I am trying to bring a company up to HIPAA standards and help them secure their customer health information. A question that sometimes comes up is that developers want to take databases of customer's data and store it on their computers and work with it.
I have always said no to this because I cannot control what happens on their computers. Even if it's a work computer, I do not control the network that it is in ; Because of this I am public enemy number 1 again.
What are some solutions that would maintain compliance and handle data securely and allow developers to continue to work on the data that we receive?