IRS spotlights requirement to have a written information security plan

Editor: Valrie Chambers, CPA, Ph.D.

Data security continues to be a hot topic for tax professionals — and the IRS. That is because tax practitioners and their clients continue to be frequent targets of data breaches. Although the IRS has implemented many successful tactics to fight tax refund fraud, more work is needed, especially as cyberthieves continue to become more sophisticated. The IRS is partnering with the practitioner community to combat this epidemic.

The IRS’s Protect Your Clients; Protect Yourself campaign (visit www.irs.gov for more information) raises practitioners’ awareness of their responsibilities and the common-sense steps they can take to protect their clients from identity theft and, in turn, their tax practice and livelihood. Steps such as protecting email accounts with strong passwords, implementing two-factor authentication, and having anti-phishing security tools are imperative. Review IRS Publication 4557, Safeguarding Taxpayer Data, available at www.irs.gov, for additional best practices.

Practitioner requirement to develop a written information security plan

According to the Gramm-Leach-Bliley Act (GLBA) safeguards rule, tax preparers must implement security plans to protect client data. Failure to do so may result in a Federal Trade Commission (FTC) investigation.

Although the GLBA, also known as the Financial Services Modernization Act of 1999, P.L. 106-102, has been around for quite some time, many practitioners have been unaware they are required to develop a written information security plan that describes how their firm is prepared to protect clients’ nonpublic personal information.

The IRS, aware of the confusion in the profession, boosted its efforts to remind practitioners of this responsibility, issuing several recent email alerts to the practitioner community.Additionally, in mid-October 2019, when practitioners were starting to renew their preparer tax identification numbers (PTINs), they noticed a statement on data security responsibilities added to the renewal process. Practitioners were instructed to check a box to confirm their awareness of their responsibility to have a data security plan and to provide data and system security protections for all taxpayer information.

In response to many recent requests from members, the AICPA Tax Section developed a GLBA information security plan template (available at www.aicpa.org that Tax Section members can download and customize to comply with the safeguards rule contained in the GLBA.

Additional data security responsibilities

In addition to the GLBA safeguards rule, tax practitioners should keep in mind other client data security responsibilities.

• Sec. 7216 is a criminal provision that prohibits preparers from knowingly or recklessly disclosing or using tax return information. See the AICPA Tax Section’s Section 7216 Guidance and Resources webpage at www.aicpa.org to aid with compliance.
• Treasury Department Circular No. 230, Regulations Governing Practice Before the IRS (31 C.F.R. Part 10), requires practitioners to exercise due diligence in preparing returns or other documents related to a federal tax matter. A violation could subject a practitioner to sanctions, including censure, suspension, or disbarment from practice before the IRS.
• The AICPA Code of Professional Conduct addresses member responsibilities to the public, their clients, and colleagues, including responsibilities to keep client information confidential and secure.
• In accordance with best business practices, including practices contained in the Privacy Management Framework (available at aicpa.org/IMTA), a firm should publish its privacy statement on its website.
• Depending on a practitioner’s focus areas, he or she may need to adhere to other privacy requirements. For example, there are specific requirements for health-related information, available at hhs.gov/hipaa/index.html.

As the IRS has noted, combating today’s cybercriminals requires everyone to work together. Practitioners play a significant role in data security and should continue to assess, improve, and document their processes to keep client data safe.