On this page
Not that we can confirm, so treat it as no. As of November 12, 2026, we found no business associate agreement and no HIPAA statement in Canva's published policies. Canva is fine for the marketing work most practices use it for: social posts, flyers, handouts and slides with no patient in them. Anything that shows or names a patient should stay out.
Checked November 12, 2026. We ran a web search limited to Canva's own site, covering its terms of use, acceptable use policy and data processing addendum, for HIPAA, BAA and protected health information and found nothing. Several of Canva's pages, including its trust pages, would not load for us that day, so we could not read them in full and we mark Canva "not confirmed" in our BAA table. Ask Canva in writing if you need a firm answer.
What does Canva say?
Nothing we could find, and that is the finding. A vendor that signs BAAs usually says so on a help or trust page and names the plan. Canva's legal pages cover terms of use, acceptable use, privacy, AI products and a data processing addendum. The addendum is about privacy laws such as GDPR. It isn't a BAA, and none of those pages turned up a mention of HIPAA in our search.
A data processing addendum, a security certification or an "enterprise" plan doesn't stand in for a BAA. HIPAA asks for that specific contract before a vendor holds patient information for you. Without it, the safe reading is that Canva is a design tool for content that has no patient information in it.
What can a practice design in Canva?
Almost everything a practice normally makes there:
- social posts and stories about your services, hours and how to book
- flyers, brochures and signs for the office
- general handouts: what to expect at a first visit, how to prepare for a blood draw, a blank symptom tracker
- slide decks for talks and webinars
- your logo, letterhead and email header
- blank form layouts that get filled in somewhere else
The test is simple: could this design be posted in your waiting room as it is? If yes, it's fine in Canva.
What should never go into a design?
- Before and after photos. A patient photo is health information when it comes from your practice, with or without a name on it.
- Testimonials with a name, face or screenshot. A screenshot of a patient's text or review carries their name and what they were treated for.
- Lab results and charts. No "look at these numbers" graphics made from a real report, even with the name cropped out. Dates, ages and odd values can still point to a person.
- Personalized plans. A treatment plan or meal plan made for Dana R. is part of her record. Build the blank template in Canva and fill it in inside your EHR, or in a document tool under a BAA.
- Filled-in forms. Don't upload completed intake forms or consents to trace over or restyle.
- AI features with patient details. Don't paste a patient's story into a text or image generator to get a post out of it.
What about patient photos you have permission to use?
That is a separate question from the BAA. To use a patient's photo or story in marketing, you need their written authorization, which is a specific HIPAA document, not a verbal okay. Authorization lets you publish the image. It doesn't make every tool that touches the image a business associate with a contract.
A cautious way to handle it: keep the original photos and the signed authorization in your EHR or a storage tool under a BAA. Prepare only the final, approved image for posting, with no name, date of birth or other details in the file name or the design. If you aren't sure whether your authorization covers a design tool, ask a healthcare attorney before you upload.
Where do practices slip up?
The usual slip isn't deliberate. A VA is asked to "make something nice" from a patient's kind text message, and the fastest way is to screenshot it and drop it into a template. The design now holds the patient's name, phone number and what they said about their treatment, in a shared Canva team, and gets exported to the scheduling tool and the social platforms.
Write the rule down for whoever makes your graphics: nothing from a chart, a text thread or a photo of a patient goes into Canva. Our guide to what a virtual assistant can do in a medical practice covers which tasks are safe to hand over.
What to use when the design has to include patient information
| Need | Option with a BAA | Plan |
|---|---|---|
| A personalized plan or summary | Your EHR's documents or templates | Covered by the EHR's BAA |
| A formatted handout for one patient | Google Docs or Slides in Google Workspace | A Workspace account with the BAA accepted |
| The same, on Microsoft | Word or PowerPoint in Microsoft 365 | A business plan |
| Storing patient photos | Your EHR, or Dropbox on a team plan | Dropbox: sign the BAA in the admin console first |
You can still design the blank template in Canva, export it and fill it in inside a covered tool. See Does Google Workspace sign a BAA? for how to accept Google's.
To check every tool you use, try the HIPAA and BAA checker. For how the pieces fit together, read the HIPAA-safe tool stack for a solo practice.
This is general information, not legal advice. Confirm BAA terms with each vendor.
Common questions
Does Canva sign a BAA?
We found no BAA or HIPAA statement in Canva's published policies as of November 2026. Until Canva confirms otherwise in writing, treat it as a tool with no BAA.
Can a medical practice use Canva?
Yes, for marketing and general education materials with no patient information in them. Keep patient names, photos, results and messages out of every design.
Can I put before and after photos in Canva?
We'd keep them out. A patient photo from your practice is health information, and we found no BAA from Canva. Publishing a photo also needs the patient's written authorization.
Is Canva's paid plan HIPAA compliant?
We found no Canva plan that comes with a BAA. A paid or team plan adds features, not a HIPAA contract.