Ensuring Correct Content Access

One of the key requirements of the site is to ensure correct content access. This is done through a combination of modules. Basically two types of access are required:

1. Patients are able to answer questionnaire (not health care workers). However not all questionnaires but only those they are supposed to answer
2. Healthcare workers (Doctors / Nurses / Coordinators) are able to see answers to the questionnaires from the patients.

Let us breakdown these two potentially competing access problems.

Patient Access

🔔 TLDR; Views is used to restrict the visibility of questionnaires on the Questionnaires available page. Permission to submit answers to a questionnaire is restricted using the Webform Access Module along with Webform Nodes.

To ensure patient access to the required questionnaires and (only patient access) the access control relies on the following steps:

• A taxonomy vocabulary called Project is created which has the names of the Project. This vocabulary will be the keystone for ensuring patients see the questionnaires they are meant to see. As we can see the Project Vocabulary has multiple Projects each of which can be referenced to the user and the content. A project can be thought of as a clinical trial in which the patient will be recruited.

• When patient accounts are created we assign them to a specific project during the account creation process. It is technically possible to assign the patient into multiple Projects but will make a bad user experience. There are other workarounds if this is anticipated using the more complex Group module.

• Questionnaires for the project are created and the we ensure that the access to this questionnaire is restricted so that NO ONE can create a submission. In other words it is not possible to directly submit the answers on the webform. We further restrict this eventuality by ensuring that the webform is not accessible without a webform node. Note that no one creates submission. This is crucial to ensuring that patients see questionnaires they are supposed to see.

• Webform nodes are created which reference the said questionnaire. Each webform node has a Project name field which allows assignment of the said node to a specific project. Thus it is entirely possible to assign a single questionnaire to multiple webform nodes and assign them to specific projects. See the diagram below to understand the concept. Thus the patient is assigned to a project and the webform node is also assigned to the project.

flowchart LR
id1[Questionnaire]
id2[Webform Node Project 1]
id3[Webform Node Project 2]
id4[Webform Node Project 3]
id2.1[Project 1]
id3.1[Project 2]
id4.1[Project 3]
id1 --> id2 --> id2.1
id1 --> id3 --> id3.1
id1 --> id4 --> id4.1

Loading

• We use the Webform access module to restrict access to Webforms to user groups. This is why it is necessary that patients.

• All questionnaires are visible on a single page. We actually show the Webform nodes. How do we restrict the view so that patients see only those questionnaires which belong to the projects they themselves belong to. We use Views to do the magic. See Views Configuration for Questionnaires page for the same.

Healthcare workers access

• To ensure that healthcare workers can see the answers to the questions we have to solve the challenge that different webforms will show results in different places. Thus we may run into situation where copies of the same questionnaire are being used in different projects and this data become fragmented. We solve this problem by storing the webform data into a single content entity using the Webform Entity Handler module.

• To ensure that this content type is restricted in viewing access to only healthcare workers we use the Entity Access By Role Field module. This allows us to restrict viewing privileges for these content nodes to healthcare workers only. We use further views to display the data in variable fashion.

• Note that HCWs are prevented from creating submissions to the questionnaires by ensuring that they do not have access to the form submission privileges through the Webform Access Module.