// Trust & Security Report
National Library of Medicine, National Institutes of Health, U.S. Department of Health and Human Services
PubMed is a free U.S. government service providing access to 40+ million citations and abstracts from biomedical literature. Core products include PubMed (web search interface), PubMed Central (full-text open access articles), My NCBI (user accounts with saved searches), and E-utilities API (programmatic access).
Certifications held
3
Maturity
Enterprise
Trains on your data
Unknown
Trust center
No
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on nlm.nih.gov“As a U.S. government agency operated by NIH (Department of Health and Human Services), PubMed operates under Federal Information Security Management Act (FISMA) standards as required for all federal information systems.”
Verify on nlm.nih.gov“NLM explicitly states compliance: 'NLM complies with requirements for privacy and security established by the Office of Management and Budget (OMB), Department of Health and Human Services (HHS), and the National Institutes of Health (NIH).' Cookie usage follows OMB Memo M-10-22.”
Verify on nlm.nih.gov“NLM complies with HHS privacy and security requirements: 'personally identifiable information is maintained in a database that is regularly purged after 410 days.'”
> Show 6 unconfirmed / not-held certifications
source: ncbi.nlm.nih.govNo public evidence of SOC 2 certification. As a U.S. government service, PubMed does not pursue commercial security certifications.
source: nlm.nih.govNo public evidence of ISO 27001 certification. As a U.S. government service, PubMed operates under FISMA (Federal Information Security Management Act) standards rather than ISO 27001.
source: nlm.nih.govNo public evidence of HIPAA Business Associate certification. PubMed is a government agency subject to HIPAA regulations as a covered entity under HHS, but does not publicly claim HIPAA BA status.
source: nlm.nih.govAs a U.S. government service, PubMed does not claim formal GDPR compliance but processes data per NLM privacy policy; no public evidence of GDPR adequacy determination.
source: ncbi.nlm.nih.govNo public evidence of ISO 27017 certification. Cloud-specific certifications not mentioned in public policies.
source: nlm.nih.govNo public evidence of ISO 27018 certification. PubMed handles minimal PII and purges records after 410 days per policy, but no ISO 27018 certification claimed.
// Privacy & AI training
Trains on customer data
Not stated
Data processing agreement
Not offered
Data region
United States (Bethesda, MD - National Library of Medicine)
PubMed data is unrestricted for use and distribution per NCBI policy. No explicit AI training restrictions or opt-out mechanisms published. NCBI states: 'NCBI places no restrictions on the use or distribution of the data contained therein.' AI/ML training on PubMed data is technically permitted under these terms.
// Security controls
Encryption in Transit
HTTPS enforced. NLM states: 'The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.'
nlm.nih.govTraffic Monitoring
NLM uses software programs to monitor traffic and identify unauthorized attempts to upload, change information, or cause damage.
nlm.nih.govPII Retention Policy
Personally identifiable information is maintained in a database that is regularly purged after 410 days.
nlm.nih.govData Sharing Restrictions
NLM does not give, share, sell, or transfer personal information except as mandated by statute or law enforcement.
nlm.nih.govCookie Policy
Session and persistent cookies (My NCBI) used only for technical functionality and user preferences, following OMB Memo M-10-22. Users may opt out in My NCBI settings.
nlm.nih.govAPI Rate Limiting
E-utilities API users advised to post no more than 3 requests per second; large jobs should run on weekends or 9 PM-5 AM Eastern time.
ncbi.nlm.nih.gov// Products & data scope
data: 40+ million citations and abstracts from MEDLINE, life science journals, and online books. Links to full text via PubMed Central and publisher websites.
Free, web-based, government service. No login required for basic search.
data: User accounts with saved searches, filters, document delivery settings, and institutional access links.
Optional persistent cookie-based system. Users may opt out of persistent cookies.
data: Full-text articles in open access subset. Includes PMC copyright restrictions enforced.
Subset of articles available in full text; copyright restrictions per publisher agreements.
data: All PubMed data accessible via programmatic API. Rate limiting enforced.
Open API for developers. Disclaimer and NCBI copyright notice required in derivative works.
data: Filtered search capabilities for clinical research, systematic reviews, and specialized queries.
No additional data scope beyond standard PubMed.
// At a glance
Pricing model
Free; no cost for any PubMed service. Fully government-funded.
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on National Library of Medicine, National Institutes of Health, U.S. Department of Health and Human Services's own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-06. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
nlm.nih.gov