I had a similar issue; here&#x27;s my recommended approach:<p>1) Tell everyone (don&#x27;t single him out) that by the request of a client, you&#x27;re double-downing on internal security and implementing a set of policies and procedures (P&amp;P) for minimizing risk (I personally used HITRUST as the P&amp;P standard).<p>2) Part of the P&amp;P entails an audit by the designated Security Officer (in this case, me), in which I personally oversaw the deletion of all production data from every personal and non-personal machine. No one individual suspected I was singling him&#x2F;her out, as I was doing this across the board, but admittedly, my intention was to go of one individual who had his hands on very sensitive data.<p>3) Make him and every employee sign-off on the P&amp;P Handbook, in which there&#x27;s a clear clause that in case any personally identifiable data is on his&#x2F;her machine, he&#x2F;she is fully liable for the implications of that data getting leaked. Any such employee will be complicit in any criminal proceedings.<p>4) Fire him.