BioStat International, Inc.

rED Cap^TM is a web-based product developed by Biostat International, Inc. for managing multi-site clinical research studies securely and safely over the Internet.

rED Cap^TM is 21 CFR 11 compliant and supports HIPAA guidelines. It is designed as a standard-based, extensible platform. In particular, it is ODM v1.3 and STDM v1.1-base full-cycle Clinical Data Warehouse.

rED Cap^TM facilitates secure protocol configuration, study events and visit management, design of electronic Case Report Forms (e-CRFs), annotated e-CRFs, subject profiles.

rED Cap^TM provides tools for dynamic and interactive entry validation, dynamic data flow controls based on entered data and automatic calculated fields.

rED Cap^TM provides tools for queries and query resolutions, data query management tracking, convenient and centralized query workflow via the Query Station.

rED Cap^TM provides re-tool capability while the study is active and ongoing to make protocol, visit, forms updates;

rED Cap^TM export study defintion and/or study data into ODM XML format or Excel data sets;

rED Cap^TM facilitates secure document exchanges, user and user role managment and dynamic reporting using standard web browsers.

rED Cap^TM makes sure that all communications between our clients and our server are encrypted using strong 128-bit SSL certificate. No account information, documents or data are transmitted over the Internet without our string 128-bit SSL encryption.

rED Cap^TM is designed to be easily customizable. It fully supports web page display and data segregation. It also supports a wide range of customizations from study to study. It can handle double data entry of paper CRFs, blinded third-party entry, and management of unscheduled visits for observational studies.

rED Cap^TM has advanced web-based user profile and dynamic user permission management facilities. The server is protected by an enterprise network security firewall.

rED Cap^TM has sophisticated and dynamic flags and status icons that makes it simple and intuitive to use and manage.

Server Architecture:

Dell PowerEdge Enterprise Server with Advanced RAID
Server OS: Enterprise Linux CentOS 5.6
Database: MySQL Server 5
Web Server: Apache httpd-2.2 with 128-bit SSL commercial Certificate
PHP 5 and Database Abstraction Layer MDB2

Client Architecture:

Recent Web Browser on Windows (IE 7/8/9, Firefox 3/4, Safari 5) or Mac (Firefox 3/4, Safari 5).
HTML, Javascript, CSS and AJAX technologies.
Works with IPAD and mobile technologies.
All communication to th server are encrypted and protected.

HIPAA Privacy & Security Best Practices

In rED Cap^TM all privacy and security provisions of the HIPAA guidelines are carefully addressed. These provisions are implemented in the system using a number of key technologies and best practices:

Authentication: Assurance of identity of person or originator of data.

Secure Login: The rED Cap^TM application uses the industry standard to authenticate the identity of users that log into the system.
The rED Cap^TM application fully support configrable password aging. It support hacking detection by disabe the access for a configurable amount of time after a series of consecutive failed logins.
Encrypted Passwords: The application uses the industry standard SHA1 hash to protect user passwords. Each user is assigned a unique activation code and a user must explicitly activate the account and set the password.
Secure Connection: Using HTTPS and SSL in the rED Cap^TM server with a strong 128-bit SSL certificate.

Integrity: Verify integrity and prevent unauthorized modification of data and documents.

All database updates and changes are logged using an application-level logging API.

Authorization: Ensure users have the permissions to perform certain actions.

Security Roles & Permissions: A permssion system is implemented at both the server level (protecting the application) and at the application level (protecting specific functions), regulating access to only the authorized users and roles.

Availability: Ensure information is available to authorized parties.

Secure Firewall: The rED Cap^TM application is deployed with placement of the database server behind the firewall on the network to protect access from the outside.

Confidentiality: Protect data and documents from unauthorized disclosure.

Confidentiality Agreements: All BSI developers and employees are required to sign a confidentiality agreement, acknowledging they understand and continue to follow all company security policies.

Auditing: Track who, when, where, what and how accesses and updates to data and documents are made. Audit trails are stored in our secure database server.

Audit trails: rED Cap^TM system captures and logs all activities and events. It has about 130 events that it tracks. All activities are logged in the database for easy audit, analysis and report.
Tracking document uploads and downloads: The system captures, stores and allows reporting of all uploads and downloads. User name, user's browser, user's Internet IP, date and time, exact action taken. All is available for auditing.