Chances are someone in your office is already using AI. Maybe your office manager pastes an email into a free chatbot to smooth out the wording, or someone uploads a spreadsheet to get a quick summary. It feels harmless, and it often saves a few minutes. The catch is that, depending on the tool’s terms, that information may be stored outside your control, and nobody has decided which tools are okay to use or what should never go into them.
At BizTechPro, we’ve been the IT department for small businesses since 2008. Today we support offices in Rockland and Westchester in New York and in Bergen, Passaic, Morris and Essex counties in New Jersey, and this is a question we hear more and more: “Should we be using Copilot, and is it safe?” Here’s a plain-English look at what it is, what it’s good for, and how to start without putting client or patient information at risk.
First, a quick note on names
Microsoft has been renaming things again. What used to be called Microsoft 365 Copilot is now Microsoft Copilot, and Microsoft 365 Copilot Chat is now Microsoft Copilot Chat. Microsoft says some screens and licenses may still show the old names during the transition (Microsoft Learn).
Copilot Chat vs. a Copilot license: what you already have
Many offices already have some Copilot without realizing it.
- Copilot Chat is included at no extra cost for people who sign in with a work account and have an eligible Microsoft 365 plan, including Microsoft 365 Business Basic, Business Standard, and Business Premium (Microsoft Learn: Manage Copilot Chat). Out of the box, it answers questions using information from the web (Microsoft Learn: License options).
- A paid Microsoft Copilot license is an add-on to your Microsoft 365 plan. It lets Copilot work with the files, email, and chats each person can already access (Microsoft Learn: License options). That’s where it can summarize a long email thread, pull notes together from your documents, or help draft a reply based on what’s in your files.
Microsoft’s pricing and promotions change often, so check current pricing with Microsoft or ask us before you buy. As our AI & automation page puts it, we license “only the people who will use it.”
What Copilot is actually good for in a small office
Think of it as a helpful assistant that drafts and summarizes, not as something that does the work for you. In practice, small offices use it for things like:
- Drafting routine replies in Outlook
- Summarizing a long Teams meeting for someone who missed it
- Pulling figures together in Excel
- Turning rough notes into a first draft
Microsoft is upfront that AI answers “aren’t guaranteed to be 100% factual” and that people should review the output before sending it to others (Microsoft Learn). We agree. Your staff stay responsible for what goes out the door.
How Copilot handles your data
This is the part most owners care about, so here is what Microsoft says, in plain terms:
- It only shows what each person can already see. Copilot “only surfaces organizational data to which individual users have at least view permissions” (Microsoft Learn).
- Your data isn’t used to train the AI. Microsoft states that prompts, responses, and data accessed through Microsoft 365 “aren’t used to train foundation LLMs” (Microsoft Learn).
- Your history is stored like your other Microsoft 365 content. Prompts and responses are stored in line with Microsoft’s commitments for your organization’s other Microsoft 365 content, and admins can set retention policies (Microsoft Learn).
The first point is also the biggest risk. If your file permissions are messy, for example if a “Shared” folder holds payroll or a former employee’s account still has access, Copilot can surface anything a user already has access to. That’s why we review who can see which files before Copilot is switched on.
Law firms, medical practices, and nonprofits: a few extra cautions
Medical practices. Microsoft lists Microsoft Copilot and Copilot Chat among its services in scope for HIPAA (Microsoft Learn: HIPAA/HITECH). Two important caveats from Microsoft: Copilot supports HIPAA compliance only “for properly configured implementations,” and web search queries fall outside those protections (Microsoft Learn: Enterprise data protection). Web search is on by default unless an admin changes it (Microsoft Learn: Manage Copilot Chat). Settings like that should be reviewed before anyone works with patient information. Compliance remains your practice’s responsibility, and no outside vendor can certify it for you. What we can do is put the technical safeguards in place and document them.
Law firms. Attorneys have confidentiality duties under ABA Model Rule 1.6. Before Copilot touches client matters, make sure document permissions match who should actually see each file, and decide in writing which AI tools are approved for client work.
Nonprofits and small businesses. Donor records, payment details, and client information deserve the same care. A short written AI usage policy goes a long way.
How to get started without the risk
- Start with a short assessment, not a purchase. Find two or three tasks where AI or automation will clearly help.
- Clean up permissions first. Make sure each person can only see what their job needs.
- Write a plain-English AI usage policy. List approved tools and what must never be entered into them, such as client records, passwords, or financial details.
- License only the people who will benefit. Not everyone needs a paid Copilot license.
- Train around real work. Hands-on practice with your team’s own tasks beats a generic demo.
That’s how our AI & automation service works, alongside the Microsoft 365 setup and cybersecurity protections that keep it safe.
Frequently asked questions
Do we already have Copilot?
If your team signs in with work accounts on an eligible plan such as Microsoft 365 Business Basic, Standard, or Premium, you likely already have Copilot Chat at no extra cost (Microsoft Learn). The deeper features that work with your own files require a paid Copilot add-on license.
Will Copilot let staff see files they shouldn’t?
Copilot only surfaces content a person already has permission to view. If permissions are too broad, though, it can make that easier to find. That’s why permission reviews come first.
Is Copilot safe to use with patient information?
Microsoft says Copilot supports HIPAA compliance for properly configured implementations, but web search queries fall outside those protections. Have your settings reviewed before anyone uses it with patient information, and remember that compliance stays your practice’s responsibility.
Do we need Microsoft Copilot?
Not always. It works best for teams that spend their day in Outlook, Word, Excel, and Teams and keep files organized in SharePoint and OneDrive. For other goals, a simple automation or a different tool may fit better.
Let’s talk about it
Curious whether Copilot is worth it for your office, or worried about what your staff are already pasting into free tools? BizTechPro is a Microsoft Partner based in Pearl River, NY, and we’d be glad to help you sort it out. Call (845) 747-5803 or schedule a conversation. We’ll listen first, then give you a plain-English plan.