Is OpenEvidence HIPAA compliant?
Checked 6 Nov 2026 from 5 vendor sources
OpenEvidence’s May 6, 2025 terms, announcement and security page say covered entities’ PHI is handled under its BAA, but an undated copy of its terms says inputs are not HIPAA-covered. Confirm directly. The vendor’s position isn’t clear enough to rely on. Treat it as unsafe for patient data until the vendor confirms in writing.
| Plan or product | BAA |
|---|---|
| US covered entities that choose to enter PHI, under the Terms of Use | Covered |
What the BAA leaves out
- Public share links may be used only for conversations without PHI
How to get the BAA
The May 6, 2025 terms incorporate the BAA by reference for covered entities sending PHI. OpenEvidence Enterprise setup also includes putting a BAA in place for organizations.
What the vendor says to do
- Do not create public links for conversations with PHI
- Users must make sure inputs comply with applicable law, including HIPAA
- Vendor recommends removing identifying information before submitting content
What we couldn’t confirm
OpenEvidence’s pages disagree. Different copies of its terms and security page say opposite things about HIPAA coverage. We couldn’t read the BAA itself, and its pages address covered entities, not business associates. Get the current terms in writing.
Proof from the vendor
- OpenEvidence Enterprise portalEnterprise setup includes a BAA for organizations
- OpenEvidence is now HIPAA compliant (April 25, 2025)Covered entities may enter PHI, handled under the BAA; public link limit
- Terms of Use (last updated May 6, 2025)BAA incorporated by reference, user responsibility for consents and authorizations
- Security (www host)States PHI is handled according to the BAA
- Security (non-www host)Returned conflicting text saying inputs are not covered by HIPAA and users must keep PHI out
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.