Victor Font replied 2 years ago

What are you actually trying to do, Matt? I use the free version of MemberPress on the Formidable Masterminds site to lock down Developers Corner content.

Your question suggests you're allowing users to create form entries that you are displaying somewhere using something.

I don't understand why you need another connection between Formidable and MemberPress, though. MemberPress uses wp user id. What other kind of connection do you need that user id doesn't already provide?

What does the attribution look like? What's the source of the data you want displayed in the attribution?

Matt Clute replied 2 years ago

Thanks Victor,

The issues I've run into seem to stem from the hosting provider. Since I am dealing with ePHI I went with a specific host (HIPAAVault) that does not allow me admin controls for managing wp users. Apart from that I also don't have access to manage plugin/updates.

I am trying to figure out if I have a sellable web app using my current host provider. If I can't manage the wp users then I don't see how I could sell or manage access to my site and its forms.

I didn't realize that all plugins (memberpress included) use the same wp user id and was trying to find a way around my limited admin controls. If I could use the free version of memberpress I would definitely prefer that.

From a compliance perspective, do you think most hosting providers offering "hipaa compliant wordpress" would lock the customer out of plugin/user management?

Victor Font replied 2 years ago

Those restrictions sound odd to me Matt. It makes me think that it might be what a host would do if you were in a shared hosting, multi-site WordPress, or SAAS environment. My experience with HIPAA compliant systems has always been from working on dedicated servers. I always had full access to the site because I was it's builder. A dedicated server is an extension of your business. You work with the hosting company to make sure system level operations are secure and functioning, but the application is totally yours. I have a dedicated server for my business operations and have root access to perform system level functions. Granted, my server is not setup for HIPAA compliance, but I had the same broad access on the HIPAA compliant servers I worked with in the past.

If your plugins are functioning, it means wp_users is not restricted for any code running on the site. They probably just hid the menu from your admin, which makes me lean toward multi-site because this is what I did for clients running multi-site.

If the code works, this means it's accessible to you too, if you know how to access it. Do you have access to PHPMyAdmin for your site? You should not be restricted in any way from accessing your site's database. Even shared hosting providers give access to PHPMyAdmin. If you can see wp_users in PHPMyAdmin, then you can write code to do your wp_users work through Formidable and WordPress hooks.

Do you have FTP access? If you have FTP Access, you can work around not being able to do what you need to do with plugins, but in a HIPAA environment, you may need to have a test instance from which you can validate and document server changes. I'm not sure about that. It's best you discuss with a HIPAA specialist.

It's been awhile since I've worked on a HIPAA compliant system. I did a quick Google search for "hipaa compliant wordpress hosts" and the search results display many of the big hosts. I looked at Liquid Web's HIPAA Compliant Dedicated Server hosting page and a Linux server that provides at-rest data encryption starts at $574/mo. They also have HIPAA specialist's you can talk to about your hosting needs. Here's the link: https://www.liquidweb.com/solutions/hipaa-compliant-hosting/