Is OpenEvidence HIPAA Compliant? BAA, PHI and Safe Use (2026)

Short answer: yes, according to OpenEvidence, with conditions. OpenEvidence states that it fully complies with HIPAA and that U.S. covered entities who enter protected health information (PHI) do so under its Business Associate Agreement (BAA). That does not mean every clinician may paste patient data into it: if you work for a hospital or health system, your employer's policy and contracts decide, and at least one health system tells its staff not to enter PHI because it has no BAA of its own with OpenEvidence.

Disclosure: Arkangel AI wrote this article and makes a clinical AI tool that competes with OpenEvidence. Facts about OpenEvidence come only from its own pages and other sources linked below, checked as of October 2026. This is not legal advice; ask your compliance officer before entering PHI into any tool.

What OpenEvidence says about HIPAA (as of October 2026)

• HIPAA compliance. On April 25, 2025, OpenEvidence announced that it "now fully complies" with HIPAA and that U.S. covered entities can input PHI (announcement). Its Security and Compliance page says it complies with the HIPAA Privacy, Security and Breach Notification Rules.
• BAA. Its Business Associate Agreement (last updated February 5, 2025) is incorporated into its Terms of Use and applies only if the user is a HIPAA covered entity and OpenEvidence handles PHI on its behalf. The security page adds that PHI may also be handled under "customer-specific agreements".
• Responsibility stays with you. The announcement states that all users are responsible for making sure their inputs comply with HIPAA and other privacy laws.
• Security controls. OpenEvidence reports SOC 2 Type II for the Security category, encryption in transit (TLS 1.2) and at rest (AES-256), hosting on Google Cloud Platform and Vercel, and an annual external penetration test (security page).
• Training and privacy. Its privacy policy, updated September 17, 2026, says raw user queries are confidential and that it does not train AI models on PHI. Conversations are private by default, and only conversations without PHI should be shared by public link.

We could not verify from public pages how OpenEvidence confirms that an individual user is a covered entity before the BAA applies, or which subprocessors handle PHI. Ask the vendor if either matters to your review.

Does the BAA cover you?

A BAA is the contract HIPAA requires before a covered entity lets a vendor create, receive, maintain or transmit PHI on its behalf (HHS on business associates). Whether OpenEvidence's click-through BAA covers your use depends on who the covered entity is:

Your situation	Can you enter PHI in OpenEvidence?
Independent clinician or practice that is itself a covered entity, after accepting the Terms of Use	OpenEvidence's BAA is designed for this case; you remain responsible for minimum-necessary use and your own HIPAA program
Employed by a hospital or health system	Only if your employer allows it. The health system is the covered entity; an individual BAA may not cover its data
Student, trainee or non-covered user	Do not enter PHI; the BAA applies only to covered entities
Outside the U.S.	HIPAA is a U.S. law; local privacy law applies, and OpenEvidence has not been available in the EU or UK since 2026 (Telehealth.org)

The second row is not hypothetical. MaineHealth tells its staff it does not have a BAA with OpenEvidence, that it has not reached acceptable terms, and that individual BAAs "do not cover the sharing of MaineHealth data with external parties", so staff should not submit PHI (MaineHealth, checked October 2026). Check your own institution's AI policy before assuming you are covered.

What you may and may not paste

Even with a BAA, HIPAA expects you to share only the minimum necessary. Without one, keep identifiers out entirely. HHS lists 18 identifiers that must be removed for health information to count as de-identified under the Safe Harbor method (HHS de-identification guidance):

1. Names
2. Geographic subdivisions smaller than a state (street address, city, county, ZIP code, with a narrow exception for the first three ZIP digits)
3. All elements of dates except year (birth, admission, discharge, death) and ages over 89
4. Telephone numbers
5. Fax numbers
6. Email addresses
7. Social Security numbers
8. Medical record numbers
9. Health plan beneficiary numbers
10. Account numbers
11. Certificate or license numbers
12. Vehicle identifiers and serial numbers, including license plates
13. Device identifiers and serial numbers
14. Web URLs
15. IP addresses
16. Biometric identifiers, including finger and voice prints
17. Full-face photographs and comparable images
18. Any other unique identifying number, characteristic or code

Two details from the same guidance trip people up: initials or the last four digits of an SSN still count as identifiers, and identifiers in free text (a pasted progress note or discharge summary) must be removed just like structured fields. A rare occupation or an unusual event can also identify a patient.

Usually fine without PHI: "62-year-old with CKD stage 3b and new atrial fibrillation: which anticoagulant and dose?"

Not fine without a BAA that covers you: a pasted note with the patient's name, MRN, admission date or a photo of the chart.

How to use clinical AI safely

1. Default to de-identified questions. Most evidence questions need age range, sex, condition and key values, not identity.
2. Know whose BAA applies. Check your employer's approved-tools list; if a tool is not on it, keep PHI out.
3. Never upload documents with identifiers (labs, reports, photos) unless your organization approved that tool for PHI.
4. Verify every citation. Open the study or guideline behind an answer before acting on it.
5. Do not share conversations that contain PHI. Use public links only for de-identified chats.
6. Keep the record in your EHR, not in a chatbot history.

How Arkangel AI handles privacy

Arkangel AI is a cited medical search tool and an alternative to OpenEvidence. On privacy, this is what we state publicly:

• ISO 27001:2022 certified, with 70+ security controls, penetration testing and continuous monitoring via Vanta (Trust Center).
• HIPAA compliance and a signed BAA on Enterprise plans only. Inputs on the self-serve Free, Pro and Team plans are not covered by HIPAA, so remove names, record numbers, dates and other identifiers before asking a question there.
• Cited answers in English, Spanish, Portuguese and French, with no U.S. NPI required.

See our security and compliance page, pricing and the side-by-side OpenEvidence alternative comparison. For a wider view, read best AI for medical questions in 2026 or AI for doctors.

Frequently asked questions

Is OpenEvidence HIPAA compliant?

OpenEvidence states that it fully complies with HIPAA, including the Privacy, Security and Breach Notification Rules, and offers a Business Associate Agreement to U.S. covered entities through its Terms of Use. Users remain responsible for making sure their inputs comply with HIPAA, and employers may still prohibit PHI.

Does OpenEvidence sign a BAA?

Yes. Its standard BAA, last updated February 5, 2025, is incorporated into the Terms of Use and applies only when the user is a covered entity and OpenEvidence handles PHI on its behalf. Its security page also mentions customer-specific agreements for organizations.

Can I put patient information into OpenEvidence?

Only if you are covered by a BAA that applies to your use and your employer allows it. If you work for a health system, its policy decides; some health systems tell staff not to enter PHI. When in doubt, remove all 18 HIPAA identifiers and ask a de-identified question.

What counts as PHI in an AI prompt?

Health information linked to any of the 18 identifiers HHS lists, such as names, dates more specific than the year, ZIP codes, record numbers, phone numbers or full-face photos. Initials and partial numbers still count, and identifiers inside pasted free text count too.

Does OpenEvidence train its AI on patient data?

Its privacy policy, updated September 17, 2026, states that it does not train AI models on protected health information and that raw user queries are confidential.

Is OpenEvidence available outside the United States?

OpenEvidence is aimed at verified U.S. healthcare professionals, and since 2026 it has not been available in the EU or the UK. HIPAA itself is a U.S. law; clinicians elsewhere should follow their local data-protection rules.

Sources (checked October 2026)

• OpenEvidence. OpenEvidence is now HIPAA compliant (April 25, 2025); Security and Compliance; Business Associate Agreement; Privacy Policy.
• U.S. Department of Health and Human Services. De-identification guidance and Business associates.
• MaineHealth. OpenEvidence notice to staff.
• Telehealth.org. OpenEvidence exits Europe.
• Arkangel AI. Trust Center.