My company handles clinical trials, so we run into HIPPA regulations. We all work remotely. Every developer and QA tester has his own laptop, they have set up

My company handles clinical trials, so we run into HIPPA regulations. We all work remotely. Every developer and QA tester has his own laptop, they have set up a VM to run the application locally, with a fake database. No one ever goes into prod for anything. Companies have to trust their employees - else they wouldn't hire any. You can't really blindfold a developer from the code he's creating, can you?