OpenEvidence vs Glass Health: which signs a HIPAA BAA?
Both can be covered by a BAA, on different terms. OpenEvidence signs a BAA on every plan we list. Glass Health signs one only on Glass Developer API.
- Business associate
- OpenEvidence
- Tool
- OpenEvidence
- Plans with a BAA
- OpenEvidence accounts used by US covered entities
- Checked
Signs a BAA
- Business associate
- Glass Health
- Tool
- Glass Health
- Plans with a BAA
- Glass Developer API
- Checked
Some plans only
Side by side
| OpenEvidenceOpenEvidence | Glass HealthGlass Health | |
|---|---|---|
| BAA | Signs a BAA | Some plans only |
| Plans with a BAA | OpenEvidence accounts used by US covered entities | Glass Developer API |
| How to get it | Not stated | Accept or sign online |
| AI features outside the BAA partly covered excluded | None listed |
|
| Sources | 2 sources | 4 sources |
| Last checked | Oct 11, 2026 | Oct 11, 2026 |
Every plan
OpenEvidence
- OpenEvidence accounts used by US covered entitiesThe announcement and security page say HIPAA covered entities may enter PHI and that it is handled under OpenEvidence's BAA. Neither page says whether the BAA is accepted automatically with the terms or must be requested, and neither describes plan tiers.Signs a BAA
Glass Health
- Glass Developer APIOrganizations using the API for PHI workflows can get a BAA through a click-through agreement in Glass API settings. Glass recommends synthetic or de-identified data until the BAA is in place, and says the BAA covers Glass's processing of the data the product sends.Signs a BAA
- Clinician app (Lite free, Starter, Pro, Max)Glass marketing pages say it supports BAA-backed workflows available directly from Glass, but they tell readers to confirm BAA terms for each plan and name no plan. Plans as listed: Lite (free), Starter ($20/mo), Pro ($90/mo) and Max ($200/mo, EHR integration).Not confirmed
If you handle patient data
Either can work. Choose on features and price, then make sure you’re on a plan listed above and the BAA is signed before anyone enters protected health information. Keep PHI out of the AI features listed as outside the BAA.
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.