C
Not statedIs Canva HIPAA compliant?
Checked 6 Nov 2026 from 4 vendor sources
No Canva statement about a BAA or HIPAA was found on the vendor pages read. That isn’t proof either way. Treat it as unsafe for patient data until the vendor confirms in writing.
What we couldn’t confirm
Some of Canva’s documents sit behind its trust portal and we didn’t read them. Ask Canva directly.
Proof from the vendor
- Canva Trust & Security PortalCompliance list has no HIPAA or BAA item in public view
- Security at CanvaNo HIPAA, BAA or PHI mention
- Canva Master Services AgreementNo HIPAA, PHI or BAA mention; refers to separate DPA
- Acceptable Use PolicyNo HIPAA or PHI mention
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.