> If you accidentally leave personally identifiable healthcare information on some random stage server and that server gets hacked, that is a federal crime.

Not sure how that relates to Version Control? I personally don't put production (real) data on staging servers to begin with; always scrub your production clones or generate data for testing instances.

> If the data and application code are very intertwined (likely in a pre-SOA era), it can be very difficult to version control code completely isolated from PII.

Maybe I am naive (never had to work on DOS), but shouldn't the data be in a database/datastore/data directory that can be ignored by source control?