Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Is Copilot Mode in Edge Safe for Healthcare Staff?
No, not on a patient record. Microsoft's list of uses to avoid names "medical records"; the pages reviewed describe no protected health information or business associate agreement; and a privacy officer should ask what the model reads on a patient screen before enabling it.
A billing coordinator wants Copilot Mode in Edge to help work the patient balance queue, and the feature arrives with a consumer subscription rather than a contract review. A patient balance screen in Epic is not one number. It renders a guarantor name, a date of birth, a medical record number, a date of service, an insurer, the charges and the last payment, and the agent that opens the screen to read the balance receives all of it.
Microsoft's own support page draws the line at that screen: its list of uses to avoid names "medical records" beside Social Security numbers and credit card details (Microsoft, Browse, 2026). The pages reviewed name no protected health information, no business associate agreement and no redaction control for a screen the agent has read.
The question a privacy officer can put in writing is narrower than whether the feature is useful. What does the model receive when the balance screen renders, who approves an action that changes the patient account, and what record of the run can the hospital hold? A covered entity that answers those three from documentation can decide whether Copilot Mode belongs in front of a patient account.
Key findings
- For Copilot Mode to be safe on a patient balance screen, the values on the page would have to be replaced with consistent tokens before the model reads it, with the real values resolving only at the approved destination (What Is Render-Layer Tokenization?).
- It would also require a named person approving each action that changes a patient account and a record of what the model received on that screen, and the vendor's pages describe neither (Can Staff Use AI on Patient Records Without PHI?).
- The page says where the actions run and which stored credentials are out of reach, and describes no control that withholds a permitted screen's values (Microsoft, Browse, 2026).
- The page defines the feature as one that "lets Copilot perform actions directly in your Microsoft Edge browser, such as clicking, typing, and navigating tabs", so a tool reading an amount owed also reads the guarantor and insurer beside it (Microsoft, Browse, 2026).
- An evaluation of web agents found them "prone to inadvertent use of unnecessary sensitive information", so a balance screen sends the insurer and guarantor details with the number (Zharmagambetov et al., 2025).
- Harvard's guidance says to "Require human approval for high-impact, sensitive, irreversible, or externally visible actions whenever feasible", which a click that posts a payment does not have (Harvard University, 2026).
What does Copilot Mode read on a patient balance screen?
Take one patient balance as the record. A coordinator opens the account in Epic to answer a question about what is owed, and the screen renders the guarantor name, date of birth, medical record number, insurer, charges, balance and last payment. The task needs the balance; the agent reads the screen.
A browser agent's prompt is built from the page (Can a Browser Agent Copy Customer Data From a Web App Into a Prompt?), and Sahib and Chaikin showed an attacker can "hide prompt injection instructions in images using a faint light blue text" that a screenshot-reading agent acts on (Sahib and Chaikin, 2025).
Sign-in widens the exposure. The support page says Copilot "cannot access autofill data, saved passwords, or wallet information", then that "Copilot can access cookies", so "if you're already signed into a site that Copilot has access to, it will also be signed in automatically" (Microsoft, Browse, 2026). The coordinator is signed into Epic because that is the job.
An evaluation of web agents found them "prone to inadvertent use of unnecessary sensitive information" (Zharmagambetov et al., 2025), and the Privacy Rule asks a covered entity to "make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request" (Cornell Law School, 2026).
So the answer is the whole screen, in the coordinator's session, images included.
What do the vendors themselves say?
The Browse with Copilot page names the data it does not want the feature used on. Its list of uses to avoid names "Personal identifiers (Social Security numbers, government IDs, medical records)" and "Financial activity (banking, stock trading, credit card details)", which is a patient balance on both counts (Microsoft, Browse, 2026).
Two warnings matter more in a clinical setting. The feature is "experimental and may misinterpret instructions, make mistakes, or be affected by malicious hidden instructions on web pages", and a hidden instruction can send the agent to "visit another site to collect sensitive information instead" (Microsoft, Browse, 2026). Microsoft's own assistant has already been the vector: Reddy and Gujral document CVE-2025-32711, where a zero-click message made the Microsoft 365 Copilot client fetch an external image the attacker supplied (Reddy and Gujral, 2025).
| Dimension | Microsoft, per its documentation | What a buyer should verify |
|---|---|---|
| Where the actions run | "All actions run locally in your browser" | Where the run happens, not what the model reads |
| What the model receives | No limit described; the caution list names medical records as a use to avoid | Whether any value is withheld from the model on a permitted screen |
| Sign-in | "Copilot can access cookies"; a signed-in site is signed in for Copilot | Which portals the session reaches |
| Availability | "Microsoft 365 Premium subscribers in the US" | Whether the hospital's plan and region are covered |
| Health data | No PHI term, no business associate agreement | The contractual basis for a patient account |
Browse with Copilot is rolling out "as a feature for Microsoft 365 Premium subscribers in the US", with additional markets to follow (Microsoft, Browse, 2026). A hospital that buys it has not signed a business associate agreement.
In 2025 and 2026, 123.9 million of the 220.0 million people affected by large healthcare breaches, 56.3%, were in breaches that came through a vendor, a business associate under HIPAA (How Many Healthcare Breach Victims Were Exposed Through a Vendor?).
McKinsey's State of AI research finds 62% of organizations at least experimenting with AI agents and 23% scaling them anywhere, as What Is the PII Wall? records.
Does the Edge for Business version change what Copilot reads on a patient screen?
The work page for Copilot in Edge is the one a hospital would rely on. It says responses draw on your prompt, conversation history and, "when allowed by your organization's settings, content from the current webpage" (Microsoft, Edge at work, 2026). The condition is a setting, not a rule about which values a page may show the model.
Consent works the same way. A dialog "asking whether Copilot can access page content" may appear, but "your admin might have explicitly enabled or disabled Copilot's access to page content" (Microsoft, Edge at work, 2026).
Where page content is used "in a work profile", it "may be stored and handled according to your organization's data protection policies" (Microsoft, Edge at work, 2026). Under Enterprise Data Protection, signed in "with a Microsoft Entra ID work account", "Prompts, responses, and files stay within your tenant and aren't used to train foundation models" (Microsoft, Edge at work, 2026). A tenant boundary governs where data is stored and whether it trains a model, not what the model received.
Browse with Copilot is "currently available in a limited preview" for "enterprise tenants who have opted in" (Microsoft, Edge at work, 2026). The page does not mention Social Security numbers, identity documents or redaction (Microsoft, Edge at work, 2026), and Microsoft's Purview control makes the same division: it restricts "users from pasting sensitive content into browser-based applications", a rule about what a person may paste rather than what a model reads (Why Does Microsoft Purview Block a Paste Into the Browser, and What Keeps the Work Moving?).
Who approves an action on a patient account?
The consent dialog grants page access, and an administrator setting enables the feature for a group; neither decides a specific action on a patient account. The agent clicks and types, and the coordinator who asked for the task is the only person in the loop.
Harvard's guidance tells teams to "Require human approval for high-impact, sensitive, irreversible, or externally visible actions whenever feasible" (Harvard University, 2026). Posting a patient payment, changing a guarantor or moving an account to collections is each of those things, and a click by an agent acting as a signed-in coordinator is not that approval.
Microsoft draws the action limit in the same place in its Copilot Studio documentation: the allow list "only prevents the model from taking actions on websites or applications that aren't in the allow list. It doesn't stop the model from opening them" (Does Copilot Studio Limit What Its Agent Sees?).
OWASP's entry for sensitive information disclosure states that "Personal identifiable information (PII) may be disclosed during interactions with the LLM" (OWASP, 2025), and a patient balance is PII that is also protected health information.
So the question to put in writing is who approves a payment posting or a record change, and where that approval is recorded.
What does a governed environment change?
A governed environment is a control class that acts where a screen is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so a balance screen renders PAT_001 and ACCT_001 where the name and the account number sit. The real values resolve only at an approved destination, at the moment of an approved action. A named person confirms the policy and approves each consequential action, and every screen the model was shown, every action and every approval land in a record the organization can export.
For a patient balance, that changes three things. The read is bounded: the model works on tokens, so a diagnosis code the task did not need is not in its context to repeat later. The approval is personal: a payment posting waits for a named person, not a coordinator's click. The record is auditable: the hospital can show what the model received, not only what it did.
Its scope is the rendered page. A governed browser environment covers what an agent reads and does on a page such as a patient account, and does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP.
Compare the two side by side (RedactSure vs Microsoft Edge Copilot Mode: 2026 Comparison & Alternative), and the question is what the model receives from the rendered screen and who is accountable for the action that follows.
What the record shows
The control that answers this question sits before the model: values replaced on the rendered screen, a named person approving the action, and a record of what the model received. By that standard Copilot Mode is not a system a covered entity can put in front of a patient balance as the pages reviewed describe it. Its caution list names medical records, its work page defers storage to organization policy without naming PHI, and neither page describes an approver or a per-screen record. The browser is still useful; the terms of use are specific, a consumer subscription for one feature and an opt-in preview for the other. A privacy officer can settle it in an afternoon: open one test patient balance, ask for the amount owed, and list every field on the screen beside the fields the task needed.
Methodology and limitations
This page rests on Microsoft's support pages for Browse with Copilot and Copilot in Edge at work, vendor research from Brave, two peer-reviewed papers, guidance from Harvard and OWASP, and the Privacy Rule text at 45 CFR 164.502. Public documentation read in full gives a sound view of where each product applies its control. Vendor pages were read between October 16, 2026 and October 23, 2026, and each Sources line carries the date for its page.
No product on this page was tested for this page, and "not described" means the pages reviewed. Vendor features change and the page carries its date, so a release after it is unreviewed until the check above is repeated. RedactSure is deploying now with enterprise and government customers, and the documentation limits here apply to its pages as they do to any vendor's. The example describes a record type, not an organization. Determinations about whether a workflow meets the Privacy Rule belong to counsel, assessors and the organization's own security and compliance officers, and nothing here replaces a pilot of one workflow.
Frequently asked questions
Is Copilot Mode in Edge safe for healthcare staff?
No, not on a patient record. Microsoft's support page lists "medical records" among the personal identifiers to avoid, and the work page defers storage to organization policy without naming protected health information or a business associate agreement. On a scheduling screen that shows no patient data the feature is a convenience. Treat a patient account as out of scope until a control replaces the values before the model reads them.
What does Copilot Mode read on a patient balance screen?
Whatever the screen renders. An agent that clicks and types on a page reads that page, so a balance screen supplies the guarantor name, date of birth, medical record number, date of service, insurer and balance along with the one number the task needed. The support page describes no field-level limit on that read, and the session behind it is the coordinator's own. List the fields on screen before deciding what the task requires.
Can Copilot Mode read a portal I am already signed in to?
Yes, through cookies. Microsoft says Copilot "cannot access autofill data, saved passwords, or wallet information" but that "Copilot can access cookies", so a site the coordinator is signed into is a site the agent is signed into as well. A patient portal that trusts the browser session therefore trusts the agent inside it. Sign out of the portals the task does not need, and treat the rest as pages the model will read.
Does the Edge for Business version keep what Copilot reads in the tenant?
Partly. Under Enterprise Data Protection with a work account, Microsoft says "Prompts, responses, and files stay within your tenant and aren't used to train foundation models", and content used in a work profile "may be stored and handled according to your organization's data protection policies". That governs storage and training. It does not describe what the model receives from a permitted patient screen, and the page names no health-data handling.
Who approves what Copilot Mode does on a patient account?
No named person, from the pages reviewed. A consent dialog may ask whether Copilot can access page content, and an administrator can enable or disable that access, but neither approves a specific action such as posting a payment or changing a guarantor. The coordinator who asked for the task is the only human in the loop, and the agent acts as that person. Ask for an approver outside the model, by name.
What record should a privacy officer ask for?
One record per run showing what the model received on each screen, which actions it took, and who approved them. The consumer page describes a local run and a caution list, and the work page describes tenant storage and training limits; neither describes a per-screen record an employer can export. Ask for that record before a pilot, then compare it with the screens the agent opened.
How RedactSure Keeps a Patient Balance Off the Model's Screen
The controls reviewed here govern where an agent clicks or what an administrator enables, and neither withholds a patient balance from the model that reads it. Microsoft's own page lists "medical records" among the uses to avoid (Microsoft, Browse, 2026).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, Copilot opened the coordinator's Epic session and the model received the guarantor name, date of birth, medical record number and balance, any of which could travel into a summary or the next page. Inside the governed environment the same screen renders PAT_001 and ACCT_001, the real balance resolves only at the payment destination a named person approved, and that approval carries the person's name into the record.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A patient balance that never reaches the model cannot be repeated in a summary or sent on to the next page. Bring one billing task and see, with test values, what the model reads and who approves the posting. Book a demo