A BAA is available for OpenEvidence: the standard BAA for individual clinician accounts and customer-specific agreements for Enterprise, both for OpenEvidence clinical search and chat. The vendor's pages say users remain responsible for the lawfulness of what they enter.
Yes A BAA is available for individual clinician accounts under the standard BAA and for Enterprise under customer-specific agreements; the main caveat is that users remain responsible for ensuring their inputs comply with applicable law, including HIPAA (checked 2026-10-20).
Short answer
OpenEvidence's standard BAA applies to U.S. covered entities that input PHI. Organizations can get a customer-specific agreement through Enterprise. The covered service is OpenEvidence clinical search and chat.
The BAA does not make an input lawful. The vendor states that users stay responsible for making sure what they enter complies with applicable laws, including HIPAA. For other tools in the same position, see Is it HIPAA compliant? All vendors.
Which plans include a BAA
A Business Associate Agreement (see the HIPAA glossary) is the contract that allows a vendor to handle PHI for a covered entity. For OpenEvidence it works like this:
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Individual clinician accounts (standard BAA) | Available | The standard BAA applies when a U.S. covered entity inputs PHI | Not published by the vendor |
| Enterprise (customer-specific agreements) | Available | Customer-specific agreement for organizations | Not published by the vendor |
The vendor's pages name no excluded plan, so this page lists none.
What the BAA covers and what it excludes
Covered:
- OpenEvidence clinical search and chat.
Excluded: the vendor's pages checked publish no excluded features. This page does not infer any.
The standard BAA is described for U.S. covered entities. A clinic that is not a U.S. covered entity should not assume the same terms apply to it.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Encryption specifics are under Sources below. A control marked "Not published by the vendor" is not evidence that the control is missing. It means the vendor has not documented it on the pages checked, so a privacy officer who needs it must ask in writing.
How to use OpenEvidence with PHI
Compliance depends on the signed BAA, your configuration and your policies, not on the tool alone. A practical checklist:
- Confirm you are a U.S. covered entity. The standard BAA is described for U.S. covered entities.
- Confirm the agreement before entering PHI. Use the standard BAA for an individual clinician account, or a customer-specific agreement for an organization. Keep a copy.
- Keep inputs lawful and minimum necessary. A clinician asking a drug-interaction question rarely needs the patient's name, date of birth or MRN. The vendor places responsibility for input compliance on the user.
- Ask for unpublished controls in writing. If your risk assessment requires audit logging, SSO or access controls, request them from the vendor. Do not assume them.
- Write the use into staff policy and training. State who may use the tool, for what, and what must never be pasted in.
- Record OpenEvidence in your vendor inventory. Include the BAA date, the plan type and the covered service.
Alternatives with a BAA
If OpenEvidence's terms don't fit your organization, these AI tools also offer a BAA, with verdicts as recorded on this site:
- Amazon Bedrock: yes, all AWS accounts. See Is AWS Bedrock HIPAA compliant?
- Anthropic Claude: conditional, Claude Enterprise with HIPAA enabled by the Primary Owner. See Is Claude AI HIPAA compliant?
- Microsoft Azure: conditional.
- OpenAI ChatGPT and API: conditional, ChatGPT for Healthcare.
- Doximity GPT: yes, Member, free.
Browse more options in HIPAA-compliant software by category.
Sources
- Security and Compliance | OpenEvidence — Trust center, checked 2026-10-20. "Covered entities, as defined by the U.S. Health Insurance Portability and Accountability Act (HIPAA), may choose to transmit Protected Health Information (PHI) on OpenEvidence. We securely store, process, and transmit PHI according to our standard Business Associate Agreement or other customer-specific agreements."
- OpenEvidence is now HIPAA compliant: Health care professionals using OpenEvidence can securely upload PHI — Press, checked 2026-10-20. "U.S. covered entities who choose to input PHI on OpenEvidence agree that such information will be handled in accordance with our Business Associate Agreement (BAA). All OpenEvidence users are responsible for ensuring that their inputs comply with applicable laws, including HIPAA and other privacy regulations."
- Security and Compliance | OpenEvidence — Trust center, checked 2026-10-20. "Data is encrypted in transit and at rest. OpenEvidence uses SSL/TLS to encrypt data in transit and encrypts data at rest using industry-standard encryption algorithms, using strong encryption and authentication (TLS 1.2 with SHA256 certificate). Data is stored within our databases with AES-256."
- Security and Compliance | OpenEvidence — Trust center, checked 2026-10-20. "OpenEvidence has achieved SOC 2 Type II certification for the Security trust services category"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Does OpenEvidence sign a BAA?
Yes. The vendor describes a standard BAA for individual clinician accounts and customer-specific agreements for Enterprise. Both are for OpenEvidence clinical search and chat.
Which U.S. organizations can use OpenEvidence with PHI?
The standard BAA applies to U.S. covered entities that input PHI. Organizations that need their own terms can use an Enterprise customer-specific agreement. Using the tool with PHI still requires the user to keep inputs compliant with applicable law, including HIPAA.
Is data in OpenEvidence encrypted in transit and at rest?
Yes. The vendor publishes encryption in transit (TLS 1.2 with a SHA256 certificate) and encryption at rest (AES-256 in databases). It does not describe the service as end-to-end encrypted.
Does OpenEvidence have a SOC 2 report?
The vendor states it has a SOC 2 Type II report covering the Security trust services category.
Can I paste patient information into the free tool before signing anything?
The vendor's pages say the standard BAA applies when U.S. covered entities input PHI, and that users remain responsible for the lawfulness of their inputs. Confirm the terms that apply to your account before entering any PHI.