Accounting firms handle information that clients trust them to keep confidential. Social Security numbers, bank details, income records, payroll information, and tax documents are all part of everyday work.
Protecting that information involves two different responsibilities. Firms need to understand when taxpayer information can legally be used or shared, and they need appropriate security measures to prevent unauthorized access, theft, or loss.
IRS Section 7216 addresses the use and disclosure of tax return information. The FTC Safeguards Rule and related IRS guidance address broader responsibilities for protecting sensitive client data.
These requirements are connected, but they aren’t interchangeable. Understanding the difference helps accounting firms make better decisions about client privacy, technology, employee access, and cybersecurity.
What Is IRS Section 7216?
IRS Section 7216 is a provision of the Internal Revenue Code that restricts how tax return preparers use or disclose tax return information.
In general, it prohibits tax return preparers from knowingly or recklessly disclosing tax return information or using it for purposes other than preparing or assisting with a tax return, unless an applicable exception or valid taxpayer consent permits the activity.
This can affect situations that might otherwise seem like ordinary business decisions.
For example, a firm may want to use information from a client’s return to recommend an unrelated service, share client information with a referral partner, or provide data to an outside organization.
Before doing so, the firm needs to determine whether the proposed use or disclosure is permitted.
The IRS provides additional information about these rules through its Section 7216 Information Center.
Who Does Section 7216 Apply To?
Section 7216 generally applies to people and organizations involved in preparing income tax returns or providing services connected with that preparation.
Depending on their activities, this can include paid tax preparers, accounting firms providing tax preparation services, and certain service providers involved in the preparation process.
The rules are not limited to large accounting practices. A small CPA firm or independent tax preparation business can also have obligations under Section 7216.
However, not every service an accounting firm provides automatically falls under the same rules. Firms should evaluate how the requirements apply to their specific activities and information.
What Tax Return Information Is Protected Under Section 7216?
Tax return information includes more than the completed return submitted to the IRS.
It can include information supplied by a taxpayer or generated in connection with preparing a return.
Examples include:
- Social Security numbers and taxpayer identification numbers
- Income and expense records
- Bank account information
- Payroll and employment information
- Dependent information
- Business ownership details
- Deductions and credits
- Supporting tax documents
- Draft returns and preparation calculations
- Other information obtained or generated during the tax preparation process
This information may exist in several places, including tax preparation software, client portals, email accounts, cloud storage, shared folders, employee devices, and paper records.
That creates an important operational challenge: a firm cannot properly manage sensitive taxpayer information without knowing where it is stored and who can access it.
A structured approach to managed IT services for small and mid-sized businesses can help firms understand the systems supporting their daily operations, although legal compliance requires additional policies and procedures beyond IT management.
What Is the Difference Between Using and Disclosing Tax Return Information?
Section 7216 distinguishes between using taxpayer information and disclosing it.
The distinction matters because the rules and exceptions can depend on what the firm intends to do.
| Activity | What It Means | Example |
|---|---|---|
| Use | Applying tax return information for a particular purpose | Reviewing return information to identify a client who might benefit from an unrelated service |
| Disclosure | Making tax return information available to another person or organization | Sharing tax information with an outside referral partner |
| Permitted activity | A use or disclosure allowed under an applicable exception or valid consent | Sharing information as necessary for certain authorized return-preparation activities |
Not every use or disclosure requires separate taxpayer consent. Treasury regulations provide exceptions for specific circumstances, including certain activities connected with preparing returns.
However, firms shouldn’t assume that a general client relationship or ordinary engagement agreement automatically authorizes every additional use of tax information.
When Is Taxpayer Consent Required?
Taxpayer consent may be required when a proposed use or disclosure is not otherwise permitted under the applicable rules.
When consent is required, it must meet the relevant regulatory requirements. A general statement that a client agrees to information sharing may not be sufficient.
For example, firms should pay attention to the purpose of the consent, the information involved, the recipient, and any applicable requirements concerning how the consent is presented and recorded.
The rules are detailed enough that firms should have their consent procedures reviewed by qualified legal or tax compliance professionals.
For reference, the relevant provisions include Treasury Regulation § 301.7216-2, which addresses permitted uses and disclosures without taxpayer consent, and § 301.7216-3, which addresses consent requirements.
How Is Section 7216 Different From Cybersecurity Compliance?
This is one of the most important distinctions for accounting firms to understand.
Section 7216 primarily addresses whether a firm is permitted to use or disclose tax return information.
Cybersecurity requirements address how the firm protects information from unauthorized access, theft, alteration, and other risks.
| Area | Primary Concern | Practical Example |
|---|---|---|
| IRS Section 7216 | Permitted use and disclosure of tax return information | Whether taxpayer information can be shared with a third party |
| FTC Safeguards Rule | Protection of covered customer information | Whether the firm has an appropriate information security program |
| IRS security guidance | Practical protection of taxpayer data | Written security planning, employee training, and incident preparation |
| Internal cybersecurity controls | Day-to-day technical protection | MFA, endpoint security, access restrictions, and backups |
A firm could have a secure client portal and still use taxpayer information for an unauthorized purpose.
Likewise, a firm might obtain valid consent to share information but fail to protect that information adequately once it is stored or transmitted.
Both privacy procedures and cybersecurity controls are necessary.
For a broader explanation of how technical safeguards fit together, see our complete guide to cybersecurity for small businesses.
What Are the IRS Security Requirements for Tax Preparers?
The IRS emphasizes that tax professionals must protect taxpayer information and maintain an appropriate Written Information Security Plan, or WISP.
These responsibilities are closely connected to the Gramm-Leach-Bliley Act and the FTC Safeguards Rule, rather than being requirements created solely by Section 7216.
The IRS provides practical guidance in Publication 4557: Safeguarding Taxpayer Data.
For accounting firms, important security responsibilities include:
- Identifying and assessing risks to client information
- Establishing written information security policies
- Controlling access to sensitive systems and records
- Protecting employee devices and business networks
- Training employees to recognize security threats
- Evaluating service providers that handle client information
- Monitoring and testing security safeguards
- Preparing for security incidents and data loss
The specific measures required depend on the firm’s circumstances and the regulations that apply.
These responsibilities should be part of normal business operations, not something reviewed only when tax season approaches.
What Is the FTC Safeguards Rule, and Does It Apply to Accounting Firms?
The FTC Safeguards Rule requires covered financial institutions to develop, implement, and maintain an information security program designed to protect customer information.
Tax preparation businesses are among the types of organizations covered by the rule.
For accounting firms, applicability and specific obligations depend on the activities performed and the relevant regulatory provisions.
The rule addresses administrative, technical, and physical safeguards, including risk assessment, access controls, employee training, service-provider oversight, and security monitoring.
Key FTC Safeguards Rule Requirements
| Security Area | What Firms Should Address |
|---|---|
| Security program management | Assign responsibility for coordinating the information security program |
| Risk assessment | Identify reasonably foreseeable threats to customer information |
| Access controls | Limit access according to legitimate business needs |
| Authentication | Implement appropriate authentication protections, including MFA where required |
| Encryption | Protect covered information according to applicable requirements |
| Employee training | Prepare staff to recognize and respond to security risks |
| Vendor oversight | Evaluate providers and require appropriate contractual safeguards |
| Monitoring and testing | Review whether security controls are working |
| Incident response | Establish procedures for identifying and responding to security incidents |
The FTC also has notification requirements for certain security incidents involving the unauthorized acquisition of unencrypted information affecting at least 500 consumers. Covered organizations generally must notify the FTC no later than 30 days after discovering a qualifying notification event.
The FTC explains the requirements, exceptions, and applicability details in its official Safeguards Rule guidance.
What Is a Written Information Security Plan (WISP)?
A Written Information Security Plan is a documented approach to identifying, managing, and reducing risks to sensitive information.
For tax and accounting professionals subject to the applicable security requirements, a WISP is an important part of meeting their responsibilities.
A useful WISP should reflect the firm’s actual operations rather than simply repeat generic security policies.
For example, a small accounting practice with five employees, one office, and cloud-based tax software may have different risks and procedures from a larger firm with several locations and seasonal staff.
What Should an Accounting Firm’s WISP Include?
A practical plan should address:
- Responsibility: Who manages the firm’s information security program?
- Risk assessment: What information needs protection, and where are the main vulnerabilities?
- Access management: Who can access tax records, financial systems, and administrative accounts?
- Technical safeguards: How are devices, networks, applications, and stored data protected?
- Employee training: What security practices must staff understand and follow?
- Vendor oversight: How are third parties evaluated and monitored?
- Incident response: What happens if client information is exposed or systems are compromised?
- Review and updates: How will the firm evaluate whether its safeguards remain effective?
The IRS offers Publication 5708, which provides guidance for creating a WISP tailored to a tax or accounting practice.
A WISP should also be reviewed when the firm introduces new software, changes its staffing model, expands remote access, or experiences a significant security event.
This is where an IT roadmap and technology lifecycle management plan can be useful. It helps firms identify outdated systems and schedule improvements that support their security objectives.
What Cybersecurity Controls Should Accounting Firms Prioritize?
Accounting firms don’t need every available security product. They need appropriate safeguards that work together to protect their actual environment.
1. Multi-Factor Authentication and Access Control
Employees should use individual accounts, with access limited to the systems and information needed for their work.
MFA should be enforced on supported business systems, particularly email, remote access, tax software, financial applications, and administrator accounts.
Our guide to MFA for business explains the different authentication methods and why phishing-resistant options are particularly valuable for sensitive accounts.
Firms should also review access when employees change roles or leave the organization.
2. Endpoint Protection and Security Updates
Accounting staff often work with sensitive information on laptops, desktops, and mobile devices.
Those devices should be appropriately managed, protected against malware, encrypted where required, and kept up to date.
Outdated systems can create security gaps, especially when they are needed to run older tax or accounting applications.
3. Secure Email and Client File Sharing
Tax records and financial documents should be exchanged through approved, secure methods.
A client portal or appropriate encrypted file-sharing system can help reduce reliance on ordinary email attachments.
Employees should also know how to recognize fake document-sharing notifications, impersonation attempts, and fraudulent requests for sensitive information.
Regular phishing simulations and security awareness training can help firms reinforce those habits.
4. Backup and Disaster Recovery
Accounting firms depend on access to tax records, client documents, and business applications, particularly during filing deadlines.
Backups should be protected against unauthorized changes, separated appropriately from production systems, and tested to confirm that information can actually be restored.
A ransomware attack or major system failure can create serious operational problems if recovery procedures haven’t been tested.
Our article on ransomware prevention for small businesses explains why protected backups and recovery planning matter alongside preventive security controls.
5. Security Monitoring
Security tools are more useful when alerts are reviewed and acted upon.
Firms should consider how suspicious sign-ins, malware detections, unusual account activity, and other potential security events will be identified and investigated.
Traditional 24/7 IT monitoring can help identify infrastructure and availability problems, while security-specific monitoring focuses on possible threats and unauthorized activity.
Both can contribute to a more reliable technology environment, but firms should understand exactly which services and alerts their provider covers.
6. Vendor and Third-Party Access Management
Accounting firms rely on tax software providers, cloud platforms, payroll systems, document management applications, and IT service providers.
Before granting a vendor access to client information, firms should understand what access is needed, how it will be protected, and what happens when the relationship ends.
Vendor security reviews are particularly important when outside organizations handle sensitive taxpayer information.
Firms must also consider whether a proposed disclosure is permitted under Section 7216, rather than assuming that a vendor’s technical security controls resolve the legal question.
What Are the Biggest Cybersecurity Risks for Accounting Firms?
Many accounting firm security problems arise from ordinary workflows rather than unusual technical scenarios.
| Risk | Why It Matters | Practical Safeguard |
|---|---|---|
| Seasonal employees | Temporary staff may receive access quickly during busy periods | Individual accounts, limited permissions, scheduled offboarding |
| Tax-season pressure | Employees may rush through unusual requests | Clear verification procedures and employee training |
| Remote work | Sensitive information is accessed outside the office | MFA, managed devices, and secure connectivity |
| Shared accounts | Difficult to determine who accessed or changed information | Unique user identities and access logging |
| Email impersonation | Attackers may pose as clients, vendors, or firm leadership | Email security and independent verification |
| Excessive data retention | More retained information can increase breach exposure | Documented retention and secure disposal procedures |
| Outdated applications | Unsupported systems may have unaddressed vulnerabilities | Regular software reviews and lifecycle planning |
The goal isn’t to make every employee a cybersecurity expert. It’s to establish procedures that are practical enough to follow during normal work and busy tax periods.
Firms with limited internal IT resources may benefit from co-managed IT services or outsourced support, depending on how much technology management they already handle internally.
What Should an Accounting Firm Do After a Suspected Data Breach?
A suspected compromise involving taxpayer information should be treated as both a security incident and a potential reporting or compliance issue.
The appropriate response depends on what happened, what information may be involved, and which laws or contractual obligations apply.
A practical initial response includes:
- Contain the incident. Restrict affected accounts, devices, or connections without unnecessarily destroying evidence.
- Contact the appropriate specialists. Involve the firm’s IT/security team, legal or compliance advisers, and other relevant professionals.
- Determine what happened. Identify affected systems, information, accounts, and the likely scope of unauthorized access.
- Preserve evidence. Retain relevant logs and records needed for investigation and reporting.
- Evaluate reporting obligations. Determine whether IRS, FTC, state-law, contractual, or other notifications are required.
- Restore systems safely. Confirm that affected systems are secure before returning them to normal operation.
- Review the incident. Update procedures and safeguards based on the findings.
The IRS recommends that tax professionals experiencing data theft contact their local IRS Stakeholder Liaison and follow applicable reporting guidance.
A documented response plan makes these decisions easier when an incident occurs.
CPA Cybersecurity and Section 7216 Readiness Checklist
Accounting firm owners and managers can use this checklist to identify areas that may need additional attention.
| Question | Status to Review |
|---|---|
| Do we have a current Written Information Security Plan? | Yes / No / Needs Review |
| Have we identified where taxpayer information is stored? | Yes / No / Needs Review |
| Are Section 7216 use, disclosure, and consent procedures documented? | Yes / No / Needs Review |
| Is MFA enforced on important business accounts? | Yes / No / Needs Review |
| Are employee permissions reviewed regularly? | Yes / No / Needs Review |
| Are seasonal and former employee accounts promptly disabled? | Yes / No / Needs Review |
| Are company devices encrypted, updated, and protected? | Yes / No / Needs Review |
| Do employees use approved methods for exchanging sensitive files? | Yes / No / Needs Review |
| Are backups protected and recovery procedures tested? | Yes / No / Needs Review |
| Are third-party service providers reviewed appropriately? | Yes / No / Needs Review |
| Do employees receive security awareness training? | Yes / No / Needs Review |
| Do we have a documented incident-response and reporting process? | Yes / No / Needs Review |
A checklist is a useful starting point, but it doesn’t establish compliance by itself. Firms should evaluate their specific obligations and confirm that documented procedures are followed in practice.
Frequently Asked Questions About IRS Section 7216 and Accounting Firm Cybersecurity
What does IRS Section 7216 cover?
Section 7216 restricts how tax return preparers may use or disclose tax return information. Certain uses and disclosures are permitted under regulatory exceptions or with valid taxpayer consent.
Does Section 7216 require accounting firms to use MFA?
Section 7216 is primarily concerned with the use and disclosure of tax return information, not prescribing MFA as a general cybersecurity control. MFA requirements may arise under other applicable rules, including the FTC Safeguards Rule.
Do accounting firms need a Written Information Security Plan?
Tax preparation firms subject to applicable federal safeguards requirements generally must maintain a written information security program. The IRS specifically emphasizes the need for tax professionals to develop and maintain a WISP appropriate to their operations.
Does Section 7216 apply to sharing information with outside vendors?
It can. Whether a particular disclosure to a vendor is permitted depends on the circumstances and applicable regulatory exceptions or consent requirements. Firms should review the arrangement rather than assume that a vendor relationship automatically permits sharing.
What is the difference between Section 7216 and the FTC Safeguards Rule?
Section 7216 regulates certain uses and disclosures of tax return information. The FTC Safeguards Rule establishes information security requirements for covered financial institutions, including tax preparation businesses.
What should accounting firms prioritize for cybersecurity?
Important priorities include MFA, endpoint protection, secure file sharing, access management, backups, employee training, vendor oversight, monitoring, and incident-response planning.
Can an IT provider make an accounting firm compliant?
An IT provider can help implement and manage technical safeguards, but legal and regulatory compliance also depends on policies, business practices, documentation, oversight, and the firm’s specific obligations. Legal or compliance professionals should evaluate those requirements.
Protecting Taxpayer Information Requires More Than One Policy
IRS Section 7216, the FTC Safeguards Rule, and related IRS security guidance address different parts of a shared responsibility: protecting sensitive taxpayer information.
For accounting firms, the practical challenge is bringing privacy procedures, employee practices, software, vendor access, and cybersecurity controls together.
At Techmentum, we help accounting firms identify technology risks, improve account and device security, protect business systems, and strengthen the safeguards supporting client information.
If your firm is reviewing its cybersecurity practices or preparing to update its security plan, schedule a free consultation with Techmentum to discuss your current environment and potential improvements.
This article provides general educational information and is not legal or tax advice. Firms should consult qualified legal or compliance professionals to determine how Section 7216, the FTC Safeguards Rule, and other requirements apply to their operations.
