PTIN renewal season opens in mid-October, which makes Cybersecurity Awareness Month a good time to look at a checkbox most preparers click past. Line 11 of Form W-12 asks you to confirm you know that paid preparers are required by law to create and maintain a written information security plan. This line has been on the form since 2019, however, plenty of firms that checked it still don't have the plan.
This is important because protecting client data is no longer left to good judgment alone; by now, it has become a legal obligation with specific parts, and regulators expect to see them in writing.
The Gramm-Leach-Bliley Act gave the Federal Trade Commission authority to set data security rules for "financial institutions." The FTC's Safeguards Rule (16 CFR Part 314) defines that term broadly, and tax preparation firms appear on its own list of examples. And remember: size doesn't take you out of scope. Firms holding data on fewer than 5,000 consumers are excused from a few documentation steps but not from the rule itself.
The 2021 amendments provided concrete expectations. For example, a covered firm must name a Qualified Individual to oversee its security program, conduct a risk assessment, and require multi-factor authentication for anyone accessing client information. Client data must also be encrypted on your systems and in transit. And information you no longer need must be securely disposed of within two years of last serving the client. Moreover, staff need security training, and vendors who handle client data need contracts that specify how they will protect it.
Since May 2024, there has also been a reporting deadline. If unencrypted information on 500 or more consumers is acquired without authorization, the firm must notify the FTC no later than 30 days after discovering it, unless there’s a legal requirement or legitimate business need to keep the information longer.
The IRS reinforces all of these policies. Publication 4557, Safeguarding Taxpayer Data, walks through the rule and tells practitioners to report data theft to their IRS Stakeholder Liaison immediately, so the agency can help stop fraudulent returns filed in clients' names. Publication 5708 offers a WISP template designed with smaller practices in mind.
For Canadian firms subject to the Personal Information Protection and Electronic Documents Act (PIPEDA), there’s no minimum number of affected people. Under the Office of the Privacy Commissioner of Canada's breach reporting guidance, any breach that poses a real risk of significant harm to even one individual must be reported to the OPC, and the people affected must be notified as soon as feasible. Every breach, reported or not, must be recorded, and those records kept for two years. The rules apply to small businesses as well.
Financial records sit high on the sensitivity scale, so a misdirected email containing a client's T4s or bank statements can cross that line faster than many bookkeepers assume.
Most breaches at small practices don't begin with a sophisticated attack. They start with routine habits nobody questioned:
Each of these runs against a specific requirement: encryption in transit, access controls, activity logs, or secure disposal. The IRS also warns that criminals often reach client data through phishing emails that pose as a software provider, the IRS itself, or even a prospective client.
A written plan describes your controls, but you must have the tools to carry them out. Client Hub is built so the everyday parts of client work happen in one secured place instead of across inboxes and text threads. In our client portal, files are stored and shared with encryption, and access controls govern what your team and your clients can see.
Two-factor authentication is available for your staff and your clients' users, and admins can see who has turned it on. Turning on two-factor authentication in Client Hub can help firms meet the Safeguards Rule’s MFA requirement.
In the rule's terms, Client Hub is also a service provider, which means you’re expected to evaluate us like any other vendor. Our Security Framework explains how we handle storage, encryption, access, and monitoring, so you can document that review in your WISP.
Open your WISP. If you don't have one, start with Publication 5708. If you do, check that it names your Qualified Individual, lists every place where client data lives, and includes an incident response plan someone other than you could follow. Then turn on two-factor authentication everywhere you can, starting with the systems that hold client files.
.svg){kind=small}
.svg){kind=small}
