FastForward and HIPAA

The answer, up front

FastForward does not receive, store, or transmit protected health information. It runs inside the clinician's browser. Patient information passes between that browser and Practice Fusion and never reaches our servers.

On that basis we do not act as a business associate, and a Business Associate Agreement is not required.

You do not have to take our word for it — section 4 explains how to verify this yourself in a few minutes.

FastForward is a Chrome extension that saves clicks when charting in Practice Fusion. It applies note templates, enters diagnoses, and copies content from a previous encounter into the note the clinician has open. This page explains where patient information goes, and where it does not.

1.How it works

FastForward operates on the Practice Fusion page already open in the clinician's browser, in the same way a person using a keyboard does — reading what is on screen and filling fields in. It has no server-side connection to Practice Fusion and no access to any Practice Fusion API.

Everything clinical happens in the browser. When FastForward copies text from a previous encounter into today's note, that text is read from one page and written into another, on the clinician's own machine. It is never sent anywhere.

2.What our servers hold

Our servers hold exactly four things about a subscriber:

an email address, used to sign in and to send account email;
a password hash — the password itself is not stored and cannot be recovered;
subscription status, and a Stripe customer reference. Card details are held by Stripe, never by us;
the note templates and diagnosis sets the clinician builds, so they follow them between computers.

Templates are configurations the clinician authors — diagnosis codes, template names and standard wording, including a care plan. They are not patient records, and clinicians are instructed not to place patient-identifying information in them.

We also record which version of our Terms an account accepted, with the date, IP address and browser identifier, as evidence of agreement.

3.What our servers never receive

Patient names, identifiers, demographics, or any other patient information.
Note content read from a patient's chart — chief complaints, subjective, objective, assessment, or plan text. The standard care plan wording a clinician writes into an encounter type is template text, not chart content: it is stored with their templates as described in section 2, and it is written by the clinician, not read from a patient record.
Diagnoses attached to a patient's encounter.
Anything at all read from a chart.
Practice Fusion credentials. Clinicians sign into Practice Fusion themselves; FastForward never sees that password.

There is also no analytics, telemetry, session recording, or usage tracking of any kind in FastForward.

4.How to verify this yourself

Two checks, both available to anyone with the extension installed.

Check what it is permitted to reach. Open chrome://extensions, click Details on FastForward, and look under Site access. It lists two addresses and no others: Practice Fusion, and our own server. Chrome enforces this — the extension cannot reach anything else.

Watch what it actually sends. Open the FastForward panel, right-click inside it, choose Inspect, and select the Network tab. Use FastForward normally. Every request to our server will be one of four: signing in, checking the subscription is still active, fetching configuration, or saving the clinician's own templates. No request carries chart content, because no code exists to send it.

5.Why that means no BAA is needed

A business associate, under HIPAA, is a person or entity that creates, receives, maintains, or transmits protected health information on behalf of a covered entity. FastForward does none of those things: the software runs on the clinician's machine, and protected health information does not travel to us in any form.

A Business Associate Agreement therefore has nothing to govern.

6.Third parties

Three services are involved in running FastForward. None of them receives patient information, because none exists in anything we send them.

DigitalOcean hosts our server and the database of accounts and templates. DigitalOcean offers a Business Associate Agreement, so this layer could be brought under one if that ever became necessary.
Stripe handles payment and subscriptions, receiving the subscriber's email and payment details directly.
Resend delivers account email — the welcome message and password resets. It receives a clinician's email address and the message text. Resend does not offer a Business Associate Agreement, which is not a gap here: we never place patient information in email, and no feature of FastForward emails anything read from a chart.

Separately, FastForward includes a diagnosis-code lookup. When a clinician types into that search box, the text typed is sent from their browser to a public code-search service operated by the U.S. National Library of Medicine, part of the National Institutes of Health, which returns matching ICD-10 codes. That request goes directly from the browser and does not pass through us. It is a code lookup, not a patient lookup, and clinicians are instructed not to type patient-identifying information into it.

We list all of this because a thorough review will find it, and none of it should come as a surprise.

7.What remains the practice's responsibility

FastForward enters information at the clinician's direction. It does not review, validate, or correct what it enters.

The clinician remains responsible for the content and accuracy of every record they create or sign, and should review each note before signing it. FastForward does not change any documentation, coding, or record-keeping obligation the practice already has, and it does not alter the practice's own relationship with Practice Fusion.

8.Questions

If your review raises anything this page does not answer, or your policy requires a Business Associate Agreement regardless of the above, please write to us and we will work through it with you.

FastForward Engineering LLC
manager@fastforwardclicker.com