Is UpToDate Expert AI HIPAA compliant?
Only on the right plan. Wolters Kluwer signs a Business Associate Agreement for UpToDate Expert AI on Enterprise / institutional subscription. Other plans aren't covered, so keep patient data out of them.
Does UpToDate Expert AI sign a BAA?
Only on some plans or setups
UpToDate's terms say Expert AI is not intended for protected health information. PHI may be entered only if the user's organization has signed a BAA with UpToDate that expressly covers Expert AI; individual subscribers have no such route.
Not fully covered by the BAA: UpToDate Expert AI (generative clinical Q&A).
- Business associate
- Wolters Kluwer
- Tool
- UpToDate Expert AI
- Plans with a BAA
- Enterprise / institutional subscription
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Individual / personal professional subscription | No BAA | Not offered | The terms say UpToDate is not designed to receive or process PHI and bar entering PHI into Expert AI. The only exception requires an organization-level BAA, and no route for an individual subscriber to obtain one is described.[1] |
| Enterprise / institutional subscription | Conditions apply | Through sales | PHI may be entered only if the organization has executed a BAA with UpToDate that expressly applies to Expert AI, the user is not otherwise barred, and HIPAA permits the disclosure. A general UpToDate BAA that does not name Expert AI is not enough. The terms do not say how to obtain such a BAA; arrange it through the enterprise contract. Many health systems tell clinicians not to enter PHI at all.[1],[2] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Wolters Kluwer says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| UpToDate Expert AI (generative clinical Q&A)Enterprise / institutional subscription | Partly covered | Covered only where an organization BAA expressly names Expert AI; otherwise PHI is prohibited. Outside a list of markets including the U.S., Expert AI is an experimental pilot not for personal data at all. Wolters Kluwer says it works closely with OpenAI on its expert AI platform but does not state which model powers Expert AI.[1],[3] |
Clinical AI assistants that offer a BAA
- Ada HealthBAA on: Enterprise partner deployments (health systems, payers)Some plans only
- Glass HealthBAA on: Glass Developer APISome plans only
- InfermedicaBAA on: Enterprise / API clients (health systems, payers, digital health)Signs a BAA
- OpenEvidenceBAA on: OpenEvidence accounts used by US covered entitiesSigns a BAA
- OverjetBAA on: Overjet customers under a Master Services AgreementSigns a BAA
- Viz.aiBAA on: Enterprise platform subscription (hospitals and health systems)Signs a BAA
All BAA-ready alternatives to UpToDate Expert AI
Sources
- Clinical Effectiveness Terms of Use
- UpToDate Expert AI
- Wolters Kluwer and OpenAI expand enterprise AI collaboration
- New UpToDate Expert AI feature available to VUMC users
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.