WP web designer and HIPAA

[civieric]

The question arose with a client whether it's possible to use an outside web-designer in a way that would not permit access to HIPAA protected health Information (ePHI) in CiviCRM. 

We're using the Capability Manager Enhanced plugin and I'm wondering if this set of capabilities would give the web designer necessary access while protecting the ePHI. If anyone who's expert on WP and Civi can help me evaluate this role creation, I'd appreciate it:

activate plugins
delete themes
edit theme options
install plugins
install themes
manage options
read
switch themes
update core
update plugins
update themes
level 0

Thanks.

[Coleman Watts]

Well you could certainly have someone work on a copy of your website (there is a simple anonymize script you can run to scramble the civi data). Any code changes they make would be easy to copy over to the live site, and most db changes in Drupal could be managed by something like the features module.
So that's one approach.

[civieric]

That's a good option too. Thanks.
Another option would be to put Civi in a subdomain only available to staff and just use stock WP stuff, since this client may not need public access to any Civi functions--they'll basically be using a custom case type.

[civieric]

(there is a simple anonymize script you can run to scramble the civi data).

Is that script available somewhere?

Thanks.

[JohnFF]

I ended up working on a scrambled CiviCRM site, and the data was unusable. I.e. first names 30+ characters long.

I found it best to replace all individual names, emails, phone numbers with my own, delete the log and email activities, delete all uploaded files, delete smtp and mobile settings... the list goes on, and Future First has its own customised script for this.

[Hershel]

Another option is to copy the WordPress site and then install a fresh, empty CiviCRM onto it, then it has no data.

JohnFF, can you share your script? Or a generic version so that others could also use it?