Is ClinicalKey AI HIPAA compliant?
Not confirmed. We couldn't find a Business Associate Agreement offer for ClinicalKey AI on Elsevier's own pages. Without a signed BAA, keep patient data out of it.
Does ClinicalKey AI sign a BAA?
Not confirmed
Elsevier markets ClinicalKey AI for use under HIPAA and says it has controls to protect PHI, but no official page says whether Elsevier signs a BAA for it. The separate Ask AI feature in classic ClinicalKey is described as not storing or processing patient-identifiable information. BAA availability is unknown.
- Business associate
- Elsevier
- Tool
- ClinicalKey AI
- Plans with a BAA
- Not stated
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| ClinicalKey AI (institutional license) | Not confirmed | Not stated | The product page says it is built to be HIPAA-compliant (where recognized by country regulators) and encrypts user data in transit and at rest; a 2026 press release says it has controls built to help protect PHI. Neither page, nor the Elsevier Trust Center, mentions a BAA or how to request one. Sold to institutions; ask Elsevier sales whether a BAA is available before entering PHI.[1],[2],[3] |
| ClinicalKey with Ask AI (existing ClinicalKey subscription) | Not confirmed | Not stated | Elsevier says ClinicalKey (with Ask AI) does not store, process or retain patient-identifiable information. It does not say whether a BAA is offered, so treat this surface as not intended for PHI.[2] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Elsevier says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| ClinicalKey AI answers (incl. patient-context prompts, EHR/SMART on FHIR access, mobile dictation)ClinicalKey AI (institutional license) | Not stated | Responses can be tailored to patient context such as age, comorbidities and medications when prompted. Elsevier markets PHI protections but publishes no BAA, so BAA coverage of these features is unknown. Query history is kept and managed in a privacy panel.[1],[2] |
| Ask AI in ClinicalKeyClinicalKey with Ask AI (existing ClinicalKey subscription) | Not stated | Described as not storing, processing or retaining patient-identifiable information; no BAA is mentioned.[2] |
Clinical AI assistants that offer a BAA
- Ada HealthBAA on: Enterprise partner deployments (health systems, payers)Some plans only
- Glass HealthBAA on: Glass Developer APISome plans only
- UpToDate Expert AIBAA on: Enterprise / institutional subscriptionSome plans only
- InfermedicaBAA on: Enterprise / API clients (health systems, payers, digital health)Signs a BAA
- OpenEvidenceBAA on: OpenEvidence accounts used by US covered entitiesSigns a BAA
- OverjetBAA on: Overjet customers under a Master Services AgreementSigns a BAA
All BAA-ready alternatives to ClinicalKey AI
Sources
- ClinicalKey AI
- Elsevier makes new Ask AI feature in ClinicalKey available to more than 1,500 hospital sites in the US
- Elsevier Trust Center
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.