Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Is Prisma Browser Enough for AI Agents in Healthcare?
No, not on screens that carry patient data, because Prisma Browser's documented controls act on the prompt a person submits and on what a person types, and neither covers a patient balance an agent reads off the rendered page. Ask what the model received on the screen before an agent works a patient account.
A hospital's billing staff work from a patient balance screen that holds a name, a date of birth, a medical record number, an insurer, a claim number, a date of service and a balance. A person opens it to answer a question about money, and the identifiers are incidental to that work. A browser agent asked to confirm the balance or post a payment reads the whole page, and every identifier travels with it into the model's context. That is the line the browser's data controls stop at, because they were built around what a person does with a record rather than what a machine takes from the screen.
Prisma Browser is a managed browser with documented control over the prompts people send to AI applications and over the text people type into form fields. Both address a real exposure on a clinical workstation, and both presume a person at the keyboard. When the reader is an agent, nobody composes the prompt and nobody types the date of birth, yet the page still renders in full. The answer a healthcare team needs therefore has two halves, and only one of them is about the browser's settings.
Key findings
- For Prisma Browser to be enough for an agent working a patient account, the values on the balance screen would have to be replaced with consistent tokens before the model reads it, so the date of birth and the record's identifiers arrive as placeholders such as PATIENT_001 and DOB_001 (What Is Render-Layer Tokenization?).
- It would also require a named person approving each payment, adjustment or record change the agent proposes, and a record of what the model received and who approved it (What Is Supervised Delegation?).
- Prisma Browser's pages reviewed do not state that a value a billing portal draws is replaced before an agent's model reads it; they describe prompt inspection and manual-input scanning inside a browser the organization manages (Palo Alto Networks, GenAI Prompt, 2026).
- Palo Alto Networks states that "The browser can automatically redact sensitive data in prompts before they leave the enterprise environment," a control on the prompt a person sends (Palo Alto Networks, Prisma Browser, 2026).
- Typing Guard is described as a control that "Scans manual input made by users in real-time within the browser" (Palo Alto Networks, Typing Guard, 2026).
- Web agents in a measured evaluation "are prone to inadvertent use of unnecessary sensitive information," and the minimum necessary standard directs a covered entity to "limit protected health information to the minimum necessary" (Zharmagambetov et al., 2025; Cornell Law School, 2026).
What does Prisma Browser control on a patient balance screen?
A patient balance screen in a billing application shows the patient's name, date of birth, medical record number, insurer and claim number, the date of service, the charge, the insurance payment, the patient payment and the balance. A revenue cycle specialist reads it to answer one question about money. The identifiers are on the page because the record needs them, not because the task needs them, and that gap between what the screen shows and what the work requires is where this question lives.
Palo Alto Networks documents two data controls for that screen, and both act on a person's input. The GenAI Prompt control inspects prompts submitted to AI applications and blocks "only prompts that contain PII, PHI, or proprietary content," and the vendor lists "standalone applications such as ChatGPT, Microsoft Copilot, Gemini, Claude, and Perplexity" as its coverage (Palo Alto Networks, GenAI Prompt, 2026). Typing Guard scans what a person types and sanitizes it, with the vendor limiting it to basic HTML form fields (Palo Alto Networks, Typing Guard, 2026). The product page adds that the browser "can automatically redact sensitive data in prompts before they leave the enterprise environment" (Palo Alto Networks, Prisma Browser, 2026).
| What the browser holds | What the pages describe | What it means for an agent on a balance |
|---|---|---|
| A prompt a person sends to an AI application | Inspection and blocking of prompts that contain PHI, applied when the rule's action is Block | Covers a person pasting a balance into a chat window |
| Text a person types into a form | Real-time scanning of manual input, basic HTML fields only | Covers a clerk typing a date of birth, not a page a model reads |
| The page an agent opens | "full visibility and last-mile data protection" over web and SaaS applications | The model receives the values the page draws |
| A copy, upload or download | Clipboard and file controls for the person at the keyboard (Is Prisma Browser Enough to Protect Data From AI Agents?) | Reading is not an action those controls intercept |
Read the middle column down and the pattern holds in every row: the control fires when a person does something.
What does the model receive when an agent reads a patient balance screen?
Everything the page draws. A computer-use agent opens a billing application the way a person would and reads what is on the page, as text, as a document structure or as a screenshot, depending on the harness. The name, the date of birth, the medical record number and the balance are not decoration; they are the fields the agent reads to find the account and confirm the amount. What the agent reads is the same page the specialist sees, so the identifiers a specialist ignores are the ones the model receives.
Rishov Chatterjee, an AI engineer at Curology and former Director of Data Science and AI at Integra Connect, said on a HAL podcast that the record carries more than the text an EHR supplies: "So we have to go beyond just that typical scope with text, right? Which is what we usually get from these EHRs." (HAL Transcript: Rishov Chatterjee).
The recorded position on enterprise browsers is direct: when AI is invoked inside any enterprise browser, the model receives the raw page, because reading is not a paste, an upload or a download (What Are Alternatives to Prisma Browser and Island?). The minimum necessary standard directs a covered entity to "make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose" (Cornell Law School, 2026). The standard names no AI system and no screen, and whether a control satisfies it is a determination for counsel and assessors. Read against it, a page that renders a full balance for a task that needs the balance alone shows more than the task needs, and the model that receives that page holds the excess.
What do the vendors themselves say?
Palo Alto Networks describes Prisma Browser as "an enterprise browser natively integrated with Palo Alto Networks security engines," and says it "isolates corporate work from the underlying untrusted endpoint" (Palo Alto Networks, Prisma Browser, 2026). The data controls named on the administration pages are the GenAI Prompt control and Typing Guard. The first "enforces at multiple layers on the browser side" and blocks prompts that carry PHI; the second scans manual input in real time and sanitizes it.
The coverage list on the GenAI Prompt page is a limit in itself: the control applies to "standalone applications such as ChatGPT, Microsoft Copilot, Gemini, Claude, and Perplexity," which are chat and assistant products rather than the billing application an organization runs. A browser agent working a patient account is not on that list. The same material records another boundary: "GenAI prompt collection does not work with Safari" (Palo Alto Networks, GenAI Prompt, 2026).
The pattern is a control set built for the person at the keyboard, and the vendor's own pages show where it stops. Substituting a value on the rendered page, approving the agent's action and recording what the model received are not described in the pages reviewed. Neither administration page names a person accountable for what an agent does with the record it read.
Is prompt-level redaction enough for an agent working a patient account?
No, because prompt redaction and page reading are different paths. The agent working a patient account composes no prompt about the patient: it opens the billing application, reads the account and acts. The PHI arrives through the page, so a control that inspects prompts has nothing to inspect at the moment the model learns the date of birth.
Prompt control does cover the staff side. A specialist who pastes a patient's balance into a chat window to draft a letter sends PHI out of the browser, and a rule that blocks that prompt, or redacts the values before it leaves, addresses a real leak (Palo Alto Networks, Prisma Browser, 2026). A clerk typing a date of birth into a basic HTML field is the other case, and Typing Guard sanitizes it (Palo Alto Networks, Typing Guard, 2026). Those are staff exposures, and the browser is a sensible place to govern them.
The healthcare question is narrower. De-identification is a defined standard with two methods, Expert Determination and Safe Harbor (HHS Office for Civil Rights, 2012), and neither runs inside a browser as a page renders. A token on the screen is not a de-identified record; it is a value replaced for the model's benefit while the real value stays available at the destination a person approves.
A guardrail inspects the input and the output rather than the page (What Are AI Agent Guardrails?), and the wall a healthcare program meets when a workflow runs on records the team will not show a model leaves one place to act: the screen, before the model reads it (What Is the PII Wall?).
What should a healthcare team ask a vendor in writing?
Four answers decide whether a browser is enough. First, ask what the model receives from a rendered screen when an agent opens a billing page: not what the browser blocks, but what the model holds after the page draws. Second, ask who approves a payment, an adjustment or a record change the agent proposes, by name and role. Third, ask what record exists of the screen as the model saw it and of the approval. Fourth, ask which of the two control paths covers an agent that reads rather than submits.
FINRA's 2026 oversight report flags that "AI agents acting autonomously without human validation and approval" and that "Complicated, multi-step agent reasoning tasks can make outcomes difficult to trace or explain, complicating auditability" (FINRA, 2025). The report concerns financial services and names no healthcare product, and the point transfers to any agent that changes a record.
The infrastructure research makes the same request in design terms: the functions of agent infrastructure include "attributing actions, properties, and other information to specific agents" (Chan et al., 2025). Put that on the list as a yes or no question: can the vendor show, for one balance task, which agent read which screen and which person approved the payment that followed.
A position paper argues that "fully autonomous AI agents should not be developed" (Mitchell et al., 2025). A healthcare team need not adopt it to take the practical consequence: the approver is part of the design, not a setting to add later.
What does a governed environment change?
A governed environment is a control class that acts where a screen is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so a patient balance screen draws PATIENT_001 and DOB_001 in place of the identifiers. For each task the planner proposes what to tokenize, starting from personal information, account numbers, credentials and record numbers. Real values resolve only at an approved destination, at the moment of an approved action. A named person confirms which values are replaced and approves each consequential action, a payment or a record change among them, and every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.
For a healthcare team the change is in what the model can give up. An agent that read tokens can be injected, misdirected or simply careless and still have nothing real to repeat, and the balance it posts resolves at the destination the approver named.
The control covers what the agent reads and does on a rendered page in applications the organization already runs. It does not cover the terminal, a script that calls an API directly, or a file the agent opens outside the browser.
A comparison of the two designs on the same record, RedactSure vs Prisma Browser: 2026 Comparison & Alternative, sets the enterprise browser's act governance beside the render-layer control.
What the record shows
The browser's data controls leave one thing open for a hospital: what a model receives from a rendered screen. The browser governs the prompt a person sends and the text a person types, and those are real exposures on a clinical workstation; the patient balance an agent reads sits on the page, which neither control inspects. A governed environment answers the same question at the render: tokens for the identifiers and the amount before the model reads them, real values only at the destination a named person approved, and a record of both. A healthcare security lead should settle it with one balance task on a test patient: run the agent, read the transcript for the date of birth and the balance, and compare that with what the page drew.
Methodology and limitations
This page rests on the Prisma Browser product page and two administration pages, for the GenAI Prompt control and Typing Guard, three research preprints and a position paper, HHS de-identification guidance, the text of 45 CFR 164.502 as republished by the Legal Information Institute, and FINRA's 2026 oversight report. Public documentation read in full gives a sound view of where each product applies its control. Vendor pages were read between October 22, 2026 and October 23, 2026, and each Sources line carries the date for its page.
The products on this page are described from documentation, and none was tested for this page. "Not described" means the pages reviewed, not a claim about what a product does outside them. Vendor features change and the page carries its date. RedactSure is deploying now with enterprise and government customers. The example describes a record type, a patient balance screen in a billing application, and not an organization. Determinations about whether a workflow meets a regulatory requirement belong to counsel, assessors and the organization's own security and compliance officers.
Frequently asked questions
Is Prisma Browser enough for AI agents in healthcare?
No, not for an agent that works a patient account. Its documented controls inspect the prompt a person submits to an AI application and the manual input a person types, and neither touches what a model takes from a rendered page. For staff-facing work the browser earns its place: it keeps corporate work off an untrusted endpoint and blocks a prompt that carries PHI. The agent-read screen needs a control at the render.
What does the model receive when an agent reads a patient balance screen?
Everything the page draws: the name, date of birth, medical record number, insurer, claim number, date of service and balance. A computer-use agent reads the page as text or as a screenshot, and the model holds what it read for the rest of the run. Copy, upload and prompt controls do not fire on a read. Minimizing what the page shows before it renders is the step that changes what the model receives.
Does Prisma Browser redact PHI before an agent reads it?
Not from the pages reviewed. The product page describes redacting sensitive data in prompts before they leave the enterprise, and the GenAI Prompt control blocks prompts that contain PHI, both of which act on text submitted to an AI application. Neither page describes replacing a value on the page a browser agent opens. The distinction matters because an agent working a balance submits no prompt about the patient.
Who approves what an agent does with a patient balance?
No approval step is described in the pages reviewed. The controls documented for Prisma Browser govern what a prompt may carry and what typed input may contain, and the pages name no person who approves an agent's payment, adjustment or record change. The approver has to come from somewhere: ask for the name and role of the person accountable for each workflow, and for the record that shows the approval after the fact.
Is Typing Guard enough to keep PHI out of an agent's context?
No. Typing Guard scans manual input made by users, sanitizes what it catches and is limited to basic HTML form fields, with the vendor noting that it may not work on JavaScript-based input. An agent reading a rendered page types nothing, so the control has nothing to scan. It addresses a clerk entering a date of birth by hand, which is a different exposure from a model reading the page the application drew.
What record should a healthcare team ask for?
One that shows, per screen and per action, what the model received and who approved the step that followed. The pages reviewed describe no per-screen record and no approver, so the question is worth asking in writing rather than assuming. Ask for the record as an export the team's own monitoring can read, then compare it with one balance task before anyone signs a purchase order.
How RedactSure Keeps a Patient Balance Off the Agent's Screen
Prisma Browser's data controls fire on a prompt a person sends and on text a person types, while a patient balance reaches the agent's model with the page.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the model reads the name, date of birth, medical record number and balance as the billing page draws them, then carries them into a summary. Inside: the page draws PATIENT_001 and DOB_001, the agent posts the payment against the real balance, and a named person approves the destination.
RedactSure is deploying now with enterprise and government customers. Palo Alto Networks states that its browser can redact sensitive data in prompts before they leave the enterprise, a limit that covers the prompt and not the page.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A balance screen is where a billing agent and a privacy review meet. Bring one balance task from your own workflow and see, with test values, what the model receives and which payment a named person approves. Book a demo