Is Canvas Medical AI HIPAA compliant?
Canvas Medical, Inc. signs a Business Associate Agreement with its customers, which HIPAA requires before a vendor handles patient data for you. Once it's signed, you can use Canvas Medical AI with patient data within the BAA's scope; whether your use is compliant still depends on your setup and your own policies. Canvas Medical, Inc. doesn't say whether the BAA covers its AI features.
Does Canvas Medical AI sign a BAA?
Yes, it signs a BAA
Canvas says customers may put PHI on its platform only after signing both a master subscription agreement and a BAA with Canvas. Its Hyperscribe AI copilot was built with tools from OpenAI, Google and Anthropic, and Canvas doesn't say publicly whether those providers are covered.
Not confirmed for the AI features: Canvas Medical, Inc. doesn’t say whether its BAA covers Hyperscribe (ambient clinical copilot); AI agents and SDK LLM integrations. Get that in writing before using them with patient data.
- Business associate
- Canvas Medical, Inc.
- Tool
- Canvas Medical AI
- Plans with a BAA
- Canvas Platform (Master Subscription Agreement)
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Canvas Platform (Master Subscription Agreement) | Signs a BAA | Through sales | Canvas's terms say the platform may hold PHI only once a fully executed Master Subscription Agreement and BAA with Canvas are in place. The Sandbox and website must never hold PHI. The BAA text is not public.[2] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Canvas Medical, Inc. says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Hyperscribe (ambient clinical copilot) | Not stated | Canvas says Hyperscribe was built with tools from OpenAI, Google and Anthropic and uses the full patient chart. It released the extension's code as open source. No page says whether the BAA covers Hyperscribe or whether the model providers are under BAAs.[3] |
| AI agents and SDK LLM integrations | Not stated | Canvas's SDK documentation describes LLM-based extensions such as an inline scribe. No page says how PHI sent to an LLM through these is covered.[4] |
Sources
- Our approach to security
- Terms of Use
- From Ambient Scribes to Multi-model AI Copilots: Announcing Hyperscribe
- Provider Companion
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.