Webform Permissions

Overview

The Drupal Webform module has a fine grained permission system which we have leveraged for the site. The fundamental principles that underlie the permission system are as follows:

1. Only patients should be able to fill questionnaires unless specifically marked for the healthcare providers. This will prevent the possibility of spurious data submission.
2. Patients should be able to see only their results and no one elses
3. Administrators and Project Managers should be able to create questionnaires using Webforms module.
4. Administrators and Project Managers should also be able to translate questionnaires.

▶️ N.B. Roles defined in the application are defined in the Roles Configuration Page.

▶️ Please see the Permissions by Term Configuration Page to learn how the permisssion system works along with these permissions to allow patients to see only questionnaires that they need to see.

Modules

Most of the permissions are defined by the core Webforms module. However additional permissions for translations will be defined by the Webform Translation Permission module (see Multilingual Capability Page).

Core Permissions

We allow project managers to:

1. Access the Webform overview page: This will allow Project Managers (and administrators) to access the page where Webforms can be created. Note that we are not allowing the Project managers access to all webforms. Selected Webforms that can be duplicated will be available.

2. Access the Webform Help page: This page has a large number of resources which show how the module can be used.

3. Access own Webform's configuration: This allows the project managers to edit the configuration of the individual webform. Please see Setting Up Questionnaires to read more about this.

4. Create, Edit and Delete own Webform: This permission is self explanatory and allows the Project Manager to create, edit and delete a questionnaire on the site.

Patients can view their own webform submission. This is a global permission. However they cannot edit their submission. Note that this permission can be given if desired seperately for a specific questionnaire.

Individual Webform Permissions

In addition to the above global permissions certain access controls are required at the level of the individual Webforms itself. This is there to ensure that the correct persons can seen and complete the questionnaires. This is done at the Settings > Access tab of the individual Webform page

We recommend that the following permissions be given for a patient reported outcome measure questionnaire.

• Administer the Webform and the Submission Permission granted to Project Managers and Administrators. Note that it is entirely possible to customise this and restrict the availability to other roles.

This set of permission ensures that project managers can change the configuration of the Webform. Note that the administer permission is optional and should be given only and only if we need the project Manager to actually use or edit the questionnaire.

To understand the impact of this permission please see the following two images:

This image shows the questionnaires that the administrator can see on the Webform Overview page.

The above image shows the questionnaires that the Project manager can see. As noted the Project Manager (pm1) can see the questionnaire created by ownself and another questionnaire whose configuration rights have be given by the administrator / creator of the webform.