I do IT governance. When someone builds a server or a firewall rule or a database in a way that could leak patient data to somewhere it shouldn’t be I find it and make them fix it. Generally people don’t want to redo something that they’ve done so there is a whole process around who you tell so that everyone know the problem and who has to fix it.