Q:

Risk of Production Data in Test / QA Environments

Looking for risks associated with seeding QA or Testing environments with data from production.  
Other than a compromise of the test environment leading to information disclosure (made worse if that data is PHI), can anyone shed light on additional risks associated with this practice? 

A:

The risks are essentially that you have far less control over a development/test environment, more people will have access to larger portions of the data, and it will be used and thought of in a far different way.   Test data often needs to be sent to 3rd parties, across oceans, or other places where you have no control over it. 
Essentially, count on your test data getting out of the database in one way or another via screenshots, email, etc.   This doesn't have to be malicious and largely isn't.   For the most part, it will be people merely trying to get their job done. 
If the data is senstive in nature like medical records, you need to anonymise the data in some way, but still make it reflect production.