you know. I've worked at large corporations that were required to be HIPAA and PCI compliant. the big database with millions of records of sensitive information was limited access. who had access to it?

1. the application
2. the DBAs who managed it
3. me, who managed the application and was backup for the DBAs

not even the execs had access to it.

my point is, it sounds like they aren't following compliance requirements and should probably face a class action suit at the least.