Use a coding agent on a machine that has patient data on it
An agent reads the folder you start it in. Here is how to give it a folder worth reading, on the same laptop where the patient export lives.
The problem, stated exactly
A coding agent works on the files in whatever folder it was started in. That is the whole reason it is useful — it can read your actual spreadsheet, your actual script, your actual mess — and it is also the entire risk. Anything in that folder is available to be read and sent to the model, whether or not you mentioned it.
On a work laptop this is not hypothetical. A patient export downloaded for a report, a billing CSV, a screenshot of a chart, a PDF someone emailed over: none of these were put there to be shared, and all of them are readable by an agent started one directory up.
The fix is not vigilance. Vigilance fails on a Thursday afternoon. The fix is structural: give the agent a folder that contains nothing you would not hand over.
Make a workspace that starts empty
Create a new, empty directory specifically for this work, and start the agent inside it. One project, one folder. This takes about fifteen seconds and closes most of the exposure on its own.
Do not start an agent in your home directory, in Desktop, or in Documents. Those are where everything accumulates, and they are the defaults a terminal opens into, which is exactly why this happens by accident.
Be particularly careful with folders that sync — Drive, Dropbox, OneDrive, iCloud Desktop. A synced folder contains whatever anyone in the practice put in the shared drive, not only what you put there, and it can change under you mid-session.
Look in the folder before you start
List the folder’s contents and read the list. Not a glance — read it. Downloads with names you do not recognise, an old export, a configuration file with credentials in it, a database dump someone left behind from a migration: these are the things that get read.
Check the hidden files too. Configuration files, credential caches, and editor state do not show up in a normal file listing and are perfectly readable.
If something is in there that should not be, move it out of the folder rather than telling the agent to avoid it. An instruction is a request; an empty folder is a fact.
Build against data you made up
Almost all of the work of building a small tool is getting the shape right: the columns, the edge cases, the format the output has to be in. Shape does not require real records. Write twenty invented rows with the same columns and the same messiness — blank cells, a duplicate, a date in the wrong format — and build against those.
This is faster as well as safer. Invented data can be broken deliberately, shared in a bug report, and pasted into a chat without a second thought, so the loop of trying something and seeing it fail gets shorter.
When the tool works on the invented rows, run it against the real file yourself, outside the agent’s folder. The tool needs the real data; the agent does not.
When the real data genuinely has to be there
Sometimes the work is the data — a one-off reconciliation across a real export, say, where no invented version will do. At that point the question stops being about folders and becomes the same question as everywhere else on this page: is this tool one that is allowed to see this?
The directory records Claude Code as covered under a BAA with zero data retention enabled, and records what that coverage excludes: remote mode, the web version, and the review and security tools. Read the entry and its source before relying on it, and confirm the account you are logged into is the covered one rather than a personal subscription.
If the answer is that the tool is not covered, de-identify the export before it goes anywhere near the folder. There is a tutorial on doing that properly, and “properly” is a higher bar than most people assume.
Before you point it at anything real
Confirm the folder holds only what this task needs. Confirm which account is logged in. Confirm the tool is one the directory records as covered, for the work you are about to do.
Give the agent one job at a time and read what it proposes before you let it run. An agent that writes files can also overwrite them, so keep originals somewhere it cannot reach.
When the work is finished, look at what is now in the folder before you leave it there. Outputs accumulate, and a folder that started empty does not stay that way.