I think this is a good approach.  I&#x27;m not familiar with HITRUST so maybe this is part of it... but I wonder if there is a way for the lawyers to build something into the policy that makes it so that if a backup exists (for instance on the devs machine, Dropbox, etc) then everything on that machine&#x2F;cloud account&#x2F;whatever is also legally discoverable in the event of a leak.<p>This could potentially make it so that the developer would effectively be leaking their own private data if they tried any shenanigans.