Skip to content

Commit

Permalink
semantic line breaks
Browse files Browse the repository at this point in the history
  • Loading branch information
wibeasley committed Sep 14, 2023
1 parent b3e349b commit 089cfaa
Showing 1 changed file with 40 additions and 9 deletions.
49 changes: 40 additions & 9 deletions vignettes/workflow-read.Rmd
Original file line number Diff line number Diff line change
Expand Up @@ -98,28 +98,51 @@ Note to REDCap Admins:
Review Codebook
-------------------------

Before developing any REDCap or analysis code, spend at least 10 minutes to review the codebook, whose link is near the top left corner of the REDCap project page, under the "Project Home and Design" heading. Learning the details will save you time later and improve the quality of the research.
Before developing any REDCap or analysis code,
spend at least 10 minutes to review the codebook,
whose link is near the top left corner of the REDCap project page,
under the "Project Home and Design" heading.
Learning the details will save you time later and improve the quality of the research.

If you're new to the project, meet with the investigator for at least 30 minutes to learn the context, collection process, and idiosyncrasies of the dataset. During that conversation, develop a plan for grooming the dataset to be ready for analysis. This is part of the standard advice that the analyst's involvement should start early in the investigation's life span.
If you're new to the project,
meet with the investigator for at least 30 minutes
to learn the context, collection process, and idiosyncrasies of the dataset.
During that conversation, develop a plan for grooming the dataset to be ready for analysis.
This is part of the standard advice that the analyst's involvement
should start early in the investigation's life span.


Part 2 - Retrieve Protected Token
===================================

The REDCap API token is essentially a combination of a personal password and the ID of the specific project you're requesting data from. Protect it like any other password to PHI ([protected health information](https://www.hhs.gov/answers/hipaa/what-is-phi/index.html)). For a project with PHI, **never hard-code the password directly in an R file**. In other words, no PHI project should be accessed with an R file that includes the line
The REDCap API token is essentially a combination of a personal password
and the ID of the specific project you're requesting data from.
Protect it like any other password to PHI
([protected health information](https://www.hhs.gov/answers/hipaa/what-is-phi/index.html)).
For a project with PHI, **never hard-code the password directly in an R file**.
In other words, no PHI project should be accessed with an R file that includes the line

```r
my_secret_token <- "9A81268476645C4E5F03428B8AC3AA7B"
```

Instead, we suggest storing the token in a location that can be accessed by only you. We have two recommendations.
Instead, we suggest storing the token in a location that can be accessed by only you.
We have two recommendations.

Security Method 1: Token File
-------------------------

The basic goals are (a) separate the secret values from the R file into a dedicated file and (b) secure the dedicated file. If using a git repository, prevent the file from being committed with an entry in [`.gitignore`](https://docs.github.com/en/get-started/getting-started-with-git/ignoring-files). Ask your institution's IT security team for their recommendation.
The basic goals are
(a) separate the secret values from the R file into a dedicated file and
(b) secure the dedicated file.
If using a git repository, prevent the file from being committed with an entry in
[`.gitignore`](https://docs.github.com/en/get-started/getting-started-with-git/ignoring-files).
Ask your institution's IT security team for their recommendation.

The [`retrieve_credential_local()`](https://ouhscbbmc.github.io/REDCapR/reference/retrieve_credential.html) function in the [REDCapR](https://ouhscbbmc.github.io/REDCapR/) package loads relevant information from a csv into R. The plain-text file might look like this:
The [`retrieve_credential_local()`](https://ouhscbbmc.github.io/REDCapR/reference/retrieve_credential.html)
function in the [REDCapR](https://ouhscbbmc.github.io/REDCapR/)
package loads relevant information from a csv into R.
The plain-text file might look like this:

```csv
redcap_uri,username,project_id,token,comment
Expand All @@ -128,7 +151,8 @@ redcap_uri,username,project_id,token,comment
"https://bbmc.ouhsc.edu/redcap/api/","myusername",213,D70F9ACD1EDD6F151C6EA78683944E98,"write data"
```

To retrieve the credentials for the first project listed above, pass the value of "153" to `project_id`.
To retrieve the credentials for the first project listed above,
pass the value of "153" to `project_id`.

```{r retrieve-credential}
path_credential <- system.file("misc/example.credentials", package = "REDCapR")
Expand All @@ -140,14 +164,21 @@ credential <- REDCapR::retrieve_credential_local(
credential
```

A credential file is already created for this vignette. In your next real project, call [`create_credential_local()`](https://ouhscbbmc.github.io/REDCapR/reference/retrieve_credential.html) to start a well-formed csv file that can contain tokens.
A credential file is already created for this vignette.
In your next real project, call
[`create_credential_local()`](https://ouhscbbmc.github.io/REDCapR/reference/retrieve_credential.html)
to start a well-formed csv file that can contain tokens.

Compared to the method below, this one is less secure but easier to establish.

Security Method 2: Token Server
-------------------------

Our preferred method involves saving the tokens in a separate database that uses something like Active Directory to authenticate requests. This method is described in detail in the [Security Database](https://ouhscbbmc.github.io/REDCapR/articles/SecurityDatabase.html) vignette.
Our preferred method involves saving the tokens in a separate database
that uses something like Active Directory to authenticate requests.
This method is described in detail in the
[Security Database](https://ouhscbbmc.github.io/REDCapR/articles/SecurityDatabase.html)
vignette.

This approach realistically requires someone in your institution to have at least basic database administration experience.

Expand Down

0 comments on commit 089cfaa

Please sign in to comment.