Users to the plugin can only access the HIPAA Forms Data via WordPress Login. The minimum the user needs is to be assigned the "HIPAA Forms" User Role. No Capabilities need to be chosen for the HIPAA Forms Role (Under Settings/User Permissions) When doing so, and depending on local customizations, the minimum access to WordPress will look like:
Within the HIPAA Forms Plugin, the user will not have Settings or Log Tab as shown here:
Finally, the HIPAA Forms User will Not have access to delete form entries or assign them to another user.