<\/td>\n<\/tr>\n<tr>\n<td>Financial \/ PCI Data<\/td>\n<td>ITAR-restricted Data<\/td>\n<\/tr>\n<tr>\n<td>Mother\u2019s Maiden Name<\/td>\n<td>Vehicle Identifiers<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<div style=\"background: #fef2f2;border-left: 6px solid #dc2626;padding: 14px 16px;margin: 20px 0;border-radius: 4px\"><strong>Important:<\/strong> These data types are prohibited regardless of study design or IRB approval.<\/div>\n<div style=\"text-align: right\"><a href=\"#top\">Back to top \u2191<\/a><\/div>\n<hr style=\"margin: 30px 0\" \/>\n<h2 id=\"irb\" style=\"background: #329EB8;color: white;padding: 12px 16px;border-radius: 6px\">Follow Your IRB-Approved Plan<\/h2>\n<ul>\n<li>All REDCap data collection must align with IRB-approved materials<\/li>\n<li>Do not collect data not explicitly approved<\/li>\n<li>Ensure access and storage align with confidentiality requirements<\/li>\n<\/ul>\n<div style=\"background: #eff6ff;border-left: 6px solid #2563eb;padding: 14px 16px;margin: 20px 0;border-radius: 4px\"><strong>Core Principle:<\/strong> If it is not in your IRB protocol, it should not be in your REDCap project.<\/div>\n<div style=\"text-align: right\"><a href=\"#top\">Back to top \u2191<\/a><\/div>\n<hr style=\"margin: 30px 0\" \/>\n<h2 id=\"email\" style=\"background: #329EB8;color: white;padding: 12px 16px;border-radius: 6px\">Email Use &amp; Identifier Linkage<\/h2>\n<p>Using email addresses for survey distribution (Survey Invitations or ASIs) creates a <strong>direct linkage between participant identity and study data<\/strong>.<\/p>\n<ul>\n<li>Email use must be <strong>explicitly described in the IRB protocol<\/strong><\/li>\n<li>Consent materials must disclose this use<\/li>\n<li>Survey responses are <strong>linked to identifiable participants<\/strong><\/li>\n<\/ul>\n<div style=\"background: #fef2f2;border-left: 6px solid #dc2626;padding: 14px 16px;margin: 20px 0;border-radius: 4px\"><strong>Important:<\/strong> If email is used for survey distribution, you <strong>cannot state that identifiers are fully separated from study data<\/strong>.<\/div>\n<h3>Best Practice Recommendations<\/h3>\n<ul>\n<li>Restrict access using <strong>User Rights and DAGs<\/strong><\/li>\n<li>Exclude identifiers from unnecessary forms\/exports<\/li>\n<li>Consider a <strong>separate contact project<\/strong> if separation is required<\/li>\n<\/ul>\n<div style=\"text-align: right\"><a href=\"#top\">Back to top \u2191<\/a><\/div>\n<hr style=\"margin: 30px 0\" \/>\n<h2 id=\"separation\" style=\"background: #329EB8;color: white;padding: 12px 16px;border-radius: 6px\">When Identifiers Must Be Stored Separately<\/h2>\n<ul>\n<li>Use a <strong>separate REDCap project<\/strong> for identifiers<\/li>\n<li>Avoid direct linkage unless IRB-approved<\/li>\n<\/ul>\n<p><strong>Example:<\/strong> Store consent forms in a separate \u201cConsent\u201d project.<\/p>\n<div style=\"text-align: right\"><a href=\"#top\">Back to top \u2191<\/a><\/div>\n<hr style=\"margin: 30px 0\" \/>\n<h2 id=\"storing\" style=\"background: #329EB8;color: white;padding: 12px 16px;border-radius: 6px\">If Storing Identifiers Is Required<\/h2>\n<ul>\n<li>Confirm IRB approval<\/li>\n<li>Apply appropriate safeguards<\/li>\n<li>Limit access to authorized personnel only<\/li>\n<\/ul>\n<div style=\"text-align: right\"><a href=\"#top\">Back to top \u2191<\/a><\/div>\n<hr style=\"margin: 30px 0\" \/>\n<h2 id=\"changes\" style=\"background: #329EB8;color: white;padding: 12px 16px;border-radius: 6px\">Changes Require IRB Approval<\/h2>\n<ul>\n<li>All changes must be IRB-approved <strong>before implementation<\/strong><\/li>\n<li>Consult IRB for Exempt studies before making changes<\/li>\n<\/ul>\n<div style=\"background: #fff7ed;border-left: 6px solid #ea580c;padding: 14px 16px;margin: 20px 0;border-radius: 4px\"><strong>Important:<\/strong> Unauthorized changes may invalidate your study approval.<\/div>\n<div style=\"text-align: right\"><a href=\"#top\">Back to top \u2191<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Back to REDCap Homepage Back to Guides Using Identifiers &amp; PHI in REDCap REDCap may be used to collect and store research data that includes identifiers or Protected Health Information (PHI). Before collecting identifiable data, study teams must understand institutional requirements, IRB expectations, and applicable HIPAA regulations. Important: The collection and storage of identifiable data [&hellip;]<\/p>\n","protected":false},"author":4679,"featured_media":0,"parent":2190,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":""},"acf":[],"publishpress_future_action":{"enabled":false,"date":"2026-07-23 05:58:28","action":"change-status","newStatus":"draft","terms":[],"taxonomy":""},"_links":{"self":[{"href":"https:\/\/health.uconn.edu\/clinical-research-center\/wp-json\/wp\/v2\/pages\/4700"}],"collection":[{"href":"https:\/\/health.uconn.edu\/clinical-research-center\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/health.uconn.edu\/clinical-research-center\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/health.uconn.edu\/clinical-research-center\/wp-json\/wp\/v2\/users\/4679"}],"replies":[{"embeddable":true,"href":"https:\/\/health.uconn.edu\/clinical-research-center\/wp-json\/wp\/v2\/comments?post=4700"}],"version-history":[{"count":6,"href":"https:\/\/health.uconn.edu\/clinical-research-center\/wp-json\/wp\/v2\/pages\/4700\/revisions"}],"predecessor-version":[{"id":5106,"href":"https:\/\/health.uconn.edu\/clinical-research-center\/wp-json\/wp\/v2\/pages\/4700\/revisions\/5106"}],"up":[{"embeddable":true,"href":"https:\/\/health.uconn.edu\/clinical-research-center\/wp-json\/wp\/v2\/pages\/2190"}],"wp:attachment":[{"href":"https:\/\/health.uconn.edu\/clinical-research-center\/wp-json\/wp\/v2\/media?parent=4700"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}