Epic AI vs athenaOne AI: which signs a HIPAA BAA?
Both can be covered by a BAA, on different terms. Epic Systems Corporation signs a BAA for Epic AI on all the plans we list. Athenahealth, Inc. signs one for athenaOne AI only on athenaOne (EHR, practice management and patient engagement).
- Business associate
- Epic Systems Corporation
- Tool
- Epic AI
- Plans with a BAA
- Epic EHR customer license (health systems and medical groups)
- Checked
Signs a BAA
- Business associate
- athenahealth, Inc.
- Tool
- athenaOne AI
- Plans with a BAA
- athenaOne (EHR, practice management and patient engagement)
- Checked
Some plans only
Side by side
| Epic AIEpic Systems Corporation | athenaOne AIathenahealth, Inc. | |
|---|---|---|
| BAA | Signs a BAA | Some plans only |
| Plans with a BAA | Epic EHR customer license (health systems and medical groups) | athenaOne (EHR, practice management and patient engagement) |
| How to get it | Through sales | Through sales |
| AI features outside the BAA | None listed | None listed |
| Sources | 5 sources | 4 sources |
| Last checked | Oct 13, 2026 | Oct 13, 2026 |
Plan by plan
Epic AI
- Epic EHR customer license (health systems and medical groups)Epic is licensed through enterprise contracts with no public pricing or self-serve signup. Epic's API Subscription Agreement says Epic may receive PHI from customers and that this access falls under the HIPAA business associate terms in place between the customer and Epic under a separate agreement. Those business associate terms are not published.Signs a BAA
athenaOne AI
- athenaOne (EHR, practice management and patient engagement)The privacy policy says processing done for provider customers is governed by customer agreements that may include BAAs as HIPAA requires. The athenaOne help page says athenahealth keeps HIPAA security and privacy plans and has business associate agreements with third parties it hires that need access to practice data. No page states outright that athenahealth signs a BAA with every athenaOne practice, and the agreement text is not public.Conditions apply
If you handle patient data
Either can work. Choose on features and price, then make sure you’re on a plan listed above and the BAA is signed before anyone enters protected health information.
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.