Introduction to Clinical Data

Clinical data is either collected during patient care or as part of a clinical trial program. Funding agencies, publishers, and research communities are encouraging researchers to share data, while respecting Institutional Review Board (IRB) and federal restrictions against disclosing identifiers of human subjects.

You should take initial steps to de-identify data for:

  • Protecting data during research projects
  • Preparing data for vetted collaborators, restricted-access or public access data repositories

Clinical Data Terminology

  • REDCap

    Secure web application for data capture for research studies

    REDCap is a free, secure, web-based application designed to support data capture for research studies. The system was developed by a multi-institutional consortium initiated at Vanderbilt University. Data collection is customized for each study or clinical trial by the research team with guidance from Harvard Catalyst EDC Support Staff. REDCap is designed to comply with HIPAA regulations.

    REDCap is a mature, secure web application for building and managing online surveys and databases.

    • Design your own survey electronically
    • Share data securely with research staff and external collaborators
    • Built in tools for viewing EPIC data, and limited de-identification


    Available Harvard Licenses

Additional Resources

Accessible Version

  • The Levels of De-identification Actions Table

    For personal & collaborator use, you must remove personal identifiers not needed for analysis and replace them with codes, e.g., names with pseudonyms, per HIPAA's 'Safe Harbor' limited datasets rule. For a restricted access repository, you do all of the above as well as broaden or mask direct and indirect identifiers when possible, e.g., change specific values to ranges, such as changing 52 to 50-55, per HIPAA's 'Safe Harbor' limited datasets rule. For a public access repository, you must do all of the above as well as find and remove or mask all potential indirect or inferential identifiers and apply advanced statistical de-identification techniques if needed, seek professional assistance and disclosure risk review, per HIPAA's expert determination 'de-identified'.