Tax season will soon be upon us and many not-so-eager taxpayers will share sensitive personal information about themselves, their dependents, their employees, and others with their trusted professional tax preparers for processing. What many of these preparers might not realize is that federal law and a growing number of state laws obligate them to have safeguards in place to protect sensitive taxpayer data. This can be overwhelming, especially considering tax preparers are already tasked with having to absorb annual federal, state, and local tax law changes, in addition to running their businesses. We hope this post provides a helpful summary of best practices and resources.
Legal Mandates.
- Federal. The Financial Services Modernization Act of 1999 (a.k.a. Gramm-Leach-Bliley Act) authorized the Federal Trade Commission to set information safeguard requirements for various entities, including professional tax return preparers. The FTC’s Safeguards Rule requires tax return preparers to implement security plans, which should include:
- one or more employees designated to coordinate an information security program;
- identifying and assessing risks to client data, along with the effectiveness of current safeguards for controlling these risks;
- maintaining a written information security program, which is regularly monitored and tested;
- using vendors that also have appropriate safeguards, and contractually requiring them to maintain those safeguards; and
- keeping the program up to date to reflect changes in business or operations, or the results of security testing and monitoring.
- States. A growing number of states have enacted laws and/or issued regulations mandating businesses adopt reasonable safeguards to protect personal information. Small and mid-sized businesses typically are not excluded from these mandates. Some of these states include: California, Colorado, Florida, Illinois, Massachusetts, New York, and Oregon.
Practical next steps.
The good news is that businesses generally are permitted to shape their programs according to their size and complexity, the nature and scope of their activities, and the sensitivity of the customer information they handle. However, a small five-person tax preparation firm should not read this to mean it would be sufficient to obtain a template privacy policy from the Internet, put it on a shelf, and call it a day. Others have tried this.
The Internal Revenue Service (IRS) has issued guidance to help preparers get up to speed. The IRS’ “Taxes-Security-Together” Checklist lists
“six basic protections that everyone, especially tax professionals handling sensitive data, should deploy.
These include:
- Anti-virus software
- Firewalls
- Two-factor authentication
- Backup software/services
- Drive encryption
- Virtual Private Network (VPN)
These six protections likely are not enough, other controls include:
- Train yourself and staff to spot and avoid phishing attacks.
- Maintain strong passwords (NOT “password” or “123456”!) – generally 8 or more characters, with special and alphanumeric characters, use phrases, etc.
- Encrypt all sensitive files/emails.
- Back up sensitive data to a secure external source, that is NOT connected fulltime to a network (If you have been hit with a ransomware attack, you will understand why this is important).
- Double check return information, especially direct deposit information, prior to e-filing.
- Only collect, use, retain, and disclose the minimum necessary information needed for the task.
- Because no set of safeguards is perfect, have an incident response plan and practice it.
Check out IRS Publication 4557 Safeguarding Taxpayer Data for more information on these and other controls, and a helpful checklist from the FTC.
Yes, professional tax preparers that fail to take these steps can expose themselves to an FTC investigation, and a violation of their obligations as Authorized IRS e-file Providers under IRS Revenue Procedure 2007-40. But the impact on your business from a breach of client data can be far worse. The key is to get started and do something.
