BioStat International, Inc.

rED Cap^TM is a web-based product developed by Biostat International, Inc. for managing multi-study, multi-site clinical research studies securely and safely over the Internet.

rED Cap^TM is 21 CFR 11 compliant and supports HIPAA guidelines. It is designed as a standard-based, extensible platform. In particular, it is ODM v1.3 and STDM v1.1-base full-cycle Clinical Data Warehouse.

rED Cap^TM facilitates secure protocol configuration, study events and visits management, design of electronic Case Report Forms (e-CRFs), queries and resolution, notes and messaging, data query and report, data export, secure document exchanges, user and user role managment, site managment and study management using standard web browsers. All communications between our clients and our server are encrypted using strong 128-bit SSL certificate. No account information, documents, data are transmitted over the Internet without our string 128-bit SSL encryption.

rED Cap^TM is designed to be easily customizable. It fully supports web page display and data segregation. It also supports a wide range of customizations from study to study.

rED Cap^TM also has advanced web-based project and user management facilities. The server is protected by an enterprise network security firewall.

rED Cap^TM is simple and intuitive to use and easy to manage.

Server Architecture:

Dell PowerEdge Enterprise Server with Advanced RAID
Server OS: Enterprise Linux CentOS 5.2
Database: MySQL Server 5.0.45
Web Server: Apache httpd-2.2.3 with 128-bit SSL commercial Certificate
PHP 5.1.6 and Database Abstraction Layer MDB2 2.4.1

Client Architecture:

Recent Web Browser on Windows (IE 6/7, Firefox 2/3) or Mac (Firefox 2/3).
HTML, Javascript, CSS and AJAX technologies.
All communication to th server are encrypted and protected.

HIPAA Privacy & Security Best Practices

In rED Cap^TM all privacy and security provisions of the HIPAA guidelines are carefully addressed. These provisions are implemented in the system using a number of key technologies and best practices:

Authentication: Assurance of identity of person or originator of data.

Secure Login: The rED Cap^TM application uses the industry standard to authenticate the identity of users that log into the system.
Encrypted Passwords: The application uses the standard SHA1 hash to protect user passwords. Each user is assigned a unique activation code and a user must explicitly activate the account and set the password.
Secure Connection: Using HTTPS and SSL in the rED Cap^TM server with a strong 128-bit SSL certificate.

Integrity: Verify integrity and prevent unauthorized modification of data and documents.

All database updates and changes are logged using an application-level logging API.

Authorization: Ensure users have the rights to perform certain actions.

Security Roles & Privileges: A privilege system is implemented at both the server level (protecting the application) and at the application level (protecting specific functions), regulating access to only the authorized users and roles.

Availability: Ensure information is available to authorized parties.

Secure Firewall: The rED Cap^TM application is deployed with placement of the database server behind the firewall on the network to protect access from the outside.

Confidentiality: Protect data and documents from unauthorized disclosure.

Confidentiality Agreements: All BSI developers and employees are required to sign a confidentiality agreement, acknowledging they understand and continue to follow all company security policies.

Auditing: Track who, when, where, what and how accessesto data and documents. Audit trails are stored in our secure database server.

Tracking document uploads and downloads: The system captures, stores and allows reporting of all uploads and downloads. User name, user's browser, user's Internet IP, date and time, exact action taken. All is available for auditing.