REDCap (Research Electronic Data Capture)

REDCap (Research Electronic Data Capture) is a secure, browser-based software platform for building and managing online surveys and databases used in research. It was created in 2004 by an informatics team at Vanderbilt University, led by Paul Harris, with early support from NIH/NCRR translational-research funding, and it has since grown into an international, non-profit-only consortium of academic medical centers, universities, and other research institutions rather than a commercially sold product.

What makes something "REDCap"

REDCap is not a generic term for any web-based survey or data-capture tool — it refers specifically to the metadata-driven software platform originated at Vanderbilt University and distributed exclusively through the REDCap Consortium. Three things distinguish a REDCap instance from other electronic data capture (EDC) tools:

• Consortium licensing, not commercial sale. An institution cannot simply buy a REDCap license on the open market. It must have a not-for-profit institutional partner already in the consortium install and administer a local REDCap instance for it, or become a partner itself by signing the REDCap license agreement with Vanderbilt University.
• Metadata-driven architecture. A REDCap project is defined by a data dictionary (field names, types, validation rules, branching logic) that the software uses to auto-generate the data-entry forms, database structure, and survey pages — rather than a developer hand-coding a form and a separate database schema.
• Institutional hosting. Each REDCap instance is installed and operated by a partner institution’s own IT/research-computing unit (on its own servers or an approved cloud environment), which is also what allows that institution to apply its own security review, data-governance policy, and regulatory controls to the instance.

The consortium access model

Access to REDCap is deliberately structured around institutional membership rather than individual or per-seat purchase. Per REDCap’s own documentation, the software is free to non-profit organizations that join the REDCap Consortium; a partner institution installs and maintains its own instance and, in turn, may extend access to affiliated researchers, and in some cases to external collaborators or smaller partner organizations without their own instance. As of this writing, REDCap’s own statistics page reports several thousand active institutional partners across more than 160 countries, with millions of end users and tens of thousands of citing publications — figures the platform itself updates continuously, so treat any specific count as a snapshot rather than a fixed number.

This consortium structure is the operational reason REDCap functions differently from a commercial electronic data capture (EDC) or clinical data management system (CDMS) product: there is no public price list or self-service signup, and a researcher at an institution without a REDCap partnership typically cannot obtain an account simply by requesting one directly from Vanderbilt. The practical starting point for a research team is almost always the local research-computing, informatics, or clinical-and-translational-science office, which manages the institution’s REDCap partnership status and account provisioning.

Typical research uses

REDCap is used across the full range of primary data-collection needs in academic research, including:

• Surveys — participant-facing questionnaires distributed by email invitation or public link, with skip logic, randomization, and multilingual support.
• Case report forms (CRFs) — structured, role-permissioned forms used by clinical and coordinating staff to capture study data at defined visits or events, a core function shared with dedicated clinical trial management systems even though CTMS and EDC/CDMS tools serve different parts of a trial’s operations.
• Longitudinal study data capture — repeating events/visits within a single project, so a cohort or panel study can capture the same instrument at multiple time points under one project structure.
• Multi-site data collection — a single hosted project with site-specific data-access groups, so a coordinating center can run a multi-institution study from one instance while restricting each site to its own records.

Because REDCap was built from the outset to support clinical researchers who needed a HIPAA-compliant alternative to spreadsheets and unmanaged databases, it is frequently the default recommendation from an institution’s clinical-research or research-data-management office for any project handling identifiable or otherwise sensitive human-subjects data — a use case closely related to the sensitive-data handling section of a study’s Data Management Plan (DMP).

Regulatory and compliance features

REDCap includes controls commonly required for regulated research data, including role-based user permissions, a full audit trail of data changes, field-level data validation, and configurable access logging. Per REDCap’s own project documentation, the platform is designed to support compliance with frameworks including the HIPAA Privacy Rule, FDA 21 CFR Part 11 (electronic records/signatures), FISMA, and GDPR. Whether a specific REDCap instance actually meets any of these requirements in practice depends on how the hosting institution configures and validates it — REDCap provides the technical capability, but regulatory compliance is ultimately established at the institutional-instance level, not by the software alone.

REDCap vs. adjacent tools and terms

REDCap is one specific product among a broader category of research data-collection tools, and it is easy to conflate with adjacent, related terms:

• REDCap vs. generic EDC/CDMS — REDCap is one implementation of the electronic data capture (EDC) function; commercial CDMS platforms (e.g., licensed clinical-trial-specific systems) serve the same broad role but are purchased directly rather than accessed through a non-profit consortium. See the CASRAI guide on clinical data management for how EDC, CDMS, and CTMS terms differ conceptually.
• REDCap vs. survey-only consumer tools — general-purpose survey tools (e.g., a consumer form builder) can capture questionnaire responses but are not designed for case-report-form workflows, audit trails, or institutional data governance the way REDCap is, and are not part of a research-institution consortium licensing model.
• REDCap vs. a Data Management Plan — REDCap is a data-capture tool, not a plan; a study’s Data Management Plan (DMP) may specify REDCap as the intended data-collection instrument, but the DMP itself is the governing document describing how data will be collected, stored, and shared.

Frequently asked questions

Is REDCap free?

REDCap is free of license fees to qualifying not-for-profit institutions that join the REDCap Consortium and to researchers at those partner institutions. It is not sold as a commercial off-the-shelf product with public pricing, and it is not open-source software available for unrestricted redistribution.

Can an individual researcher sign up for REDCap directly?

Generally no. Access is provisioned through an institution’s REDCap partnership; a researcher whose institution is not yet a consortium partner typically needs to work through their institution’s research-computing, informatics, or clinical-and-translational-science office to establish access, rather than registering directly with Vanderbilt University.

Is REDCap the same as a Clinical Trial Management System (CTMS)?

No. REDCap functions as an electronic data capture (EDC) tool for the research data itself — survey responses, case report forms, longitudinal measurements. A CTMS manages trial operations such as site contracts, monitoring visits, and enrollment tracking. The two categories are frequently used together on the same study but serve different functions.

Does using REDCap automatically make a study HIPAA-compliant?

No. REDCap provides technical features that support HIPAA compliance (role-based access, audit trails, encryption in transit/at rest depending on configuration), but compliance depends on how the hosting institution configures, validates, and governs its specific REDCap instance, along with the institution’s broader policies and business-associate agreements where applicable.

See also: Research Data Management (RDM) and Clinical Research Administration for the broader CASRAI clusters this term sits within, and Case report for the individual-record concept a REDCap CRF is built to capture.