Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Is Claude in Chrome Safe for Healthcare Staff?
No, not on work accounts whose pages show patient balances, because Anthropic's safety page says whatever is visible in the active tab becomes part of the conversation and recommends a profile without banking or health accounts. The answer changes only with tokens on the rendered screen, a named approver and a record.
A practice manager with a full waiting room opens the patient balance screen for the next appointment and asks Claude in Chrome to read what the family still owes after insurance, then to draft the note that goes to the portal. The tab renders a name, a date of birth, a balance, an account number and a plan note. Anthropic's help center tells users to keep the extension away from accounts like that: its recommendations name banking, healthcare and government among what a separate browser profile should not be able to reach. That answers part of the clinic's question: it says which accounts the browser should not hold. It does not change what the model reads from a page the browser is allowed to open, and the balance screen is such a page. The clerk, the biller and the front desk want the same three clicks, and none of those tasks needs the whole screen. The model receives the tab, not the field. That gap is what a privacy review asks about, and no browser profile settles it, because the same balance screen opens inside the clean profile with the same identifier on it.
Key findings
- For Claude in Chrome to be safe on a patient balance screen, the name, the date of birth and the account number would have to be replaced with consistent tokens such as ACCT_001 before the model reads it, with the real values resolving only at the destination the practice approved (What Is Render-Layer Tokenization?).
- It would also take a named person approving each balance adjustment and each record change, and a record that attributes the action to that person or to the extension (AWS, 2026).
- The vendor's safety page documents site blocking, permission prompts and password-manager fills, and does not describe replacing the values on a page before the model reads it (Anthropic, 2026).
- Anthropic's recommendations name banking, healthcare and government accounts among what a separate profile should keep out of reach, advice about which tabs exist (Anthropic, 2026).
- Web agents built on GPT-4, Llama-3 and Claude "are prone to inadvertent use of unnecessary sensitive information," the AgentDAM benchmark found, so a task can put identifiers in front of a model that never needed them (Zharmagambetov et al., 2025).
- An adaptive-attack study bypassed 12 published defenses against jailbreaks and prompt injections, with an "attack success rate above 90% for most" (Nasr et al., 2025).
What does Claude in Chrome receive from a patient balance screen?
The record is the screen the practice manager opens: the patient's name, date of birth, the balance after insurance, an account number and a plan note. Anthropic's page is direct: "Claude takes screenshots of your active browser tab to understand webpage content," and "whatever is visible in one of those tabs is captured in the screenshots and becomes part of the conversation" (Anthropic, 2026). The model receives a picture of the tab, not the balance field (What Can Claude in Chrome Access in Your Browser?).
The staff member asks for the balance and a draft note, and the extension decides which parts of the page it needs. A definition that fits the task describes agentic AI as systems "capable of pursuing goals autonomously by making decisions, taking actions, and adapting to dynamic environments without constant human oversight" (MIT Sloan Management Review, 2025). A model reading a balance screen to answer a billing question can take the date of birth beside the account number.
The exposure is the gap: the task needed the balance, and the context holds the name, the date of birth and the account number for the session. Nothing on the page replaces those values before the screenshot leaves the browser. The answer changes on the screen, where tokens stand in before the model reads it and a named person approves the adjustment.
Does a separate browser profile change what the model reads?
Anthropic recommends a separate browser profile, and its recommendations name banking, healthcare and government as accounts the profile should not be able to reach (Anthropic, 2026). For a clinic, the useful part is the naming: it keeps the extension out of the browser that holds the health accounts, a real reduction in what a screenshot can reach. The profile is the vendor's answer to the risk the page describes.
It does not change what a permitted page shows. A biller who runs the extension in a clean profile still opens the patient balance screen there, and the screen renders the name, the date of birth and the account number the way it did in the everyday profile. A profile changes which accounts the browser holds, not what a permitted page renders. The extension acts on behalf of the staff member, and nothing in the profile advice rewrites a page before the model reads it.
Columbia's DAPLab states the point: "Agents turn every layer of the stack into a semantic quality problem," and "trustworthy agent automation cannot be solved at a single layer of the stack" (Columbia, 2026). A profile is one layer, and the layer that matters is where the page is rendered. The blocked-site list is a second layer, and it governs where the extension goes; the rendered page still reaches the model as it is.
What do the vendors themselves say?
Anthropic documents where its controls act, and each sits before a page opens or after an action is proposed. The page states that the model receives screenshots of the active tab, that "Claude cannot access sensitive, high-risk sites", and that it "asks for permission before accessing financial sites"; it adds that "1Password fills the login directly" and that passwords and one-time codes never enter Claude's context, and it lists "action confirmations for certain high-risk actions such as downloading a file or entering sensitive information" (Anthropic, 2026). Of the 16 AI agent products reviewed, Claude in Chrome is the only one that publishes a prompt injection rate, measured on Anthropic's own tests, and Anthropic says the risk is not zero (How Often Do AI Agents Follow Injected Instructions?).
| Dimension | Anthropic, per its documentation | What a healthcare team should verify |
|---|---|---|
| What the model receives | Screenshots of the active tab; whatever is visible is captured | Which fields on a permitted balance screen reach the model |
| Where the extension may go | Sensitive sites blocked; permission asked before financial sites | Whether the practice portal sits on a list, and who maintains it |
| Consequential actions | Action confirmations for certain high-risk actions | Who other than the staff member can see the confirmation |
| Record | No exported record of the screens received is described | What an auditor can be shown for one visit |
Coder's documentation for running agents says: "Be sure not to give agents full permissions on behalf of a user, and instead use separate identities with limited scope whenever interacting autonomously" (Coder, 2026). That guidance covers scope and identity, and neither page describes replacing the values on a rendered page before the model reads it.
Who approves an action on a patient account, and what record remains?
The approval the vendor documents is a confirmation shown to the person who asked. The page lists action confirmations for certain high-risk actions and leaves the decision with the person at the keyboard (Anthropic, 2026). On a balance adjustment the same person asks for the action and approves it, so the practice has no second name on the decision. That protects the staff member, not the practice. The user who asked is the only approver the pages describe.
The record is thinner. The safety page describes what the person sees and confirms; it does not describe an exported record of the screens the model received that a practice could hand to an auditor (Anthropic, 2026). AWS's guidance says the separation should be visible: "audit logs attribute every action unambiguously to either an agent or a human actor" (AWS, 2026). The person who asked and the extension that acted are two actors on one account. A test on one workflow is described in (How Do You Test Whether an AI Agent Can Reach Data Outside Its Assigned Task?).
The control class answers both: a named person approves each adjustment and each record change, and the record exports to the practice's own logging with the action attributed to the person or the extension.
What should a clinic ask for in writing before it allows the extension?
Five answers, each in a form the vendor or the environment can put in writing.
Jim Sinkoff, Deputy CEO and CFO, Sun River Health, described how a health system approaches deployment: "we will continue to innovate, explore, and deploy AI tools as quickly and as fast as we can with this proviso" (Who Owns the Data When AI Touches Patient Records? A Health System CFO on AI Governance).
- What the model receives from each rendered screen on a permitted site, field by field.
- Which profile it runs in, who configures it, and which accounts are signed in. A clean profile that drifts back into everyday use has stopped being a control, and Coder's guidance points to "separate identities with limited scope" (Coder, 2026).
- Who approves a balance adjustment, and how that approver is authenticated. The New York State Department of Financial Services tells its covered entities to "consider using authentication factors that can withstand AI-manipulated deepfakes" (New York State Department of Financial Services, 2024).
- What record exists of one visit, screen by screen, and can the practice export it with each action attributed?
- What a successful injection collects when the classifier misses. Information-flow research warns that "poisoned data retrieved from one component can change the model's behavior and compromise the entire system" (Siddiqui et al., 2025).
A policy that applies to every AI tool is described in (How Do You Keep Data Access Policies Consistent Across AI Tools?), and the wall that keeps records out of every model's reach is described in (What Is the PII Wall?).
What does a governed environment change?
A governed environment changes the first answer, and the rest follow. The values a practice names, such as a patient's name, date of birth, account number and balance, are replaced with consistent tokens on the rendered page before any model reads the screen, so the same patient appears as PATIENT_014 on every page of a run. The real values resolve only at the approved destination at the moment of an approved action, so a value the model never held cannot be repeated in a draft message, a summary or an injected instruction. A named person approves each balance adjustment, submission and record change, and every screen, action and approval goes to a record the practice exports to its own logging.
Applied to the balance screen, the model reads PATIENT_014, DOB_002 and ACCT_003, the practice manager sees the real values, and the portal note carries the tokens until a named person approves the send. The comparison with the extension sets the two designs side by side (RedactSure vs Claude in Chrome: 2026 Comparison & Alternative), and the difference between hiding part of a value and replacing all of it is in (Runtime Tokenization vs Data Masking for AI Agents).
What the record shows
The three facts that decide the answer are what the model receives on the rendered screen, who approves the action, and what record remains. For Claude in Chrome the vendor's pages settle the first: the model receives a screenshot of the active tab, and the separate profile the vendor recommends names health accounts without changing what a permitted page shows. A clinic can run the test on one balance screen by opening it in the clean profile, asking for the balance and nothing else, and listing every value visible on the page beside the values the task needed; the difference is what the practice is exposed to. What changes the answer is a control at the render layer, where values become tokens before the model reads the page, a named approver on each adjustment, and a record of both.
Methodology and limitations
This page rests on vendor documentation (Anthropic's safety page and Coder's guidance for running agents), peer-reviewed and preprint research on agents, information flow and adaptive attacks, regulator guidance from the New York State Department of Financial Services, and analysis from Columbia's DAPLab and MIT Sloan Management Review, read in full. Public documentation read in full gives a sound view of where each product applies its control. Vendor pages were read between October 16, 2026 and October 20, 2026, and each Sources line carries the date for its page.
The products on this page are described from documentation and none was tested for this page; "not described" means the pages reviewed, vendor features change, and the page carries its date. RedactSure is deploying now with enterprise and government customers. The balance screen example describes a record type, not an organization. Determinations belong to counsel, assessors and the organization's own security and compliance officers, and nothing here replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
Is Claude in Chrome safe for healthcare staff?
No, not on a work account whose pages show patient balances or health records. The vendor's safety page says the model receives screenshots of the active tab and that whatever is visible becomes part of the conversation, and its recommendation is a separate profile that cannot reach banking or health accounts (Anthropic, 2026). That profile limits which tabs exist. It does not change what a permitted balance screen shows.
Does a separate browser profile make it safe for patient data?
Only for what it keeps out of reach. A clean profile keeps the practice's health accounts out of the browser the extension runs in, a real reduction in what a screenshot can carry. Inside that profile, a permitted portal still renders the patient's name, date of birth and account number in full, and the model receives the tab. A profile decides which accounts the browser opens; the page decides what the model reads.
What does the extension see on a patient balance screen?
The whole tab. The screenshots the vendor's page describes capture whatever is visible, so the patient's name, date of birth, balance and account number all reach the model in one image. The staff member asked for the balance alone, and the note the portal draws beside it arrives with the rest. A model that holds the whole image can repeat any part of it in the draft it writes.
Who approves an action on a patient account?
The person at the keyboard. The vendor documents "action confirmations for certain high-risk actions such as downloading a file or entering sensitive information" (Anthropic, 2026), and the user who asked for the action is the user who confirms it. That protects the staff member. It does not give the practice a second name on a balance adjustment, and an employer that wants its own approver must supply one.
What record does the clinic get of what the model read?
Not from the pages reviewed. The safety page describes confirmations and advice shown to the user; it does not describe an exported record of the screens the model received (Anthropic, 2026). A record that attributes every action to either an agent or a human actor is what a practice needs to answer a patient. Without it, the record shows who was signed in, not what the model read.
Can staff use it to book follow-ups from a de-identified screen?
Yes, when the screen carries no patient identifiers. A scheduling view that shows only appointment times and open slots does not put a name, a date of birth or an account number in front of the model, so the vendor's warnings about health accounts do not describe that task. The line is the practice's own: the moment the view adds a patient name or a record number, the screen is the kind the advice warns about. De-identification has to hold on the page the extension reads.
How RedactSure Keeps Patient Balances Off the Model's Screen
A separate profile decides which accounts the browser can reach and leaves every value on a permitted balance screen in the screenshot. Anthropic's own safety page says whatever is visible in a tab becomes part of the conversation.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the balance screen rendered the patient's name, date of birth and account number, and the screenshot of all of it entered the model's context. Inside the governed environment: the screen renders PATIENT_014, DOB_002 and ACCT_003 in their place, a practice manager approves the adjustment by name, and the real values resolve only at the approved destination.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A practice that cannot name which fields reached the model on a balance screen cannot answer a privacy review. Bring one patient balance screen and see, with test values, the page as the model receives it, the approval, the record. Book a demo