Grady has hit capacity. He runs Lighthouse Accounting LLC, a solo firm that provides tax preparation, planning, representation, bookkeeping, payroll, and some attestation work. To grow, he could hire seasonal preparers, outsource work to a contractor, or merge into a colleague’s firm.
Those staffing and business decisions are also federal compliance questions.
Giving a contractor access to a client portal, forwarding a client email, or sharing a client list with a potential buyer may trigger Sections 7216 and 6713 of the Internal Revenue Code. A knowing or reckless violation of Section 7216 is a misdemeanor punishable by up to one year in prison, prosecution costs, and ordinarily a fine of up to $1,000. The maximum fine rises to $100,000 when the disclosure or use is connected with a crime involving the misappropriation of another person’s taxpayer identity. Section 6713 separately imposes a civil penalty of $250 per unauthorized disclosure or use, capped at $10,000 per calendar year; for identity-theft-related conduct, those amounts rise to $1,000 per disclosure or use and $50,000 per calendar year. Unlike Section 7216, Section 6713 contains no express knowing-or-reckless requirement, and the same conduct can trigger both provisions.
In Episode 35 of Tax in Action, Jeremy Wells, EA, CPA, uses Grady’s choices to explain a practical three-question test:
- Is this tax return information?
- Is a use or disclosure occurring?
- Does an exception allow it without the taxpayer’s consent?
Tax return information goes beyond the completed return
Generally, Section 7216 prohibits a tax return preparer from knowingly or recklessly disclosing or using a taxpayer’s tax return information for a purpose other than preparing the return, unless the Code or regulations authorize the disclosure or use.
For these rules, a tax return includes an original or amended income tax return imposed under Chapter 1 of the Code. That includes Forms 1040, 1120, and 1041. Form 1065 and employment tax returns such as Forms 940 and 941 are not automatically covered because they are not returns of income tax imposed under Chapter 1. Information from those filings may nevertheless become protected tax return information when furnished in connection with preparing a covered income tax return.
The term “tax return preparer” is also broad. It can include people who prepare or assist with returns, their employees, and providers of auxiliary services. Examples may include tax software companies, e-file providers, tax-focused publishers, and professional liability insurers. Creditors, office landlords, and people who provide information at a taxpayer’s request or provide services only incidentally related to return preparation generally are not preparers.
Most importantly, “tax return information” includes information furnished in any form for, or in connection with, preparing a return. It can include:
- Names, addresses, and taxpayer identification numbers
- Documents supplied by the client
- Calculations and recommendations produced by the preparer
- IRS acceptance notices and e-file rejections
- Statistical compilations, even when anonymized
The client’s reasons for providing the information play a part. A profit and loss statement given to a business coach to improve operations may not be tax return information. The same statement given to a tax professional for return preparation may be protected.
That purpose-based definition leads to the next question: What counts as a use or disclosure?
A disclosure doesn’t require sending a document
A use occurs when a preparer relies on tax return information to take or permit an action. For example, if you identify a client’s IRA eligibility while preparing a return and recommend a contribution, you’ve used the information. Classifying an action as a use does not mean it is prohibited; rather, ask whether the Code, regulations, or valid consent authorize the use.
A disclosure occurs when you make tax return information known to another person in any manner. Examples include:
- Emailing a return
- Granting access to tax software or a client portal
- Sharing a client folder
- Forwarding an email containing client information
- Allowing someone to see information on your screen
Some disclosures happen without an intentional file transfer, so access itself matters.
Once you identify a use or disclosure, you must determine whether an exception applies.
Employees, contractors, and buyers face different rules
Grady’s seasonal employees generally may access client information without written consent if Grady and the employees are based in the United States and work for the same firm. If Grady is based in the U.S. and hires an employee overseas, however, he needs written consent from each affected taxpayer before providing access. For Form 1040-series taxpayers, Social Security numbers generally must be masked or redacted before a foreign disclosure unless both the U.S. and foreign preparers maintain adequate data protection safeguards and the consent contains the prescribed language.
Donna, an independent bookkeeper, presents a different problem. If Grady brings her in as an outside contractor and gives her access to his portal, she isn’t an officer, employee, or member of his firm. Grady may disclose information without consent under the preparer-to-preparer exception only if Donna qualifies as another tax return preparer located in the United States, including as a qualifying auxiliary-service provider. The disclosure must be necessary for preparing or assisting with a return or providing auxiliary services connected with return preparation, and Donna may not make substantive determinations—an analysis, interpretation, or application of the law—or provide advice affecting the reported tax liability. If those conditions are not satisfied, Grady must obtain valid written consent before giving Donna access to the portal.
He could instead refer the bookkeeping clients directly to Donna. If the clients give their information to Donna themselves, Grady isn’t making the disclosure. But, Grady should not give Donna client names or contact information directly without consent or another applicable exception, because doing so would itself disclose tax return information, and the client-list exception does not authorize solicitation of services other than tax return preparation.
A firm sale has its own exception. The regulations permit certain disclosures without individual consent in connection with the sale or other disposition of a tax return preparation business. Grady may share a list containing client names, addresses, and tax form numbers without individual consent if the potential buyer first signs a confidentiality agreement. That agreement must protect the information and prohibit its use or disclosure for any purpose other than due diligence for the purchase.
Other exceptions cover certain narrow and fact-specific disclosures to software and e-file providers, related taxpayers without a harmful conflict, peer reviewers, courts, regulators, law enforcement, and successor preparers after death or incapacity.
The consent rules are critical when no exception applies.
Consent must come before the disclosure
Taxpayer consent must be written, knowing, voluntary, and received before the use or disclosure. A signature obtained on Tuesday can’t cure a disclosure made on Monday.
Valid consent generally identifies:
- The preparer and taxpayer
- The purpose and recipient, or the authorized use
- The information being disclosed or used
- Any applicable disclosure to a preparer outside the United States
- The taxpayer’s signature and date
The preparer must give the taxpayer a copy when the consent is signed. One document may authorize multiple uses or multiple disclosures, but not both, and each must be specifically identified. For taxpayers not filing Form 1040-series returns, a consent may use another format, including an engagement letter, provided it satisfies the regulation’s core requirements, and the separate-document rule does not apply. A consent may specify its duration; if it does not, it remains effective for one year from the date of signature.
Generally, conditioning services on the taxpayer’s consent makes the consent invalid. A narrow exception permits a preparer to condition tax return preparation services—or change their terms or cost—when consent is needed to disclose information to another preparer for services connected with preparing the taxpayer’s return.
Apply the same test to every workflow
Section 7216 sets a legal minimum, but it’s not a complete privacy program and is only one part of a firm’s privacy and data security obligations. Jeremy recommends analyzing potential disclosures in the same order every time:
- Determine whether the information qualifies as tax return information
- Decide whether a use or disclosure is actually occurring
- Check the regulations for an exception
- If no exception applies, get valid written consent in advance
Apply that test before hiring a seasonal preparer, outsourcing client work, or opening due diligence. Then listen to the full Tax in Action episode for Jeremy’s complete walkthrough of the Lighthouse Accounting case study.
