I absolutely agree with this. The person using the file-sharing program is partially at fault, guilty of being ignorant of technology, the ramifications of using those technologies, and the security practices to protect against these problems. However, the real problem, and the people who should be worried for their jobs are the admins of the facility. They are hired for their knowledge and expertise. This traffic should never have been allowed...the individual should not have had the priviledges to install a program, not to mention one that would cause a security risk...if the information is truely sensitive, it should never have been locally stored. There are plenty of procedures and policies that would have stopped it.

I had a similar need about a year ago to find a low cost issue tracking software and ran across a real gem. BTNET is asp.net/c#/SQL server based tracking software that is remarkably customizable and with the SQL backend you should be able to scale as large as you need. I think you will find it a possible fit for you.