Does OpenEvidence sign a BAA?
Yes, it signs a BAA
OpenEvidence signs a BAA with US covered entities: since April 25, 2025 it says any PHI they enter is handled under its Business Associate Agreement. It does not say how that BAA is executed or which features and account types it covers.
- Business associate
- OpenEvidence
- Tool
- OpenEvidence
- Plans with a BAA
- OpenEvidence accounts used by US covered entities
- Checked
Signs a BAA
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| OpenEvidence accounts used by US covered entities | Signs a BAA | Not statedhipaa-feedback@openevidence.com | The announcement and security page say HIPAA covered entities may enter PHI and that it is handled under OpenEvidence's BAA. Neither page says whether the BAA is accepted automatically with the terms or must be requested, and neither describes plan tiers.[1],[2] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what OpenEvidence says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Clinical question answering with PHI input | Covered | PHI that covered entities enter on OpenEvidence is handled under the BAA. Specific features (such as Visits or DeepConsult) are not named, so their individual coverage is unconfirmed. Hosting is mainly on Google Cloud Platform and Vercel.[1],[2] |
Compare OpenEvidence
- OpenEvidence vs Glass HealthGlass Health: some plans
Sources
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.