Generally you will find that suck policies come from HR and IT people aren't particularly enthusiastic about them either.
On Gmail the question was "why were they banning Gmail" not was his personal use of gmail a violation so the point still stands (though I'll admit I read it wrong)
Finally, if your security gets circumvented than your security is flawed. Any IT department that chooses not to implement security on the argument that it will inevitably get circumvented probably needs to re-evaluate how they're handling things.
What I mean by circumvent is that if you tell an employee they can't use Facebook during breaks, they'll whip out their phone and use Facebook. If you tell a developer they can't use an IDE they like, they'll buy their own.
I like this article on Google's approach: http://www.cio.com/article/144500/IT_s_Third_Epoch...and_Run...
"On Sarbanes Oxley Gmail IS a violation because S.O. requires the companies themselves to archive all e-mails. So if he leaves and takes his gmail with him than he'll have an archive but the company will be in violation." The article clearly stated he was forwarding his email to gmail- so you are the one that has it wrong, the company would still have a copy. The problem here would not be SO compliance, but rather corporate document retention (destruction) policies where they want to get rid of records as soon as it is legal to do so.
"any IT person in Health Care will tell you IM programs are a HIPAA violation because they allow for encrypted transfer of files" Do you mean unencrypted? Regardless- I can think of 100 ways to transfer an unencrypted file. Why single out IM, which has many useful properties.
Here's what's happening in the real world- the corporate network/desktop that is overly locked down gets circumvented. People bring in laptops and use cell modems, people use their phones, people install virtual machines.