Skip to main content
BAA Directory

Is OpenEvidence HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA

Yes. OpenEvidence says it handles PHI under its standard Business Associate Agreement, which is part of its Terms of Use for healthcare providers that are covered entities.

AI assistants. Checked on the vendor's own pages on .

Using OpenEvidence on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What OpenEvidence says

“We securely store, process, and transmit PHI according to our standard Business Associate Agreement or other customer-specific agreements.”

Source: OpenEvidence, Security and Compliance (Protected Health Information), checked .

“Covered entities, as defined by the U.S. Health Insurance Portability and Accountability Act (HIPAA), may choose to transmit Protected Health Information (PHI) on OpenEvidence.”

Source: OpenEvidence, Security and Compliance (Protected Health Information), checked .

“This Business Associate Agreement (this “Agreement”) is incorporated by reference into and made a part of OpenEvidence’s Terms of Use”

Source: OpenEvidence, Business Associate Agreement (last updated February 5, 2025), checked .

What the BAA covers and excludes

Covers, in OpenEvidence's words:

  • "the terms of this Agreement apply only if and solely to the extent that (1) Customer is a Covered Entity as defined under HIPAA"

What this means for ad tracking

OpenEvidence is a medical knowledge platform for healthcare professionals (OpenEvidence). Its security page says covered entities may choose to transmit PHI on OpenEvidence, and that it handles that PHI under its standard BAA or other customer-specific agreements (OpenEvidence).

That BAA covers OpenEvidence. A BAA binds only the vendor that signs it. This directory lists Meta and Google Ads as not signing a BAA, so data from your practice website should reach them with no health details. Our guides to HIPAA compliant chatbots and the HIPAA compliant software list cover other tools.

Curve Compliance helps with that part: it sends the conversion itself server-side under a BAA it signs on every plan, sends each platform only a fixed list of fields, and detects PHI-like patterns before data reaches an ad platform. Book a call to see it on your own funnel.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve carries the conversion signal to your ad platforms separately, under its own BAA, so you can keep OpenEvidence for what it does well.
  • Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn from Curve's servers.
  • Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
  • Each platform receives only a fixed list of fields. Contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names.
  • Event Logs show what Curve sent to each platform and what the platform accepted.
  • Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Does OpenEvidence sign a BAA?

Yes. In OpenEvidence's words: “We securely store, process, and transmit PHI according to our standard Business Associate Agreement or other customer-specific agreements” (OpenEvidence). We checked OpenEvidence's own pages on October 26, 2026.

Is OpenEvidence HIPAA compliant?

OpenEvidence says it complies with HIPAA, including the Privacy, Security and Breach Notification Rules, and that covered entities may choose to transmit PHI on OpenEvidence (OpenEvidence). How you use it is still your responsibility, so talk to your counsel about your own setup.

Do I need to sign a separate BAA with OpenEvidence?

OpenEvidence's BAA says it “is incorporated by reference into and made a part of OpenEvidence’s Terms of Use” and is between OpenEvidence and the healthcare provider that has agreed to those terms. It applies only where the provider is a covered entity and OpenEvidence handles PHI for it (OpenEvidence). OpenEvidence also mentions other customer-specific agreements (OpenEvidence).

Can I enter PHI in OpenEvidence's question box?

Only under the BAA. OpenEvidence's BAA applies only where the healthcare provider that agreed to its Terms of Use is a covered entity and OpenEvidence handles PHI for it (OpenEvidence). Ask OpenEvidence which accounts and features its BAA covers before you enter PHI.

What does Curve Compliance do for ad tracking?

Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. It detects PHI-like patterns before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Book a call to see it on your own funnel.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup, typically live in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with OpenEvidence before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call