Including PHI in communications should only include the minimal amount of information needed. This determination should be made by your study Principal Investigator. Any inclusion of PHI is the responsibility of the PI to be in accordance with your IRB. REDCap administrative review will not be responsible for confirming your use of PHI in project communications.
Can PHI be included in emails sent via REDCap?
Yes, assuming your project has IRB-approval to include such information in an e-mail (if your project is governed by the IRB).
How should REDCap emails containing PHI be protected?
Include PHI in the subject line of the email without any other characters touching the letters PHI.
Example Subject line: PHI Your Survey Awaits
How do I determine what is PHI?
Review the university IRB resources for PHI: https://irb.utah.edu/_resources/documents/pdf/IGS%20-%20The%2018%20Protected%20Health%20Information%20PHI%20HIPAA%20Identifiers%20C2013.pdf