1) Tell everyone (don't single him out) that by the request of a client, you're double-downing on internal security and implementing a set of policies and procedures (P&P) for minimizing risk (I personally used HITRUST as the P&P standard).
2) Part of the P&P entails an audit by the designated Security Officer (in this case, me), in which I personally oversaw the deletion of all production data from every personal and non-personal machine. No one individual suspected I was singling him/her out, as I was doing this across the board, but admittedly, my intention was to go of one individual who had his hands on very sensitive data.
3) Make him and every employee sign-off on the P&P Handbook, in which there's a clear clause that in case any personally identifiable data is on his/her machine, he/she is fully liable for the implications of that data getting leaked. Any such employee will be complicit in any criminal proceedings.
4) Fire him.