Can Health Systems Use Microsoft 365 Copilot With Patient Data? Start With Who Can Open the Records

New York, NY, Nov. 12, 2026 (GLOBE NEWSWIRE) -- A March 2026 national survey found that 35% of clinicians used AI multiple times a day at work, while only 27% of doctors and nurses knew of any formal AI governance policy at their organization.* eSoftware Associates (ESW) today outlined an access review for health systems preparing to use Microsoft 365 Copilot with patient data. The review opens with an AI readiness assessment, then maps which staff can open patient records, shared mailboxes and department sites.

“Shared mailboxes and project sites keep their old permissions long after people change roles or a project ends. An IT report shows who can reach a location, but the department owner knows whether a colleague, an outside partner or a finished project team still has a reason to be there. That confirmation keeps patient records with the people authorized to see them,” said Russell Kommer, founder and CEO of eSoftware Associates.

ESW’s free, five-minute AI readiness diagnostic scores six areas, including governance and Copilot readiness. Organizations can use the results to identify review priorities before ESW assesses tenant access and helps configure the required policies and permissions. Each health system remains responsible for determining and maintaining its HIPAA compliance obligations.

ESW worked with a healthcare compliance organization of more than 2,000 employees to formalize external-sharing approvals. The organization needed a process for approving requests to share files with partner labs and clinics. ESW built a request hub with SharePoint workflow automation. Power Automate routes each request, including those involving PHI, for approval and logs the outcome. The engagement also established quarterly documented access reviews.

Before the pilot, confirm the Microsoft agreement covers the Copilot services in scope. Decide whether staff who handle PHI will have web search enabled, and identify the policy that controls the setting.

Map shared mailboxes, department sites and care-team channels

Start with department mailboxes, inactive project sites and channels that contain people outside the care team. For each location, document its users, the business reason for access and the department owner responsible for confirming that access remains necessary. Include former staff and external collaborators in the review where applicable.

Let record owners approve access changes

Send the findings to each department responsible for the records and obtain confirmation before changing access. Remove or restrict permissions that are no longer needed, and apply sensitivity labels where appropriate. ESW can support the work through permissions audits and governance configuration in Entra ID and Microsoft Purview DLP. Test the intended users’ access before beginning the pilot.

Frequently Asked Questions

Question: Can health systems use Microsoft 365 Copilot with patient data?

Answer: Yes, Microsoft states that Microsoft 365 Copilot and Copilot Chat support HIPAA compliance when properly configured. The health system must also have a Business Associate Agreement covering the services it uses and maintain the required administrative, physical and technical safeguards. A BAA or a supported product does not establish HIPAA compliance on its own. Reviewing who can access patient information is one piece of the broader safeguards process.

Question: Can clinicians use Copilot’s web search with patient information?

Answer: Microsoft states that queries sent to Bing through Copilot web search are not covered by the Data Protection Addendum or Business Associate Agreement, and HIPAA compliance does not apply to those queries. Health systems should review these terms before enabling web search for staff who handle PHI and configure the setting according to their policies.

Administrators decide who can use web search through the Allow web search in Copilot policy in the Cloud Policy service. The policy can be scoped to specific users or groups, turned off entirely, or turned off in Work mode while staying on in Web mode. Once it is disabled, users cannot turn web search back on themselves.

Question: Do sensitivity labels keep PHI out of Copilot?

Answer: Sensitivity labels can restrict access to encrypted files, subject to the applicable permissions. Microsoft documents specific VIEW and EXTRACT permission requirements for Copilot to return content from encrypted files. Excluding labeled files or emails from Microsoft 365 Copilot processing is a separate control available through applicable Microsoft Purview DLP policies. Microsoft notes that excluded items may still appear in response citations, so review the policy scope for each deployment.

*Source: Wolters Kluwer Health, 2026 Future Ready Healthcare Survey Report, conducted by Ipsos, March 11–14, 2026.

About eSoftware Associates (ESW)
ESW builds secure business apps, workflows, portals, and automations across Power Apps, SharePoint, Dataverse, SPFx, Copilot & AI Agents, and Azure. 100% U.S.-based since 2006.

 Majed Soufi
Zen Media
 pr@zenmedia.com