Microsoft Copilot in UK Healthcare

Microsoft Copilot is useful in UK healthcare organisations for the corporate and administrative side of the work: board and committee papers, policies, meeting summaries, email and the documents that support services rather than direct patient care. It isn't a clinical documentation tool, and Microsoft sells a separate product, Dragon Copilot, for that. Whichever you look at, the first job is getting permissions and information governance right, because Copilot surfaces anything a member of staff already has access to, and in healthcare that can include patient-identifiable information sitting in the wrong place.

Which Microsoft Copilot is right for healthcare?

The word Copilot now covers several products, and it helps to separate them early.

• Microsoft Copilot Chat is included with eligible Microsoft 365 plans at no extra cost. It answers from the web and from documents a user uploads, and when staff sign in with their work account their prompts and responses are covered by Microsoft's enterprise data protection commitments.
• Microsoft Copilot is a paid add-on licence. It works from the user's own email, calendar, chats, meetings and files, and sits inside Word, Excel, PowerPoint, Outlook and Teams. It also includes the Researcher and Analyst agents and the ability to build agents in Copilot Studio.
• Microsoft Dragon Copilot is a separate clinical product. It records a clinician and patient conversation, with consent, and drafts clinical notes or nursing flowsheet entries for the clinician to review. In Great Britain it is registered as a class I medical device under UK MDR 2002, and Microsoft has refined its templates for UK and Irish usage.

The rest of this post is about Microsoft Copilot. Microsoft renamed Microsoft 365 Copilot to Microsoft Copilot, and Microsoft 365 Copilot Chat to Microsoft Copilot Chat, in 2026, so older licences and documents may still use the previous names.

Realistic use cases in a trust, health board or care provider

The good early uses are the ones where staff spend time assembling or rewording information that already exists, and can check the result quickly. Examples include:

• drafting a board or committee paper from previous papers, minutes and email
• summarising a governance, estates or project meeting in Teams, with actions and owners
• catching up on a long Outlook thread after leave or a run of shifts
• comparing a revised policy or standard operating procedure with the current version
• turning a policy into a short staff briefing or a set of training slides
• asking questions of a workforce or finance spreadsheet in Excel without building formulas

Copilot can be wrong and can sound confident when it is. It shouldn't be used to make clinical decisions, and anything it drafts needs to be read by someone who knows the subject before it is used.

What has to be sorted before you roll out Copilot?

Copilot only shows a user content they already have at least view access to. The problem in healthcare is that years of shared drives, Teams and SharePoint sites have built up with much wider access than anyone intended, and patient lists, incident reports or HR casework can end up in a site that half the organisation can open. If a member of staff can reach a file through an old sharing link, Copilot can find it and summarise it for them.

The steps we would take first are:

• run the SharePoint data access governance reports to find sites shared with everyone, sharing links and broken permission inheritance (SharePoint Advanced Management is included with Microsoft Copilot licences)
• change the default sharing link if it is set to Anyone, and review guest accounts and external sharing
• use Restricted Content Discovery on sensitive sites, such as HR, safeguarding and any site holding patient information, while permissions are reviewed
• apply sensitivity labels to sensitive content and use Microsoft Purview data loss prevention for Copilot to keep it out of Copilot's answers
• archive inactive sites and Teams so Copilot isn't working from out-of-date policies

Bring your data protection officer and Caldicott Guardian in at the start. They will want to see a data protection impact assessment, and it is much easier to agree the rules before staff have the tool than after.

Data protection and security

Microsoft states that prompts, responses and data accessed through Microsoft Graph aren't used to train the foundation models used by Copilot, and that Copilot only works with content the signed-in user has permission to see. For tenants that signed up in the United Kingdom, Microsoft Copilot is covered by Microsoft's data residency commitments for data at rest, although Microsoft notes that queries from outside the EU may be processed in other regions. Copilot prompts and responses are stored and can be covered by Microsoft Purview retention policies, so your records manager should decide how long they are kept.

For Teams meetings, organisers can choose whether Copilot works only during the meeting, using temporary speech-to-text data that isn't saved, or during and after it from a saved transcript. Setting a sensible default for sensitive meetings is a quick win.

How is Microsoft Copilot licensed?

Copilot Chat is included with eligible plans including Microsoft 365 E3, E5, F1 and F3 and Office 365 E1, E3 and E5. The paid Microsoft Copilot licence is an add-on to a qualifying plan, including those same Microsoft 365 and Office 365 plans, and is included in Microsoft 365 E7. Frontline staff on F1 or F3 licences are eligible for both. Dragon Copilot is licensed separately. Pricing depends on your agreement, so get a current figure from your reseller rather than working from list prices.

A phased rollout works well. Get Copilot Chat in front of staff with clear guidance on what not to paste into it, then licence a group of corporate and administrative staff with heavy drafting and meeting loads, and measure what changes before going wider. Our post on Microsoft Copilot in the UK public sector covers data residency and records in more detail.

Frequently asked questions

Can Microsoft Copilot be used for clinical notes?

Microsoft Copilot is a general productivity tool and isn't designed for clinical documentation. Microsoft's clinical product is Dragon Copilot, which drafts notes from recorded consultations for a clinician to review and is registered as a class I medical device in Great Britain.

Does Copilot use patient or staff data to train its AI?

No. Microsoft states that prompts, responses and data accessed through Microsoft Graph aren't used to train the foundation models used by Microsoft Copilot. It also only uses content the signed-in user is already allowed to see, which is why permissions need reviewing first.

Can frontline staff use Copilot?

Yes. Microsoft 365 F1 and F3 users are eligible for Copilot Chat at no extra cost, and both plans qualify for the paid Microsoft Copilot add-on.

What should we do before buying Copilot licences?

Find and fix oversharing in SharePoint, OneDrive and Teams, label sensitive content, and complete a data protection impact assessment with your data protection officer. Agree an acceptable use policy and a default for Copilot in Teams meetings at the same time.

If you would like to know whether your Microsoft 365 tenant is ready before you commit to licences, our AI readiness assessment covers permissions, sharing, governance and where Copilot is likely to pay back. Get in touch to talk it through.