Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Can Healthcare Staff Use Gemini in Chrome on Patient Portals?
No, not on a screen that shows a patient record: the confirmation Google documents is written for a purchase or a send, not a patient chart, and the help page describes no business associate agreement. Staff can use it on portal tasks that carry no patient identifiers, and the check is what the model receives from the rendered screen.
A clinic's front desk opens a portal tab to see what a family still owes after insurance and asks Gemini in Chrome to read the balance and draft the reminder. The tab draws a name, a date of birth, a balance and an account number. Google documents a browser agent that completes multi-step tasks in the tabs a user is signed into (Google, Auto browse, 2026). Its examples are travel and shopping tasks, not clinical work, and the page calls the capability experimental. The checkpoint Google describes is narrower than a clinic's: the enterprise announcement says auto browse is designed to ask before a purchase or a send, a question at the keyboard rather than a block on what a page displays (Google, New ways, 2026). The same help page describes no business associate agreement, the written arrangement a practice needs before a vendor handles patient data on its behalf. That leaves a workable line for staff: the browser can help with portal work that carries no patient identifiers, and it cannot be the tool that reads a patient record.
Key findings
- For Gemini in Chrome to be usable on a patient balance screen, the name, the date of birth and the account number would have to be replaced with consistent tokens such as PATIENT_014 before any model reads the rendered page, with the real values resolving only at the destination the practice approved (How to Protect Data Before ChatGPT, Claude or Gemini Sees It).
- It would also require a named person approving each submission and record change, and a record that attributes the action to that person or to the agent (What Is Supervised Delegation?).
- The pages reviewed describe a confirmation before a purchase or a send and a browser agent that reads the tabs a user is signed into; they do not describe a business associate agreement for the feature (Google, Auto browse, 2026).
- Google's administrator page states that "Auto browse is currently off by default for managed users and can be enabled using the GeminiActOnWebSettings policy," and that the agent "can use the context of the currently viewed webpage (with user permission)," so a clinic's exposure starts with a policy it may not have set (Google, Chrome Enterprise, 2026).
- An adaptive-attack study bypassed 12 published defenses against jailbreaks and prompt injections with an "attack success rate above 90% for most" (Nasr et al., 2025).
What does Gemini in Chrome receive on a patient portal screen?
The record is the balance screen a front desk opens from the EHR before a call: the patient's name, date of birth, the balance after insurance, an account number and a plan note. Google's help page says the agent "has access to the same sites that you do, including sites you're signed into" (Google, Auto browse, 2026). The unit the model receives is the page, not the balance field the clerk asked about. A task that needs one number still hands over the page that holds it.
The help page warns that Gemini "may share your information with that site," and it makes the user responsible for what the agent does during a task (Google, Auto browse, 2026). The warning addresses where information goes after the agent has it, not which fields the page shows.
Anthropic's page for Claude in Chrome documents the same shape more plainly, saying the extension "takes screenshots of your active browser tab," a capture of the whole tab rather than a selected field (What Can Claude in Chrome Access in Your Browser?). The exposure is the same: what the page renders is what the model can receive. A portal page that shows open appointment times and no patient name puts nothing identifying in front of the model; a page that shows a balance and the patient it belongs to puts both there.
What does the confirmation cover, and what record is left?
The enterprise announcement says auto browse is designed to "pause and explicitly ask for your confirmation" before a purchase or a send (Google, New ways, 2026). That is the vendor's clearest checkpoint, and it is a question put to the person at the keyboard. A confirmation can be declined, which stops the action; when it is accepted, the page is read with the same values on it.
On a portal submission the same staff member asks and confirms. The help page makes the user responsible for the agent's mistakes and purchases (Google, Auto browse, 2026), and the recorded facts do not describe the confirmation being written outside the browser tab or exported to a security team's monitoring. A practice that has to answer a patient or an auditor needs a record of what the model received, what action followed and who approved it.
Shi and colleagues describe "a suite of adaptive attack techniques to run continuously against past, current, and future versions of Gemini" (Shi et al., 2025), and a second study bypassed 12 published defenses with an "attack success rate above 90% for most" (Nasr et al., 2025). A design study sets the goal that "the untrusted data retrieved by the LLM can never impact the program flow" (Debenedetti et al., 2025).
Chrome Enterprise Premium lets administrators "warn, block or monitor sensitive data actions within Generative AI websites," each an action the person takes, and monitoring an action does not say which values the model read before it acted (RedactSure vs Chrome Enterprise Premium: 2026 Comparison & Alternative). The control class is described in (What Is an AI Control Record?): a named person approves each submission, and every screen, action and approval lands in an exported record.
What do the vendors themselves say?
Google's help page describes a browser agent that completes multi-step tasks in the tabs a user is signed into, limits eligibility to a personal Google Account on a paid plan, calls the capability experimental, assigns responsibility for mistakes and purchases to the user, and warns that Gemini may share information with the site (Google, Auto browse, 2026). Those terms describe where the agent may go and who answers for it, not which values on a permitted page the model reads.
The administrator page adds the managed-account setting a clinic's IT team will meet first: "Auto browse is currently off by default for managed users and can be enabled using the GeminiActOnWebSettings policy," and the agent "can use the context of the currently viewed webpage (with user permission)" (Google, Chrome Enterprise, 2026). The policy controls which destinations the browser may reach by URL, not what the model receives from the content of a page it may read.
| Dimension | Google, per its documentation | What a healthcare team should verify |
|---|---|---|
| What the model receives | Context of the page in view with permission; access to the same signed-in sites as the user | Which fields on a permitted portal page reach the model |
| Default on managed accounts | Auto browse off by default; enabled by the GeminiActOnWebSettings policy | Whether the policy is on in this tenant, and who can turn it on |
| Consequential actions | Confirmation before a purchase or a send | Whether a portal submission counts as a send, and who confirms |
| Inbound content | External image URLs and suspicious links redacted in one defense layer (Google, Workspace, 2026) | What the filter covers, and what it leaves on the page |
| Record and agreement | Neither an exported record of screens received nor a business associate agreement is described | What can be shown to an auditor, and what contract covers the data |
Does a business associate agreement cover what the browser agent reads?
HHS guidance defines the arrangement a practice needs: a covered entity may disclose protected health information to a business associate if it obtains "satisfactory assurances, in the form of a contract or other written arrangement," and it limits the conduit exception to entities that "only provide transmission services for PHI" (HHS, Business Associates, 2026). A browser agent that reads a page and uses its content to answer a question is not transmitting a message between two parties.
Records from the HHS breach portal put the exposure above half in 2025 and 2026: 56.3% of the people affected by large healthcare breaches, 123.9 million of 220.0 million, were exposed in breaches that came through an outside vendor, a business associate under HIPAA (How Many Healthcare Breach Victims Were Exposed Through a Vendor?).
No Google page reviewed describes a business associate agreement for auto browse, and the help page's eligibility list requires a personal Google Account and excludes school accounts (Google, Auto browse, 2026). A practice cannot treat the feature as covered on the strength of the vendor's pages. The absence is not a finding that the feature cannot be covered; it is a gap to close in writing.
The de-identification guidance does not close it either. HHS describes "two methods that can be used to satisfy the Privacy Rule's de-identification standard," Expert Determination and Safe Harbor, and warns that both "yield de-identified data that retains some risk of identification" (HHS, De-identification, 2026). A token such as PATIENT_014 on a rendered screen is neither method. The contract question belongs to counsel (Does an AI Model Vendor Need a BAA for Patient Records?).
What does a governed environment change?
A governed environment is a control class that acts where a screen is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so a patient appears as PATIENT_014 and an account as ACCT_003 on every page. Real values resolve only at an approved destination, at the moment of an approved action. A named person approves each submission and record change, and every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.
Applied to the balance screen, the model reads PATIENT_014, DOB_002 and ACCT_003 while the front desk sees the name and the balance it needs. The portal note that follows carries the tokens, and the real values appear at the submission the practice manager approves.
Its scope is the rendered page. It does not govern a spreadsheet a staff member exports, a message sent from a phone, or a file read outside the browser. The comparison with the browser agent sets the two designs side by side (RedactSure vs Gemini in Chrome: 2026 Comparison & Alternative), and the difference between a prompt at the keyboard and a substitution before the model reads is the difference between asking about an action and deciding what the model can see.
What the record shows
No, not on a screen that shows a patient record: what decides the answer is what the model receives on the rendered screen, who approves the action, and what record remains. Google documents an agent that reads the tabs a user is signed into and the context of the page in view, a confirmation before a purchase or a send, and a managed-account default that keeps auto browse off until a policy enables it. It describes no business associate agreement for the feature. For a practice, that makes the browser usable for portal work that carries no patient identifiers and unusable as the tool that reads a patient record. A team can test its own exposure by opening one balance screen in the profile staff use, asking for the balance and nothing else, and writing down every value the page shows beside the values the task needed; the difference between the two lists is what the model can read.
Methodology and limitations
This page rests on Google's documentation, HHS guidance on business associates and de-identification, and three preprints on adaptive attacks and prompt-injection design. Public documentation read in full gives a sound view of where each product applies its control. Vendor pages were read between October 22, 2026 and October 23, 2026, and each Sources line carries the date for its page.
The products on this page are described from documentation and none was tested for this page; "not described" means the pages reviewed, vendor features change, and the page carries its date. Google's pages and RedactSure's design are both described from documentation, and neither was tested for this page. RedactSure is deploying now with enterprise and government customers. The balance screen example describes a record type, not an organization. Determinations belong to counsel, assessors and the organization's own security and compliance officers, and nothing here replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
Can healthcare staff use Gemini in Chrome on patient portals?
No, not on a screen that shows a patient record. Google documents a confirmation before a purchase or a send and a browser agent with access to the tabs a user is signed into, so a permitted portal page reaches the model with the name, date of birth and account number the page draws. The confirmation gates the action, not the reading. Staff can use it on portal work that carries no patient identifiers.
What does the model receive from a patient balance screen?
The page as it renders. Google's administrator page says the agent can use the context of the currently viewed webpage with permission, and the help page says it has access to the same sites the user is signed into (Google, Chrome Enterprise, 2026). On a balance screen that means the patient's name, date of birth, balance and account number, rather than only the field the clerk asked about. The model receives the page, and the page is wider than the question.
Does the confirmation change what the model reads?
No. The enterprise announcement says auto browse asks before a purchase or a send, which is a question at the keyboard (Google, New ways, 2026). Google's Workspace guidance adds a layer that redacts external image URLs and suspicious links, a filter on inbound content. Neither replaces the values on a page the agent may read, so the confirmation changes the action and leaves the reading.
Who approves a submission the agent makes?
The staff member who asked. Google's help page makes the user responsible for the agent's actions, including mistakes and unexpected results like purchases, and the confirmation is shown to that person. The practice has no second name on the decision unless it supplies one. An employer that needs its own approver should name that person before the agent reaches a portal that changes a balance or sends a message.
What record is left of the agent's work?
Not from the pages reviewed. Google describes a confirmation at the keyboard and does not describe that confirmation being recorded outside the tab or exported to a security team's monitoring. A practice that must answer a patient needs a record of what the model received and who approved it. Without it, the browser history shows a session, not a record of what the model read.
Is there a business associate agreement for Gemini in Chrome?
None that the pages reviewed describe. The help page's eligibility list requires a personal Google Account and excludes school accounts, and no Google page reviewed describes a business associate agreement for auto browse. HHS guidance requires satisfactory assurances in a written arrangement before protected health information goes to a business associate. Ask Google in writing before the pilot; counsel decides the contract.
How RedactSure Keeps a Patient Balance Out of the Browser Agent
A confirmation at the keyboard decides whether the browser may act, and it leaves every value on the portal page in front of the model.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the balance screen rendered the patient's name, date of birth and account number, and the browser agent read the page as the staff member saw it. Inside the governed environment: the screen renders PATIENT_014, DOB_002 and ACCT_003, a practice manager approves the submission by name, and the real values resolve only at the approved destination.
RedactSure is deploying now with enterprise and government customers. Google's help page assigns the user responsibility for the agent's mistakes and purchases.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A clinic that cannot name which fields reached the model on a balance screen cannot answer a privacy review. Bring one billing question from your own portal and see, with test values, where the record becomes tokens and who approves the release. Book a demo