About this plugin
it can download their medical reports (referti).
Patients identify themselves with their Italian fiscal code (validated with check digit and “omocodia” support) and verify their identity with a one-time password sent via SMS or with a personal password issued in the “report ready” email — optionally combined (two-step verification).
Reports are exported by the CRM to docs/{PATIENT_ID}/referti/ and registered with the PUSHReferto() helper, which updates the referti table and notifies the patient by email and/or SMS according to the plugin settings.
Main features
- Secure identification: fiscal code + SMS OTP, personal password, or both — with optional two-step verification (password + OTP)
- Personal password automatically generated and delivered with the “report ready” email
- Report list with date, type, specialty, description and “new” badge for reports never downloaded
- One-click download; download tracking (first download date, counter)
- Configurable notifications on new report: email (with password when first issued) and/or SMS (short text, no clinical details)
- Configurable visibility: immediately, after approval from the CRM ( PubblicaReferto() ), or after N days
- Access audit log on the CRM (logins and downloads, with IP) — reports are health data
- Rate limiting, OTP expiry and attempt limits, password lockout after repeated failures
- Temporary suspension of the service with a custom message
- Customizable colors to match your theme; same look & feel as Prenotazioni IGEA
- No external dependencies: all CSS and JavaScript is bundled with the plugin
Security
The API key never leaves the server: the patient’s browser only talks to WordPress, which forwards requests to the CRM. Nonce on every call, field whitelisting, session tokens issued only after identity verification, ownership check on every download, path hardening on the CRM side, rate limiting per IP and per patient.
Requirements
sql ) executed, and — for OTP and SMS notifications — an SMS provider configured. Without the CRM the plugin has no standalone functionality. it.
External services
This plugin sends data to the IGEA CRM server configured by the site administrator (URL and API key in the plugin settings). The data transmitted is what the patient enters in the form (fiscal code, verification codes or password) plus the visitor’s IP address, used exclusively for anti-abuse rate limiting and access logging. Downloaded reports travel from your CRM server to the patient’s browser through your WordPress site.
it or to any third party by this plugin: the destination server is chosen and operated by the site owner.