That IT person presumably is working under something like an NDA (and HIPAA, etc., where applicable), so there is recourse we’re they to violate their duties and misuse data.