Either IT or this person is grossly incompetent. Beyond patch policies, managing data this way is terrifying.