DAX Copilot
Microsoft / Nuance · Ambient AI medical scribe
Ayliea's assessment: Medium RiskAyliea recommends: ApproveIn Ayliea's curated list
Verified . Risk classification and recommended policy are Ayliea's subjective assessments — not vendor certifications.
- Data residency
- In-geography (US data stays in the US; EU Data Boundary for EU customers)
- Zero retention available
- No
- Certifications
- HIPAA, SOC 2 Type II (Azure platform), ISO 27001 (Azure platform), HITRUST CSF (Azure platform)
Why this rating
Now delivered as Microsoft Dragon Copilot on Azure: HIPAA BAA via the Microsoft DPA, in-geography data residency, and models trained only on anonymized data. Its SOC 2 Type II, ISO 27001, and HITRUST CSF are certified at the Microsoft Azure platform layer it runs on (badged with that scope) — confirm a Dragon-Copilot product-scoped attestation via Microsoft's Service Trust Portal for your own audit.
Considerations before deploying
- Confirm Dragon Copilot is listed in-scope on your executed Microsoft BAA (the BAA is delivered via the DPA)
- Pull the product-scoped SOC 2 Type II / HITRUST reports from Microsoft's Service Trust Portal — the public certs are Azure-platform-level
- Anonymized customer data is reused for model improvement and is not purged on patient consent revocation — document in your DPIA
- Verify the underlying model stack (e.g., Azure OpenAI) via Microsoft's AI Transparency white paper
Sources
- Dragon Copilot Security white paper (Microsoft Learn) (learn.microsoft.com)
- Dragon Copilot Privacy white paper (Microsoft Learn) (learn.microsoft.com)
Want this for every tool on your network?
A scoping call starts an expert assessment that maps your full AI surface — sanctioned and shadow — from the log metadata you share.