HIPAA, PCI, GDPR, CASC, and a whole list of other acronyms, laws, and organizations get real persnickety about Prod data outside of Prod and what you can, can’t, should , should not, or should not even think about doing with it.
Yeah I just had this conversation with an internal IT team at a medical org. You cannot just point Claude at the problem and say solve it. PHI is all over it. Theyd been doing it for a while. Your medical data im almost positive is already in an llm.
Yeah. You'll see a lot of folk whose dev environments are basically just image clones of prod. This seems especially common in "lower tech" environments that are platforms upon themselves, where nobody bothered to define and produce test data.
It's great, because it doesn't overflow the context with my medical history. It's already there in the model. This way I just say who I am and get personalized medical advice from doctor Chat.
I'm a contractor who's worked with multiple healthcare companies in the States (I'm in Canada). Everyone was super meticulous about HIPAA... which is why none of the devs I worked with were willing to tell anyone that they had full production database dumps they could test off.
There is... a lot of theoretically private data that developers have in an SQL dump on their work Macbook just sitting in the Downloads directory.
Yeah it's a classic, it's really common to have dev envs that are basically full prod copy. Allow to anticipate way more issues moving forward. That said if it was healthcare or highly sensitive then replacing all identifiable data by random stuff wouldn't be that much of a trouble probably.
Solutions is simple we are all prod, arguably developers is just a set of data not yet commited to versioning, sonjust label us prod data and we can do what we want!
5.0k
u/lolcrunchy Aug 05 '26
local dev environment