Open healthcare models, with the fine print attached.

2 MODELS · 2 DEPLOYMENT PROFILES · REVIEWED 2026-10-20

No Anthropic, OpenAI, Gemini, Grok, or merely “open-weight” listings. This public directory is limited to healthcare- or biomedical-specific models and safeguards published under an Apache 2.0 open-source license. The catalog is intentionally small; license ambiguity is a reason to exclude a model, not soften the label.

Governance

How this directory is governed.

Verification status is recorded per field, never per row, and every field carries a source, a retrieval date, the exact configuration scope, a verification status, a reviewer, and a re-verification due date. Where we do not know, the entry says unknown.
Evidence has an expiry, 90 days from retrieval by default. A build containing an expired field fails, so a stale date cannot ship silently.
The directory is re-verified on a quarterly cycle.
The counts shown on this page are generated at build time from the shipped data file.

AVAILABILITY IS NOT COVERAGE

Availability listed here is not coverage for your deployment. A BAA covers specific services and specific configurations under an agreement between specific parties. Nothing in this directory creates coverage, and no model is itself HIPAA-eligible apart from the service configuration it runs in. Verify every field against your own contracts before relying on it.

Evidence

Reading the provenance chips.

VERIFIED: PRIMARY: Confirmed against the provider's own published documentation.
VERIFIED: SECONDARY: Confirmed against a reputable non-provider source.
PARTIAL: Part of the field is confirmed; the rest is not.
UNVERIFIED: Asserted somewhere, confirmed nowhere we accept.
UNKNOWN: We could not determine this. Published as such.

Catalog

Models

Healthcare foundation models

BioMistral consortium (Avignon Université / Nantes Université)

BioMistral 7B

Apache-2.0

Permissive Apache-2.0 license (most permissive in the healthcare-tuned lane), but note the Mistral-7B base and PubMed-derived training data. 2024-era model — older than the current healthcare-tuned generation.

View deployment evidence

Deployment path	Retention	Training use	Zero data retention	Agreement path	Regions
Self-hosted (open weights)OPERATOR: Customer / operator	Operator-defined retention for any downloaded and locally run model; the cited card does not attest a duration or deletion control.PARTIALSOURCE: huggingface.co RETRIEVED 2026-10-20 · RE-VERIFY BY 2027-01-18 · REVIEWER: codex-public-source-review-20261020 SCOPE: Self-hosted deployment of downloaded open weights CAVEAT: The cited publisher card documents access to model weights or local-use instructions, but no operator configuration. Retention, inference-data use, ZDR, BAA and region are operator-defined.	Operator-defined inference-data use for any downloaded and locally run model; the cited card does not attest a deployment policy.PARTIALSOURCE: huggingface.co RETRIEVED 2026-10-20 · RE-VERIFY BY 2027-01-18 · REVIEWER: codex-public-source-review-20261020 SCOPE: Self-hosted deployment of downloaded open weights CAVEAT: The cited publisher card documents access to model weights or local-use instructions, but no operator configuration. Retention, inference-data use, ZDR, BAA and region are operator-defined.	Operator-defined data retention controls for any downloaded and locally run model; the cited card does not establish zero data retention.PARTIALSOURCE: huggingface.co RETRIEVED 2026-10-20 · RE-VERIFY BY 2027-01-18 · REVIEWER: codex-public-source-review-20261020 SCOPE: Self-hosted deployment of downloaded open weights CAVEAT: The cited publisher card documents access to model weights or local-use instructions, but no operator configuration. Retention, inference-data use, ZDR, BAA and region are operator-defined.	No BAA coverage is established by the cited model card; any operator deployment requires its own hosting and configuration review.PARTIALSOURCE: huggingface.co RETRIEVED 2026-10-20 · RE-VERIFY BY 2027-01-18 · REVIEWER: codex-public-source-review-20261020 SCOPE: Self-hosted deployment; HIPAA/BAA responsibility sits with the operator's hosting environment and configuration CAVEAT: The cited publisher card documents access to model weights or local-use instructions, but no operator configuration. Retention, inference-data use, ZDR, BAA and region are operator-defined.	Deployment region is operator-defined; the cited model card does not attest a deployment location.PARTIALSOURCE: huggingface.co RETRIEVED 2026-10-20 · RE-VERIFY BY 2027-01-18 · REVIEWER: codex-public-source-review-20261020 SCOPE: Self-hosted deployment CAVEAT: The cited publisher card documents access to model weights or local-use instructions, but no operator configuration. Retention, inference-data use, ZDR, BAA and region are operator-defined.

Infrastructure

Clinical data safeguards

Knowledgator + DS4DH, University of Geneva

GLiNER-BioMed

Apache-2.0

Infrastructure NER model, not a QA/chat model: probabilistic ML zero/few-shot biomedical entity recognition. As an ML model its detection is probabilistic — distinct from deterministic rule-based detection (see Microsoft Presidio). Candidate PHI-detection recognizer for gateway tooling.

View deployment evidence

Deployment path	Retention	Training use	Zero data retention	Agreement path	Regions
Self-hosted (open weights)OPERATOR: Customer / operator	Operator-defined retention for any downloaded and locally run model; the cited card does not attest a duration or deletion control.PARTIALSOURCE: huggingface.co RETRIEVED 2026-10-20 · RE-VERIFY BY 2027-01-18 · REVIEWER: codex-public-source-review-20261020 SCOPE: Self-hosted deployment of downloaded open weights CAVEAT: The cited publisher card documents access to model weights or local-use instructions, but no operator configuration. Retention, inference-data use, ZDR, BAA and region are operator-defined.	Operator-defined inference-data use for any downloaded and locally run model; the cited card does not attest a deployment policy.PARTIALSOURCE: huggingface.co RETRIEVED 2026-10-20 · RE-VERIFY BY 2027-01-18 · REVIEWER: codex-public-source-review-20261020 SCOPE: Self-hosted deployment of downloaded open weights CAVEAT: The cited publisher card documents access to model weights or local-use instructions, but no operator configuration. Retention, inference-data use, ZDR, BAA and region are operator-defined.	Operator-defined data retention controls for any downloaded and locally run model; the cited card does not establish zero data retention.PARTIALSOURCE: huggingface.co RETRIEVED 2026-10-20 · RE-VERIFY BY 2027-01-18 · REVIEWER: codex-public-source-review-20261020 SCOPE: Self-hosted deployment of downloaded open weights CAVEAT: The cited publisher card documents access to model weights or local-use instructions, but no operator configuration. Retention, inference-data use, ZDR, BAA and region are operator-defined.	No BAA coverage is established by the cited model card; any operator deployment requires its own hosting and configuration review.PARTIALSOURCE: huggingface.co RETRIEVED 2026-10-20 · RE-VERIFY BY 2027-01-18 · REVIEWER: codex-public-source-review-20261020 SCOPE: Self-hosted deployment; HIPAA/BAA responsibility sits with the operator's hosting environment and configuration CAVEAT: The cited publisher card documents access to model weights or local-use instructions, but no operator configuration. Retention, inference-data use, ZDR, BAA and region are operator-defined.	Deployment region is operator-defined; the cited model card does not attest a deployment location.PARTIALSOURCE: huggingface.co RETRIEVED 2026-10-20 · RE-VERIFY BY 2027-01-18 · REVIEWER: codex-public-source-review-20261020 SCOPE: Self-hosted deployment CAVEAT: The cited publisher card documents access to model weights or local-use instructions, but no operator configuration. Retention, inference-data use, ZDR, BAA and region are operator-defined.

Corrections

Tell us what we got wrong.

If any field here is wrong, stale, or misleadingly scoped, email customerservice@healthit.com with the model, the field, and your source. Corrections are reviewed against primary evidence and the field's provenance line is updated with a new retrieval date. We would rather publish a correction than defend an error.

AVAILABILITY IS NOT COVERAGE

Verify every field against your own contracts before relying on it. See the governance block above.