The FTC Safeguards Rule for Ohio Tax Preparers

PTIN renewal opens in mid-October every year. On Form W-12 there’s a box on line 11 asking you to confirm you know that paid preparers are required by law to keep a written information security plan. It’s easy to check it and keep going.

The law behind that box is the FTC Safeguards Rule, and it names tax preparation firms directly. It asks for more than a policy sitting in a drawer. Here’s what it means for an Ohio tax or accounting practice, without the legal language.

What the rule expects

The rule’s full list is long. Boiled down, it wants six things from a practice:

• One person in charge. That can be someone on staff or an outside provider, but your firm still owns the result and has to oversee whoever does it.
• A clear view of your risks. Look at what could go wrong with client data and how well you’re protected today, then revisit it as things change.
• Tight access. Each person gets only the client data their job needs, and everyone signing in to your systems uses multi-factor authentication.
• Protected data. Encrypt client information, know where all of it lives, and get rid of what you no longer need.
• Trained staff and careful vendors. Train your people, and make sure the companies that handle your client data can protect it, with that promise written into their contracts.
• A plan for a bad day, plus regular checks that your safeguards still work.

Most of that is what a well-run practice already half-does. The work is usually in writing it down and closing two or three gaps, not starting from nothing.

Small practices get a break. If your firm holds information on fewer than 5,000 people, some requirements drop away, including the written risk assessment, the written incident response plan and the annual report to owners. The protections themselves still apply. And the count covers everyone whose information you still keep, not just this season’s clients. Even if you qualify, keep an incident response plan anyway. When something goes wrong, you’ll want it written down before you need it.

If client data is stolen

Several people need to hear from you, and some of them on a deadline:

• The IRS, through your local Stakeholder Liaison rather than the general phone line. A quick report gives the IRS a chance to stop fake returns filed in your clients’ names.
• State tax agencies, through the Federation of Tax Administrators at StateAlert@taxadmin.org.
• The FTC, if unencrypted information on 500 or more people was taken. That notice is due within 30 days of finding out.
• Your clients. Ohio law requires notice to affected Ohio residents within 45 days at the latest. The IRS also suggests telling clients how to protect themselves, such as by getting an Identity Protection PIN.
• Your cyber insurance carrier, early. Your policy says how to report a claim, and some carriers want to choose who investigates.

Gaps worth checking first

Before you write anything new, look for these. They’re easy to miss and easy to fix:

• Multi-factor authentication is on for the tax software but not for email, or the other way around.
• Client documents live in more places than anyone listed: a scanner’s email folder, a shared mailbox, a personal laptop used in March.
• A former seasonal employee still has an account.
• Nobody has read the security terms in the software vendor’s contract.
• The written plan exists, but it describes the office as it was three years ago.

Writing the plan

You don’t have to start from a blank page. The IRS publishes a free template, Publication 5708, built for tax and accounting practices. Use it, then make sure the plan describes how your office really works. A template filled in with good intentions won’t help you after a breach.

There’s a bonus in Ohio. Under the Ohio Data Protection Act, a written security program that reasonably follows a recognized framework can give a business a legal defense in some data breach lawsuits, and the federal security rules behind the Safeguards Rule are on that list. Our Ohio Data Protection Act page explains how it works.

Our page for law and tax firms goes deeper on the written plan and what the rule asks of a practice. If you’d like help putting yours together, tell us how your practice is set up and we’ll tell you where we would start.

Sources

• 16 CFR Part 314, the FTC Safeguards Rule
• IRS Form W-12 and Publication 5708
• IRS: who tax pros should contact after a data theft or loss
• Ohio Revised Code 1349.19

TTS Cyber is an IT and cybersecurity company, not a law firm, and this article is not legal advice. It summarizes published rules so you can read them yourself. Whether a rule applies to your firm, and what it requires of you, are questions for your own attorney.