Is Canva HIPAA compliant? Using patient photos in marketing designs

Short answer from Canva's own trust pages

That leaves a clear rule: Canva is for finished, approved marketing images, never for the raw material.

What counts as PHI in a marketing design

Protected health information (PHI) is health information that identifies someone. In a design, these count:

• Identifiable faces, including partial faces a friend would recognize.
• Distinctive features such as tattoos, birthmarks or jewelry. HIPAA's Safe Harbor list includes "Full face photographic images and any comparable images" and "Any other unique identifying number, characteristic, or code" (45 CFR 164.514(b) (opens in a new tab)).
• Before-and-after photos, which show both who and what was treated.
• Screenshots of reviews that name or picture a patient, even if the patient posted publicly.
• Appointment details: a "Happy birthday, Maria!" post, a schedule in the background of an office photo, or a chart visible on a monitor.

Before/after photos and testimonials: authorization first

HIPAA requires a patient's written authorization before you use their PHI for marketing (45 CFR 164.508(a)(3) (opens in a new tab)). A signed photo-release from 2019 that says "for our records" doesn't stretch to a 2026 Instagram ad. What the form must contain is in authorization for patient photos, and surgical practices should also read before-and-after photo consent.

Testimonials carry a second set of rules. The FTC's Endorsement Guides say an endorsement must reflect "the honest opinions, findings, beliefs, or experience of the endorser," and an ad built on one patient's result should disclose "the generally expected performance" if that result isn't typical (16 CFR 255 (opens in a new tab)). More in FTC Endorsement Guides. The posting side, including replying to reviews without confirming someone is a patient, is in HIPAA and social media.

Check that each authorization covers the use you plan, then keep everything outside the approved image out of Canva: file names with patient names, unapproved angles, intake photos.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Brand kits, shared folders and who can see uploads

Design tools are built for sharing, which is the problem. Once an image is in a team workspace, it can end up in templates, brand kits and shared folders that people outside your practice can open, such as a freelance designer or an agency.

Run these checks in your own account:

• Who is on the team, and does anyone outside the practice have access?
• Which folders hold patient images, and who can open them?
• Are any patient images saved in a brand kit or template others reuse?
• Are there old uploads from finished campaigns still sitting in the library?
• Is anyone designing from a personal account instead of the practice's?

A safe design workflow for practice marketing

1. Get the authorization signed first, and file it with the image.
2. Keep originals in a BAA-covered system, such as your EHR or a Workspace account with the BAA accepted, never in Canva or a personal phone album.
3. Approve the final crop there. Remove backgrounds, charts and anything not covered by the authorization before export.
4. Upload only the final approved image to Canva, with a neutral file name ("knee-case-04.jpg").
5. Restrict the folder to the people producing that campaign.
6. Delete the upload when the campaign ends, and note the date in your authorization log.

Many practices skip patient images altogether for paid ads. Medfy's Meta ads + AI creatives add-on ($199/month) makes on-brand static ads from your own website, with copy written for healthcare ad policies, and ad platforms never receive patient data. See AI ad creative for the approach and Meta ads + AI creatives pricing for the plan. To see what your current ads and pages expose, start with a free marketing audit. Other tools are covered in HIPAA-compliant software.

Frequently asked questions

Does Canva sign a BAA?

We found no evidence that it does. Canva's Trust and Security portal lists SOC 2 Type 2, ISO/IEC 27001, PCI DSS, GDPR, CCPA and other programs, but not HIPAA, and mentions no business associate agreement. Canva's terms and help pages blocked our automated checks. Treat Canva as uncovered unless Canva gives you a BAA in writing, and confirm with your compliance officer or attorney.

Can I upload patient before-and-after photos to Canva?

Only the final images a patient has authorized for marketing, in writing, and only if the authorization covers that use. Keep raw clinical photos, extra angles and anything with names or dates out of Canva, because it doesn't appear to sign a BAA. Store originals in a covered system and delete uploads after the campaign. Check your process with your compliance officer or attorney.

Is a de-identified photo still PHI?

Not if it truly meets HIPAA's de-identification standard. Under the Safe Harbor method, full-face images and any comparable images must go, along with other identifiers, and the practice must have no actual knowledge the image could identify the person. Cropping out a face often isn't enough when tattoos, jewelry or backgrounds remain. Get an authorization anyway and ask your compliance officer.

How should a practice store approved patient images?

Keep the originals and signed authorizations together in a system covered by a BAA, such as your EHR or a Google Workspace or Microsoft 365 account with the BAA accepted. Use file names without patient names, limit access to the marketing lead, and track when each authorization expires or is revoked. Have your compliance officer or attorney approve the process.