About role-based eForm access

You can create rules that grant or deny access to a particular eForm based on a user role. You can control access to an eForm in a particular visit only, or anywhere it occurs in a visit schedule. All rules are study-specific and do not take eForm or visit cycles into account.

A restricted eForm shows in the schedule in the usual way but if a user without the required user role attempts to access it, they will see a message informing them that they do not have permission to open it. As a restricted eForm shows in the schedule, ensure that you do not allow any sensitive data to be used in the eForm date and label.

Restricted eForms cannot be accessed by an unauthorised data entry user in any way, including from the full and QuickView schedules, from hotlinks on other eForms, from the navigation buttons within other eForms, or from search panel results in the data/audit/SDV/DCR/notes browser. eForm level SDVs display in the SDV browser but the associated eForm cannot be accessed. eForm access rules also apply when importing or exporting data through the API and Command Line, and when using the Batch Validation and Batch Data Loading modules. The Archive and Query modules are administrator-level modules and so are not affected by the rules.

How the access rules work

An eForm access rule can be set to Allow or Deny access, for a particular role. You do not need to use both types of rule. The simplest setup will use one or the other but if you want to control access more precisely you can combine them. Be sure to understand how the two types of rule work, both alone and together.

Allow rules explicitly allow access and always take precedence over Deny rules. This means that:

If Allow rules exist for a particular visit/eForm combination and Deny rules do not exist, then only the roles included in the Allow rules will be granted access.
If no Allow rules exist for a visit/eForm combination and Deny rules do exist, then only the roles which are not included in the Deny rules will have access.
If Allow rules and Deny rules are both set for the same eForm in the same visit scope, then all the Deny rules will be ignored (but not removed), regardless of role.
If no rules are set for an eForm, then no eForm-level restrictions will apply and all roles will have access.

To create and remove eForm access rules, you need the 'Maintain Schedule' permission

Managing eForm access rules

eForm access rules are managed directly from the visit schedule in the Study Definition module. Help on this...

You can also use the API and Command Line modules to perform the following tasks:

Create an eForm access rule
Remove an eForm access rule
Retrieve a list of access rules for a given eForm/visit/role combination (API only)