3

I want to allow 8 different mobile workers to access the same CommCare application on their phones and submit data to the same forms. We are not using user as a case. Is there any reason we shouldn't allow mobile workers to collect data using the same username and password? Are there any risks we should be aware of?

3 Answers 3

4

There are some assumptions that get made about the locality of a user to a single device. If the same user logs into multiple devices there are some edge cases where they won't see updated data that was changed on one of the other devices. This is because the server tries to optimize what data get's synced to a user and assumes that any changes made by the user don't need to be re-synced to the device (since they're already on the device).

There may be other side effects but in general it's not something that is well tested or supported.

1
  • As of CommCare 2.35 this is no longer an issue as the server takes the device ID into account when responding to requests from the phone. Having said that this is still not a well tested or supported workflow.
    – Simon
    Commented May 5, 2017 at 10:48
2

Additional comment depending on how data is used, but in my experience, shared log-ins also create issues and limitations later with how you can potentially filter the form data (IE you cannot filter by user unless you identify who is entering the data in another way), which can impact projects that need to meet IRB standards or other standards wherein you may need to know who entered what.

1

A couple of other things I would add to Simon's answer:

  1. Shared logins can make debugging issues related to syncing much more difficult, because it means that the sync logs for that username actually reflect the activity of several people.

  2. This is probably only a concern for a handful of projects, but shared logins can also compromise data integrity. When multiple people are logging in with the same username, that means that if something "goes wrong" in any way with data that is associated that username, it's nearly impossible to trace the individual person responsible. For this reason, projects that are particularly concerned with security (including those that need to be HIPAA compliant) will want to avoid this pattern.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.