skip to main content
career toolkits

OpenEvidence Governance Checklist: Privacy, PHI, and ‘What Are You Signing?’

A practical governance checklist for OpenEvidence use: privacy policy basics, PHI handling, BAAs, and how to align personal use with organisational rules.

Review date
Jan 2026
Reading time
11 min read
Author
Dr Kola Tytler MBBS CertHE MBA MSt MRCGP
On this page
Career toolkitPractical prompts and templates for applications, portfolios and professional development. Check local employer and regulator requirements before use.
This is a non-clinical governance checklist. It does not judge the tool; it helps you use it responsibly. The practical problem: clinicians adopt tools faster than organisations can write policy. This gives you a defensible personal standard while you wait for formal guidance.

Don’t assume ‘free’ means ‘risk-free’

Before you paste anything sensitive into any AI tool, you need to understand: what data is collected, how it is used, what is retained, and what agreements govern that usage.

The checklist (10 items, done once per tool)

1

1) Read the Privacy Policy and Terms (yes, actually)

Extract four facts: what data is collected, what is stored, retention, and whether data is used to improve services/models.
2

2) Identify whether you will ever input PHI/identifiers

Default to ‘no’ unless your environment explicitly allows it and you understand the contractual/security position.
3

3) Confirm whether a BAA (or equivalent) is relevant to you

If you’re in a US context or dealing with PHI rules, understand whether a Business Associate Agreement is offered and what it implies.
4

4) Check for subprocessors and onward sharing

If the tool uses subcontractors, you need to know whether they are bound to similar restrictions.
5

5) Establish your personal ‘safe use’ policy

Write 3 rules for yourself: (a) no identifiers, (b) request citations, (c) verify in primary sources before action.
6

6) Keep an audit habit (lightweight)

If you use outputs in professional work, record a minimal note: what you asked and what sources were cited (no identifiers).
7

7) Avoid uploading documents you don’t own

Policies, internal documents, and protected content can create IP and confidentiality issues.
8

8) Define a breach/incident response behaviour

If you accidentally paste sensitive information, know the escalation route (local IG, supervisor, etc) rather than pretending it didn’t happen.
9

9) Keep personal vs organisational use separate

If your trust/practice later deploys an approved tool, follow that workflow. Don’t quietly run shadow tooling outside policy.
10

10) Re-check quarterly

Policies and product behaviour change. Recheck terms/privacy periodically (set a recurring reminder if you’re a heavy user).
SourceBack to Toolkits Directory
Open Link

References

OpenEvidence: Privacy Policy (latest)
OpenEvidence: Terms of Use
OpenEvidence: Security and compliance overview
OpenEvidence: Business Associate Agreement (BAA)
Your learning path

Save your place and choose what comes next

sign in to save your learning
Work through this guide (10 steps)

Use the actions from this article to track what you have worked through.

Sign in using the reading controls above to save your steps.

  • Extract four facts: what data is collected, what is stored, retention, and whether data is used to improve services/models.

    Return to this section

  • Default to ‘no’ unless your environment explicitly allows it and you understand the contractual/security position.

    Return to this section

  • If you’re in a US context or dealing with PHI rules, understand whether a Business Associate Agreement is offered and what it implies.

    Return to this section

  • If the tool uses subcontractors, you need to know whether they are bound to similar restrictions.

    Return to this section

  • Write 3 rules for yourself: (a) no identifiers, (b) request citations, (c) verify in primary sources before action.

    Return to this section

  • If you use outputs in professional work, record a minimal note: what you asked and what sources were cited (no identifiers).

    Return to this section

  • Policies, internal documents, and protected content can create IP and confidentiality issues.

    Return to this section

  • If you accidentally paste sensitive information, know the escalation route (local IG, supervisor, etc) rather than pretending it didn’t happen.

    Return to this section

  • If your trust/practice later deploys an approved tool, follow that workflow. Don’t quietly run shadow tooling outside policy.

    Return to this section

  • Policies and product behaviour change. Recheck terms/privacy periodically (set a recurring reminder if you’re a heavy user).

    Return to this section

Portfolios and governance · Article 10 of 12