What REDCap is
REDCap is a web application for building and managing data collection instruments — surveys, case report forms, longitudinal assessment schedules — developed at Vanderbilt University and licensed free to non-profit institutions, which host it themselves. Thousands of universities and hospitals run their own instance.
The self-hosting is the entire point. When your institution runs REDCap, participant data sits on institutional infrastructure inside the institution’s legal boundary, governed by its existing agreements and accessible to its own administrators. That is what makes it acceptable to ethics committees for identifiable data, and it is why a general survey tool — however capable — is usually not. The audit logging, granular permissions, e-consent, and export controls are the second layer; the hosting is the first, and it is the one that decides whether an application gets approved.
Why researchers use it
- Ethics committees know it by name — an application that says “data will be collected in REDCap” clears a hurdle that an application naming a commercial survey tool does not.
- Audit trails on everything — who changed which value, when, and from what. Required for regulated research and useful in any study where data integrity will be questioned.
- Granular role permissions — a research assistant who can enter data but not export identifiers is a configuration, not a policy you hope people follow.
- Longitudinal designs handled properly — visit schedules, repeating instruments, automated survey invitations, and time windows, rather than improvised in a spreadsheet.
- Data dictionaries — an instrument is a portable specification, so a multi-site study can deploy identical forms across institutions.
Where it fits in a research workflow
REDCap is where identifiable data enters and stays. Upstream is your protocol and ethics approval; downstream is a de-identified export that feeds analysis.
That boundary is the important part of the design. Analysis happens elsewhere — R, Python, Jupyter — against an export, while the identifiable dataset remains inside REDCap under audit. The study record and preregistration live on OSF; analysis code lives in GitHub or an institutional GitLab; the eventual public dataset goes to a repository only after de-identification. Keeping identifiers on one side of that line and analysis on the other is the arrangement your ethics approval almost certainly describes, and REDCap is built to enforce it rather than to trust you.
Getting started
A week to a live study, and most of it is design rather than software.
- Contact your institution’s REDCap administrator — there is very likely one, often in the medical school, research computing, or clinical research unit. Access is usually free and approval takes days.
- Build instruments in the online designer and pilot with test records before anything real. Changing an instrument after live data exists is possible and unpleasant.
- Set up user roles and export rights explicitly, including who can see identifiers. Default-open permissions in a study with identifiable data are a finding waiting to happen.
- The step people skip: decide the de-identification strategy at design time, not at analysis time. Which fields are identifiers, which get hashed, which never leave the instance — configure that as a project setting before collection starts, because retrofitting it means re-exporting everything and hoping you caught it all.
REDCap vs the alternatives
| Alternative | Does it better | Pick it if |
|---|---|---|
| Qualtrics / SurveyMonkey | Interface quality, question types, and speed of build | The survey is anonymous and low-stakes |
| LimeSurvey | Self-hostable and lighter, with a better designer | You need self-hosting without REDCap’s overhead |
| OSF | Recording the study, its plan, and its materials | You are describing the study, not collecting data |
| A spreadsheet | Nothing, once more than one person touches it | Genuinely nothing — this is how data integrity dies |
REDCap wins wherever compliance is a requirement rather than a preference. Where it is not, lighter tools are faster and pleasanter.
Cost, licensing, and your data
Free to non-profit institutions under a licence from Vanderbilt, with the institution hosting and administering its own instance. There is no cost to you as a researcher, though your institution carries the hosting and support burden — which is why access runs through an administrator rather than a signup form.
The data position is the reason to use it. Participant data lives on institutional servers, under institutional agreements, in the institution’s jurisdiction, with audit logging and access controls that satisfy HIPAA- and GDPR-class requirements. That is a materially different posture from a commercial survey platform, and it is stateable in an ethics application in a way that “we will use a secure online tool” is not. The dependency worth naming: you inherit your institution’s version, patch cadence, and administrator responsiveness, which vary considerably and which you cannot control.
The honest review
Strengths. REDCap is the rare tool that ethics committees pre-approve by name, and that alone saves weeks in a research career. Beyond the administrative advantage, the data dictionary makes instruments portable — a multi-site study can deploy identical forms at every institution’s own instance, which is how consortium research stays comparable. For longitudinal designs, the scheduling and repeating-instrument machinery handles complexity that would otherwise become a spreadsheet nobody trusts.
Limitations. The interface is dated and the instrument designer is clunky; building a complex form is slower than in any commercial survey tool. Branching logic becomes unwieldy past moderate complexity and is hard to review. Participant-facing surveys look institutional rather than polished, which measurably affects completion rates in community samples. You depend entirely on your institution’s instance — its version, its uptime, its administrator’s availability — with no recourse if any of those is poor. And its overhead is real, so using it for a simple anonymous survey is paying a compliance cost for nothing.
Verdict. Adopt it for any study collecting identifiable, clinical, or regulated data — it is the standard and there is no meaningful alternative. Skip it for anonymous, low-stakes surveys, where the overhead buys you nothing and a lighter tool is faster and prettier. The condition that flips the answer is the sensitivity of the data, not the size of the study.
Common questions
Is REDCap free?
Yes, for researchers at non-profit institutions — Vanderbilt licenses it free to those institutions, which host and administer their own instance. Contact your institution’s REDCap administrator; there is very likely one already.
Is REDCap suitable for GDPR or HIPAA-regulated data?
It is designed for exactly that, and its institutional hosting model is why. Data stays on your institution’s infrastructure under its existing agreements, with audit trails and access controls. Compliance still depends on how your institution configures and operates the instance — confirm with your data protection officer rather than assuming.
REDCap or Qualtrics?
REDCap for identifiable, clinical, or regulated data, where ethics approval effectively requires it. Qualtrics or a similar commercial tool for anonymous, low-stakes surveys, where the interface is far better and the compliance overhead buys nothing.