I loved working in a HIPAA regulated field- "we literally can't do that without breaking the law" would actually work to make people remember that security is important. That said I lucked out in that one of the two cofounders actually understood why this was important (and he gave me permission to revoke all access to sensitive data from the other cofounder).