Is OpenEvidence HIPAA compliant?
A BAA is built into the terms for clinicians who use OpenEvidence, including Visits. The API terms bar patient information.
- Maker
- OpenEvidence Inc.
- Last checked
- November 11, 2026
- In the index
- Full assessment of OpenEvidence
Plan by plan
A business associate agreement (BAA) is the contract HIPAA requires before a tool handles patient information.
| Plan | BAA available | Detail |
|---|---|---|
| OpenEvidence app (free for verified clinicians) | Yes | The BAA is part of the Terms of Use and applies when a covered entity enters patient information. |
| Health system access (institutional agreement) | Yes | A health system with its own contract works under the BAA it signs with OpenEvidence. |
| Visits | Yes | The Terms of Use name Visits in the same section that brings in the BAA. |
| Doctor Dialer | Not stated | Calling, messaging and fax run on outside vendors under a separate Telehealth Policy, which does not mention the BAA. |
| OpenEvidence API | No | The API terms say customers agree not to send protected health information. |
What that means in practice
A clinician who is a covered entity under HIPAA takes on the BAA by accepting the Terms of Use, last updated September 17, 2026. There is no separate form to sign and no paid plan to buy. The agreement is posted in full and was last updated February 5, 2025.
A health system or hospital that has its own contract with OpenEvidence works under the BAA in that contract. Where the two differ, the health system's agreement controls.
The standard BAA names two parties: OpenEvidence and the healthcare provider who accepted the terms. The terms add that a clinician employed by a health system or hospital is responsible for following that organization's policies, whether or not the organization has a contract with OpenEvidence.
The API is separate. Its terms, dated March 16, 2024, say customers agree not to use it for protected health information.
What the agreement leaves out
The API is left out. Its terms bar protected health information. OpenEvidence also says the Share feature is only for conversations that hold no patient information. The BAA lets OpenEvidence deidentify patient information and use the deidentified data to provide or improve its products.
How to read this answer
HIPAA has no certificate a product can hold. The part that can be checked is whether the maker signs a business associate agreement, and for which plans.
A signed agreement is where compliant use starts. The practice still has to set the tool up correctly, control who can use it, and train staff.
This page records what OpenEvidence Inc. documents. It is not legal advice. See the regulatory compliance guide or the HIPAA status of other AI tools.