OpenEvidence

AI clinical search is the entire product.

Proprietary models trained on peer reviewed literature claimed in third party coverage; no model card or technical documentation verified.

PHI handling is documented: encryption in transit and at rest, private by default conversations, explicit user controls over sharing, a Data Classification Policy, and a Data Retention and Disposal Policy with deletion on customer request. Held back from A because the trust center does not state whether user submitted content or PHI is used to train or improve models, which is the central stewardship question for a clinical AI product.

Among the clearest BAA disclosures in the index. The vendor states plainly that US covered entities may transmit PHI and that such information is handled under its standard Business Associate Agreement, announced publicly in April 2025 with a dedicated HIPAA contact address. Compliance is claimed specifically against the HIPAA Privacy, Security, and Breach Notification Rules rather than as a vague alignment statement, and user conversations are private by default with explicit sharing controls.

Upgraded from C on verification of a full public trust center hosted on Secureframe at trust.openevidence.com, plus a dedicated security page. SOC 2 Type II certification for the Security trust services category, verified as an independent audit of controls operating over an extended period. Documented controls include AES-256 at rest, TLS 1.2 with SHA256 certificates in transit, a Secure Development Policy, change approval by an independent reviewer, continuous control monitoring, a tested incident response plan with tabletop exercises and lessons learned documentation, formal risk assessments, and cybersecurity insurance. Depth and independence of disclosure both meet the A anchor.

Epic embedded enterprise deployments documented at Mount Sinai (seven hospitals) and Cedars-Sinai, the latter with patient context aware queries from the EHR.

Free individual tier for verified clinicians published; enterprise per seat structure reported without amounts.