The parties
This Business Associate Agreement (the “Agreement”) is entered into between your practice (the “Covered Entity”) and Yanis Tiam, an individual operating the Yanforms service at yanforms.com (the “Business Associate”). It applies to every form the Business Associate builds and hosts for the Covered Entity under the Yanforms Terms of Service.
Terms used but not defined in this Agreement, such as Breach, Protected Health Information (“PHI”), Electronic PHI, Security Incident, Subcontractor, Unsecured PHI and Required by Law, have the meanings given in the HIPAA Rules at 45 CFR Parts 160 and 164.
What we do with PHI
The Business Associate rebuilds the Covered Entity’s paper forms as web forms, and routes each completed form to Google Workspace, where the signed document is stored in a folder shared with the Covered Entity.
The Business Associate may use or disclose PHI only to provide this service, as Required by Law, or for its proper management and administration as permitted by 45 CFR 164.504(e)(4).
The Business Associate’s own servers do not receive the content of completed forms. They receive only a count: which form was used, and when. PHI is created on the patient’s device and stored in Google Workspace.
Our obligations
Not to use or disclose PHI other than as permitted by this Agreement or as Required by Law, and to request, use and disclose only the minimum necessary PHI.
To use appropriate safeguards, and to comply with Subpart C of 45 CFR Part 164 (the Security Rule) for Electronic PHI, to prevent any use or disclosure not provided for by this Agreement.
To report to the Covered Entity any use or disclosure not provided for by this Agreement, including any Breach of Unsecured PHI as required by 45 CFR 164.410, and any Security Incident of which it becomes aware, without unreasonable delay and in no case later than 10 business days after discovery.
To ensure that any Subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to the same restrictions and conditions. The Covered Entity acknowledges that the Business Associate uses Google Workspace, under Google’s Business Associate Agreement, to receive and store completed forms.
To make PHI available to the Covered Entity so it can meet its obligations on access (45 CFR 164.524), amendment (45 CFR 164.526) and accounting of disclosures (45 CFR 164.528), within 10 business days of a request.
To the extent it carries out one of the Covered Entity’s obligations under Subpart E of 45 CFR Part 164, to comply with the requirements of Subpart E that apply to the Covered Entity in performing that obligation.
To make its internal practices, books and records relating to PHI available to the Secretary of HHS for purposes of determining compliance with the HIPAA Rules.
Your obligations
To upload only blank forms, with no patient information, when ordering a form.
To notify the Business Associate of any limitation in its notice of privacy practices, any change in or revocation of a patient’s permission, and any restriction on the use or disclosure of PHI it has agreed to, to the extent this may affect the Business Associate’s use or disclosure of PHI.
Not to ask the Business Associate to use or disclose PHI in any manner that would not be permitted under the HIPAA Rules if done by the Covered Entity.
Term and termination
This Agreement takes effect when signed and remains in effect as long as the Business Associate hosts at least one form for the Covered Entity, or holds PHI for it.
Either party may terminate this Agreement if the other party materially breaches it and does not cure the breach within 30 days of written notice.
On termination, the Business Associate shares with the Covered Entity the Google Workspace folders holding its completed forms, then deletes its own copies. Where returning or deleting PHI is not feasible, the Business Associate extends the protections of this Agreement to that PHI for as long as it keeps it. Patient records are never deleted before being shared with the practice.
General terms
A reference to a section of the HIPAA Rules means the section in effect or as amended. The parties agree to amend this Agreement as needed for compliance with the HIPAA Rules, and any ambiguity is resolved to permit compliance with them.
This Agreement is governed by the laws of the state in which the Covered Entity is located, except where federal law applies. It is provided at no charge.
The parties agree to sign this Agreement electronically. An electronic signature has the same effect as a handwritten one.
How we sign it
Once you confirm a form, we email you a link to sign this agreement on your phone or computer, with no account to create. Once both parties have signed, a copy is saved in your practice’s Yanforms folder in Google Drive. Your form is not used with patients before it is signed. For any question, reply to any email you received from us.