Microsoft Dragon Copilot (formerly DAX Copilot)
Microsoft / Nuance · Ambient AI medical scribe
Public sources reviewed . Risk classification and recommended policy are Ayliea's subjective assessments — not vendor certifications.
Scope of this recommendation
Microsoft Dragon Copilot clinical workflow (legacy DAX Copilot); exact service-specific agreement required.
Public documentation review only. Current audit reports, certificate scope, executed contracts and customer settings were not independently examined. An omitted assurance claim is not evidence that the vendor lacks it.
- Storage and processing locations
- Microsoft describes in-geography processing/storage; verify country availability and contracted geography for the enabled functions.
- Retention and ZDR scope
- Clinical recordings and documentation are service data, not zero-retention inference. Confirm current retention and secondary-use terms under the DPA and service-specific terms.
- Vendor-reported audits / certifications
- HITRUST CSF (Azure environment; confirm product coverage)
Why this rating
Dragon Copilot combines dictation and ambient documentation on Azure. Azure-layer assurance and Microsoft privacy commitments must be checked against the purchased clinical service; a platform certificate alone is not a product-scoped assessment.
Considerations before deploying
- Execute the applicable BAA and document recording notice/consent before patient use.
- Obtain current product-scoped assurance, subprocessor/data-flow details and contractual training/secondary-use terms.
- Validate audio, transcript, note and backup retention, deletion and EHR access; require clinician review before finalizing documentation.
- Review current Dragon service-specific data-use terms; do not rely on the previous unsupported blanket statement about anonymized model training or consent revocation.
Sources
- Dragon Copilot privacy white paper (learn.microsoft.com)
- Dragon Copilot security white paper (learn.microsoft.com)
Need a vendor review for your use case?
A scoping call defines the systems, data flows and vendor evidence to review for your use case.