If you can't trust your employees to adhere to HIPAA or other mandatory regulations, you need better employees.
If your source code contains personal information, usernames, passwords, etc that should not be exposed to the public, you need to address that immediately regardless of any irrational stances on version control.
> "If you can't trust your employees to adhere to HIPAA or other mandatory regulations, you need better employees."
You need a better process. Developers aren't lawyers. Of course they should be aware of HIPAA requirements, but better is to ensure they simply don't have access to sensitive production data except in very controlled circumstances, while making safe anonymised test data available for anything they need test data for.
