Microsoft Copilot is useful in UK healthcare organisations for the corporate and administrative side of the work: board and committee papers, policies, meeting summaries, email and the documents that support services rather than direct patient care. It isn't a clinical documentation tool, and Microsoft sells a separate product, Dragon Copilot, for that. Whichever you look at, the first job is getting permissions and information governance right, because Copilot surfaces anything a member of staff already has access to, and in healthcare that can include patient-identifiable information sitting in the wrong place.
The word Copilot now covers several products, and it helps to separate them early.
The rest of this post is about Microsoft Copilot. Microsoft renamed Microsoft 365 Copilot to Microsoft Copilot, and Microsoft 365 Copilot Chat to Microsoft Copilot Chat, in 2026, so older licences and documents may still use the previous names.
The good early uses are the ones where staff spend time assembling or rewording information that already exists, and can check the result quickly. Examples include:
Copilot can be wrong and can sound confident when it is. It shouldn't be used to make clinical decisions, and anything it drafts needs to be read by someone who knows the subject before it is used.
Copilot only shows a user content they already have at least view access to. The problem in healthcare is that years of shared drives, Teams and SharePoint sites have built up with much wider access than anyone intended, and patient lists, incident reports or HR casework can end up in a site that half the organisation can open. If a member of staff can reach a file through an old sharing link, Copilot can find it and summarise it for them.
The steps we would take first are:
Bring your data protection officer and Caldicott Guardian in at the start. They will want to see a data protection impact assessment, and it is much easier to agree the rules before staff have the tool than after.
Microsoft states that prompts, responses and data accessed through Microsoft Graph aren't used to train the foundation models used by Copilot, and that Copilot only works with content the signed-in user has permission to see. For tenants that signed up in the United Kingdom, Microsoft Copilot is covered by Microsoft's data residency commitments for data at rest, although Microsoft notes that queries from outside the EU may be processed in other regions. Copilot prompts and responses are stored and can be covered by Microsoft Purview retention policies, so your records manager should decide how long they are kept.
For Teams meetings, organisers can choose whether Copilot works only during the meeting, using temporary speech-to-text data that isn't saved, or during and after it from a saved transcript. Setting a sensible default for sensitive meetings is a quick win.
Copilot Chat is included with eligible plans including Microsoft 365 E3, E5, F1 and F3 and Office 365 E1, E3 and E5. The paid Microsoft Copilot licence is an add-on to a qualifying plan, including those same Microsoft 365 and Office 365 plans, and is included in Microsoft 365 E7. Frontline staff on F1 or F3 licences are eligible for both. Dragon Copilot is licensed separately. Pricing depends on your agreement, so get a current figure from your reseller rather than working from list prices.
A phased rollout works well. Get Copilot Chat in front of staff with clear guidance on what not to paste into it, then licence a group of corporate and administrative staff with heavy drafting and meeting loads, and measure what changes before going wider. Our post on Microsoft Copilot in the UK public sector covers data residency and records in more detail.
Microsoft Copilot is a general productivity tool and isn't designed for clinical documentation. Microsoft's clinical product is Dragon Copilot, which drafts notes from recorded consultations for a clinician to review and is registered as a class I medical device in Great Britain.
No. Microsoft states that prompts, responses and data accessed through Microsoft Graph aren't used to train the foundation models used by Microsoft Copilot. It also only uses content the signed-in user is already allowed to see, which is why permissions need reviewing first.
Yes. Microsoft 365 F1 and F3 users are eligible for Copilot Chat at no extra cost, and both plans qualify for the paid Microsoft Copilot add-on.
Find and fix oversharing in SharePoint, OneDrive and Teams, label sensitive content, and complete a data protection impact assessment with your data protection officer. Agree an acceptable use policy and a default for Copilot in Teams meetings at the same time.
If you would like to know whether your Microsoft 365 tenant is ready before you commit to licences, our AI readiness assessment covers permissions, sharing, governance and where Copilot is likely to pay back. Get in touch to talk it through.