DAX Copilot
Microsoft / Nuance · Ambient AI medical scribe
Ayliea's assessment: Medium RiskAyliea recommends: ApproveIn Ayliea's curated list
Verified . Risk classification and recommended policy are Ayliea's subjective assessments — not vendor certifications.
- Data residency
- In-geography (US data stays in the US; EU Data Boundary for EU customers)
- Zero retention available
- No
- Certifications
- HIPAA
Why this rating
Now delivered as Microsoft Dragon Copilot on Azure: HIPAA BAA via the Microsoft DPA, in-geography data residency, and models trained only on anonymized data. It runs on Microsoft Azure, which is independently certified to SOC 2 Type II, ISO 27001, and HITRUST CSF — but those are documented at the platform layer, not as a Dragon Copilot product attestation, so we badge only the product-applicable HIPAA/BAA and defer the rest to diligence.
Considerations before deploying
- Confirm Dragon Copilot is listed in-scope on your executed Microsoft BAA (the BAA is delivered via the DPA)
- Pull the product-scoped SOC 2 Type II / HITRUST reports from Microsoft's Service Trust Portal — the public certs are Azure-platform-level
- Anonymized customer data is reused for model improvement and is not purged on patient consent revocation — document in your DPIA
- Verify the underlying model stack (e.g., Azure OpenAI) via Microsoft's AI Transparency white paper
Sources
- Dragon Copilot Security white paper (Microsoft Learn) (learn.microsoft.com)
- Dragon Copilot Privacy white paper (Microsoft Learn) (learn.microsoft.com)
Want this for every tool on your network?
A scoping call starts an expert assessment that maps your full AI surface — sanctioned and shadow — from the log metadata you share.