My employer is a health & wellness company, and we already have a fairly well developed Drupal site.
We're looking into adding client/patient and staff forms to our site, which will contain private & confidential information about a patient's health as well as confidential company information related to each of our staff.
Of course, from the web site's front end the permissions and such are structured so only those allowed to see any given piece of information can, but we're a fairly good sized organization, and what is the correct handling of permissions for our web developers? We have some foreign and domestic contractors, as well as several internal staff with admin roles and permissions to access anything. We don't like that they could access confidential patient and staff records in the database...
What are people doing to secure their databases holding confidential patient records from internal & contractor staff?
Comments
Give them access to a
Give them access to a development version of the website which doesn't contain the confidential information, so they can just do their work and your admin or the developer you trust can integrate the changes into your main website.