內容簡介
HIPAA Compliance Helper for Contact Form 7 是一款為 Contact Form 7 提供 HIPAA 技術保障的外掛，能夠加密儲存資料、避免在電子郵件中傳送個人健康資訊，並提供多重身份驗證等功能，幫助管理員保護表單提交的安全性。
【主要功能】
• 加密儲存：使用 libsodium 加密表單提交資料
• 無個人健康資訊：電子郵件中不含個人健康資訊
• 多重身份驗證：內建 TOTP 認證，增強安全性
• 自動登出：設定閒置時間自動登出使用者
• 防篡改審計日誌：記錄所有操作，確保資料完整性
外掛標籤
開發者團隊
② 後台搜尋「HIPAA Compliance Helper for Contact Form 7」→ 直接安裝（推薦）
原文外掛簡介
Adds HIPAA technical safeguards to Contact Form 7: encrypted storage, no PHI in email, encrypted file uploads, an MFA-gated viewer and a tamper-evident audit log.
This plugin helps administrators protect Contact Form 7 submissions while keeping the existing form workflow intact.
What it does
Interception
Runs before CF7 sends mail. Protects every CF7 form by default (or only the forms you choose).
Fails closed
If HTTPS, the encryption key, storage or the write fails, the submission is aborted and nothing is emailed or stored.
No PHI in email
Staff notice contains only a form name, a short reference and a sign-in link. Attachments, Reply-To and answer-echoing tags are stripped. The patient auto-reply (Mail 2) is disabled by default, or replaced with a generic message.
Encrypted storage
Entries are encrypted with libsodium XChaCha20-Poly1305 (authenticated encryption) into wp_cf7_hipaa_entries. Each ciphertext is bound to its entry ID and form ID, so rows cannot be swapped undetected.
Key management
The master key must be defined in wp-config.php. There is no auto-generated fallback key stored in the database. Sub-keys are derived per purpose. Key IDs and CF7_HIPAA_PREVIOUS_KEYS support rotation, and a “Re-encrypt” action migrates entries and files.
Encrypted attachments
Files are encrypted in 64 KB authenticated chunks (truncation, reordering and tampering are detected), stored outside the web root when the host allows it, and delivered only through an authenticated, audited proxy. Original file names live only inside the ciphertext.
MFA step-up
Built-in TOTP (any authenticator app) with replay protection, 5-attempt lockout, single-use recovery codes, and unlock tied to the login session. Secrets are stored encrypted. Sites that already enforce MFA can switch to an attested “external” mode.
Automatic logoff
Server-side idle check plus a client-side timer that signs out and blanks the screen (5 to 60 minutes, default 15).
Tamper-evident audit log
Every view, download, delete, login-step, settings change and blocked submission is recorded in an HMAC hash chain, with an off-database checkpoint. A “Verify integrity” button walks the chain. CSV export. Contains no PHI.
Roles
HIPAA Reviewer can view entries. Only administrators can delete, change settings, view the audit log or reset MFA.
Security Setup screen
Detects common PHI leaks around the plugin: Flamingo and other submission-storing plugins, Akismet on protected forms, missing key, non-HTTPS, storage inside the web root, WP_DEBUG_LOG, users without MFA.
Retention
Optional automatic deletion after N days.
Disclaimer
This plugin provides technical safeguards that may assist with HIPAA-related security work. Installing, configuring, or using it does not make an organization HIPAA compliant. Organizations must perform their own legal, administrative, and technical assessment and maintain all required policies, procedures, agreements, and controls.
Requirements
WordPress 5.9 or later.
Contact Form 7.
PHP 7.4 or later.
The PHP Sodium extension (or the Sodium implementation available through the supported WordPress environment).
HTTPS for production use and protected administrative access.
Configuration
The encryption key must be a securely generated 32-byte key represented as 64 hexadecimal characters. Keep a protected backup of the key. Losing it makes encrypted data unrecoverable.
wp-config.php constants
CF7_HIPAA_ENCRYPTION_KEY (Required) – Base64 of 32 random bytes.
CF7_HIPAA_PREVIOUS_KEYS – Array of older keys, kept so old entries and audit history stay readable after rotation.
CF7_HIPAA_STORAGE_DIR – Absolute path for encrypted files, ideally outside the web root.
CF7_HIPAA_TRUSTED_IP_HEADER – e.g. ‘HTTP_CF_CONNECTING_IP’. Only set if your proxy overwrites that header, otherwise it can be spoofed.
CF7_HIPAA_REMOVE_DATA_ON_UNINSTALL – true to delete all tables and files on uninstall. Default: delete nothing.
CF7_HIPAA_ALLOW_INSECURE – Development only. Disables the HTTPS requirement. Never set in production.
Privacy and data
Submission fields and uploaded files are stored locally in encrypted form. Audit records may include administrator IDs, actions, timestamps, IP addresses, and user-agent information. The plugin does not send submission data to a third-party service.
Deactivating the plugin does not delete stored data. Uninstalling also preserves data by default; an explicit configuration constant is required before a site owner chooses to remove plugin data. Make backups and document retention decisions before changing that behavior.
Key rotation
Generate a new key. Set it as CF7_HIPAA_ENCRYPTION_KEY.
Move the old key into CF7_HIPAA_PREVIOUS_KEYS: define( 'CF7_HIPAA_PREVIOUS_KEYS', array( 'old-key' ) );
Security Setup – Re-encrypt. Repeat until none remain.
Keep the old key listed: earlier audit-log events were signed with it, and integrity verification needs it. Entries stay readable without it once re-encrypted.
HOOKS
cf7_hipaa_audit_logged (action): receives each audit row. Forward to syslog/SIEM for stronger tamper resistance.
cf7_hipaa_transport_secure (filter): tell the plugin a request is secure when TLS ends at a proxy WordPress cannot see.
cf7_hipaa_external_mfa_satisfied (filter): verify your own MFA in “external” mode.
cf7_hipaa_risky_plugins (filter): extend the list of submission-copying plugins to flag.
How it maps to the HIPAA Security Rule (45 CFR 164.312)
This shows what each feature supports. It is not a claim of compliance.
Access control (a)(1): unique user ID, automatic logoff, encryption, WordPress accounts, roles/capabilities, idle logoff, encryption at rest.
Audit controls (b): Hash-chained audit log, integrity verification, export.
Integrity (c)(1): Authenticated encryption for entries and files, chain-verified log.
Person or entity authentication (d): TOTP MFA with replay protection and lockout.
Transmission security (e)(1): HTTPS enforcement at the WordPress layer, no PHI in email.
What this plugin cannot do
It cannot make your host, backups, email provider or other plugins compliant. Software cannot verify BAAs, risk analyses, policies, training or breach procedures. Security Setup lists these as manual items.
It only controls CF7’s own mail and storage. Other CF7 add-ons (CRMs, webhooks, Zapier, Google Sheets, “save to DB” plugins) that hook into submissions still receive the full data. Security Setup flags known ones but cannot see them all.
“Tamper-evident”, not “immutable”. Someone holding both the database and the encryption key can rewrite the log undetected. Forward events off-site (cf7_hipaa_audit_logged) and restrict database privileges where your host allows.
The unlock check happens in WordPress. A compromised server or a malicious administrator with code execution can bypass it.
Loss of the key means loss of the data. That is by design.
No QR code is drawn during MFA setup. It would require sending the secret to a third party or bundling a library. Authenticator apps accept the setup key directly.
Analytics, chat widgets, ad pixels and caching on form pages are outside this plugin’s control.
About BAAs
A self-hosted plugin that never touches your customers’ data generally does not by itself make its author a business associate, and this plugin has no telemetry or remote access. If you later offer hosting, managed service or support with admin access, that changes. Have a healthcare attorney review your terms.
External services
This plugin does not transmit submission data, files, or audit records to external services. Its health check uses a loopback request to the same WordPress installation.
