Jeremy Wells

Grady, the owner of Lighthouse Accounting LLC in the episode’s case study, has a capacity problem. In the previous episode of Tax in Action, he considered hiring employees, outsourcing work, or selling his firm. Now he’s asking, “What if technology could solve the problem?”

New software might automate some of the work. AI might reduce the need for seasonal staff. But adding technology creates its own risks, especially when client information leaves the firm.

In this episode, host Jeremy Wells, EA, CPA, explains why Section 7216 is only the starting point. Tax professionals must also consider the Gramm-Leach-Bliley Act (GLBA), the FTC Safeguards Rule, their written information security program (WISP), vendor oversight, SOC 2 reports, and the professional duties that apply when AI helps perform the work.

Three questions connect these rules:

1. May we share the client’s information?
2. Are we protecting it appropriately?
3. Is a human still exercising professional judgment?

Section 7216 is only the first layer

Section 7216 generally prohibits a tax return preparer from using or disclosing tax return information unless an exception applies or the taxpayer provides written consent.

One exception covers certain “auxiliary services.” Certain disclosures for auxiliary services connected with tax return preparation are permitted without taxpayer consent. These services can include processing, storage, transmission, and software support. But the exception is not blanket permission to share client information with any technology provider. Firms must evaluate the services performed, where information will be disclosed, and the conditions of the applicable exception. Special requirements can apply to overseas disclosures, substantive tax determinations, and certain software-support contractors.

Without that exception, Jeremy notes, firms might be stuck using pencil and paper.

But Section 7216 only governs the use and disclosure of tax return information. It doesn’t tell you whether your firm or the provider has adequate safeguards. And disclosure can include both an intentional transmission and an unauthorized release, such as a data breach or someone viewing client information over your shoulder.

Once you determine that a disclosure is allowed, you must move to protecting the information.

GLBA creates the duty to protect client information

The Gramm-Leach-Bliley Act says financial institutions have an “affirmative and continuing obligation” to respect customer privacy and protect nonpublic personal information. It calls for administrative, technical, and physical safeguards that:

1. Preserve the security and confidentiality of customer records
2. Protect against expected threats or hazards
3. Prevent unauthorized access that could cause substantial harm or inconvenience

GLBA appears in Title 15 of the U.S. Code rather than the Internal Revenue Code. It doesn’t specifically name accountants or tax preparers. Instead, the FTC’s regulations treat tax preparation firms as financial institutions because they engage in financial activities.

That means strict compliance with Section 7216 may not satisfy a firm’s broader information-security obligations. For those requirements, we must look at the FTC Safeguards Rule.

Your WISP should guide your technology choices

The FTC Safeguards Rule, found at 16 CFR Part 314, requires covered firms to develop, implement, and maintain a written information security program. The program must fit the firm’s size and complexity, the nature and scope of its work, and the sensitivity of the information it holds.

A solo practitioner and a national firm with 5,000 employees won’t need identical controls. That is why a generic WISP template isn’t enough. The document must reflect how your firm operates.

A WISP should address areas such as:

• Risk assessment and security safeguards
• Incident response
• Employee training
• Vendor selection and oversight
• Document retention and secure disposal
• Ongoing monitoring and updates

Some specific requirements have a small-firm exception. Firms maintaining customer information concerning fewer than 5,000 consumers are exempt from certain provisions, including the prescribed written incident response plan. They must still maintain a written information security program, and planning how to respond to an incident remains a sound practice.

The firm must also designate a Qualified Individual to oversee and implement the program. That person may work within the firm or for an affiliate or service provider, such as an outside IT firm. If the role is outsourced, the firm retains responsibility for compliance and must designate a senior employee to oversee the outside Qualified Individual. The affiliate or service provider must also maintain an information security program that protects the firm.

These duties apply whether your firm stores records in the cloud or in locked filing cabinets. Paper records still create questions about access, retention, destruction, and oversight of shredding providers.

Most importantly, software should conform to the WISP, not the other way around. Before adopting a new tool, ask what risks it creates, how you’ll manage those risks, who will oversee implementation, and whether you need to update the WISP. Because technology keeps changing, the WISP must be a living document.

That ongoing process also requires firms to evaluate the vendors behind their technology.

A SOC 2 report provides evidence, not certainty

The Safeguards Rule requires firms to take reasonable steps to select and retain service providers capable of maintaining appropriate safeguards, require those safeguards by contract, and periodically assess providers based on their risks and the continued adequacy of their safeguards.

Most firm owners can’t personally inspect a vendor’s servers, personnel, or access controls. A SOC 2 report helps fill that gap. In a SOC 2 engagement, an independent CPA examines controls related to one or more AICPA Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy.

There are two main report types:

• Type 1 evaluates the design of controls as of a specified date
• Type 2 evaluates both the design and operating effectiveness of controls over a period

A Type 2 report is generally more useful for an established vendor. Still, neither report certifies that a vendor is breach-proof. As Jeremy explains, it is “just one piece of evidence.” Firms should check the report type, the date or period covered, and whether the vendor continues to maintain its controls.

Vendor reports help with oversight, but they don’t transfer accountability away from the firm. The same principle applies when the technology uses AI.

Treat AI like a junior staff member

On June 24, 2026, the IRS Office of Professional Responsibility published OPR Alert 2026-19, its first guidance on artificial intelligence. Although the alert did not amend Circular 230 or create a separate set of AI rules, it explained how existing duties apply to AI-assisted work.

Those duties include due diligence, competence, supervision, written advice, and fees. Practitioners must still review client inputs and firm outputs, understand a tool’s limits, supervise AI-assisted workflows, and ensure written advice meets professional standards. 

The alert also cautions against billing for time not actually spent or double billing for AI-assisted tasks, and calls for transparency about AI-related cost savings. Jeremy emphasizes that firms using time- or cost-based billing should review whether their charges fairly reflect those efficiencies under the client agreement.

Jeremy recommends treating AI like a junior staff member, not an unsupervised practitioner or business partner. AI can draft client messages, support research, assist with return preparation, or perform bookkeeping tasks. It can also make mistakes, produce unsupported answers, and tell users what it thinks they want to hear.

Jeremy’s point is that professional judgment and responsibility remain with the human practitioner.

Keep three questions in every technology review

For Grady, choosing technology to expand his firm’s capacity means evaluating more than how much time a tool might save. He needs to establish whether he may share client information, how it will be protected, and who will review the work. The same three questions belong in every firm’s technology review:

• May we share the information this way? Apply Section 7216 and determine whether an exception permits the proposed use or disclosure or valid taxpayer consent is required.
• Are we protecting it appropriately? Follow a firm-specific WISP and continue monitoring vendors.
• Are we still exercising professional judgment? Review the work and take responsibility for the result.

For Jeremy’s complete explanation and the rest of Grady’s case study, listen to Episode 36 of Tax in Action.

Grady has hit capacity. He runs Lighthouse Accounting LLC, a solo firm that provides tax preparation, planning, representation, bookkeeping, payroll, and some attestation work. To grow, he could hire seasonal preparers, outsource work to a contractor, or merge into a colleague’s firm.

Those staffing and business decisions are also federal compliance questions.

Giving a contractor access to a client portal, forwarding a client email, or sharing a client list with a potential buyer may trigger Sections 7216 and 6713 of the Internal Revenue Code. A knowing or reckless violation of Section 7216 is a misdemeanor punishable by up to one year in prison, prosecution costs, and ordinarily a fine of up to $1,000. The maximum fine rises to $100,000 when the disclosure or use is connected with a crime involving the misappropriation of another person’s taxpayer identity. Section 6713 separately imposes a civil penalty of $250 per unauthorized disclosure or use, capped at $10,000 per calendar year; for identity-theft-related conduct, those amounts rise to $1,000 per disclosure or use and $50,000 per calendar year. Unlike Section 7216, Section 6713 contains no express knowing-or-reckless requirement, and the same conduct can trigger both provisions.

In Episode 35 of Tax in Action, Jeremy Wells, EA, CPA, uses Grady’s choices to explain a practical three-question test:

1. Is this tax return information?
2. Is a use or disclosure occurring?
3. Does an exception allow it without the taxpayer’s consent?

Tax return information goes beyond the completed return

Generally, Section 7216 prohibits a tax return preparer from knowingly or recklessly disclosing or using a taxpayer’s tax return information for a purpose other than preparing the return, unless the Code or regulations authorize the disclosure or use.

For these rules, a tax return includes an original or amended income tax return imposed under Chapter 1 of the Code. That includes Forms 1040, 1120, and 1041. Form 1065 and employment tax returns such as Forms 940 and 941 are not automatically covered because they are not returns of income tax imposed under Chapter 1. Information from those filings may nevertheless become protected tax return information when furnished in connection with preparing a covered income tax return.

The term “tax return preparer” is also broad. It can include people who prepare or assist with returns, their employees, and providers of auxiliary services. Examples may include tax software companies, e-file providers, tax-focused publishers, and professional liability insurers. Creditors, office landlords, and people who provide information at a taxpayer’s request or provide services only incidentally related to return preparation generally are not preparers.

Most importantly, “tax return information” includes information furnished in any form for, or in connection with, preparing a return. It can include:

• Names, addresses, and taxpayer identification numbers
• Documents supplied by the client
• Calculations and recommendations produced by the preparer
• IRS acceptance notices and e-file rejections
• Statistical compilations, even when anonymized

The client’s reasons for providing the information play a part. A profit and loss statement given to a business coach to improve operations may not be tax return information. The same statement given to a tax professional for return preparation may be protected.

That purpose-based definition leads to the next question: What counts as a use or disclosure?

A disclosure doesn’t require sending a document

A use occurs when a preparer relies on tax return information to take or permit an action. For example, if you identify a client’s IRA eligibility while preparing a return and recommend a contribution, you’ve used the information. Classifying an action as a use does not mean it is prohibited; rather, ask whether the Code, regulations, or valid consent authorize the use.

A disclosure occurs when you make tax return information known to another person in any manner. Examples include:

• Emailing a return
• Granting access to tax software or a client portal
• Sharing a client folder
• Forwarding an email containing client information
• Allowing someone to see information on your screen

Some disclosures happen without an intentional file transfer, so access itself matters.

Once you identify a use or disclosure, you must determine whether an exception applies.

Employees, contractors, and buyers face different rules

Grady’s seasonal employees generally may access client information without written consent if Grady and the employees are based in the United States and work for the same firm. If Grady is based in the U.S. and hires an employee overseas, however, he needs written consent from each affected taxpayer before providing access. For Form 1040-series taxpayers, Social Security numbers generally must be masked or redacted before a foreign disclosure unless both the U.S. and foreign preparers maintain adequate data protection safeguards and the consent contains the prescribed language.

Donna, an independent bookkeeper, presents a different problem. If Grady brings her in as an outside contractor and gives her access to his portal, she isn’t an officer, employee, or member of his firm. Grady may disclose information without consent under the preparer-to-preparer exception only if Donna qualifies as another tax return preparer located in the United States, including as a qualifying auxiliary-service provider. The disclosure must be necessary for preparing or assisting with a return or providing auxiliary services connected with return preparation, and Donna may not make substantive determinations—an analysis, interpretation, or application of the law—or provide advice affecting the reported tax liability. If those conditions are not satisfied, Grady must obtain valid written consent before giving Donna access to the portal.

He could instead refer the bookkeeping clients directly to Donna. If the clients give their information to Donna themselves, Grady isn’t making the disclosure. But Grady should not give Donna client names or contact information directly without consent or another applicable exception, because doing so would itself disclose tax return information, and the client-list exception does not authorize solicitation of services other than tax return preparation.

A firm sale has its own exception. The regulations permit certain disclosures without individual consent in connection with the sale or other disposition of a tax return preparation business. Grady may share a list containing client names, addresses, and tax form numbers without individual consent if the potential buyer first signs a confidentiality agreement. That agreement must protect the information and prohibit its use or disclosure for any purpose other than due diligence for the purchase.

Other exceptions cover certain narrow and fact-specific disclosures to software and e-file providers, related taxpayers without a harmful conflict, peer reviewers, courts, regulators, law enforcement, and successor preparers after death or incapacity.

The consent rules are critical when no exception applies.

Consent must come before the disclosure

Taxpayer consent must be written, knowing, voluntary, and received before the use or disclosure. A signature obtained on Tuesday can’t cure a disclosure made on Monday.

Valid consent generally identifies:

• The preparer and taxpayer
• The purpose and recipient, or the authorized use
• The information being disclosed or used
• Any applicable disclosure to a preparer outside the United States
• The taxpayer’s signature and date

The preparer must give the taxpayer a copy when the consent is signed. One document may authorize multiple uses or multiple disclosures, but not both, and each must be specifically identified. For taxpayers not filing Form 1040-series returns, a consent may use another format, including an engagement letter, provided it satisfies the regulation’s core requirements, and the separate-document rule does not apply. A consent may specify its duration; if it does not, it remains effective for one year from the date of signature.

Generally, conditioning services on the taxpayer’s consent makes the consent invalid. A narrow exception permits a preparer to condition tax return preparation services—or change their terms or cost—when consent is needed to disclose information to another preparer for services connected with preparing the taxpayer’s return.

Apply the same test to every workflow

Section 7216 sets a legal minimum, but it’s not a complete privacy program and is only one part of a firm’s privacy and data security obligations. Jeremy recommends analyzing potential disclosures in the same order every time:

1. Determine whether the information qualifies as tax return information
2. Decide whether a use or disclosure is actually occurring
3. Check the regulations for an exception
4. If no exception applies, get valid written consent in advance

Apply that test before hiring a seasonal preparer, outsourcing client work, or opening due diligence. Then listen to the full Tax in Action episode for Jeremy’s complete walkthrough of the Lighthouse Accounting case study.

Jessica wants out of Lighthouse LLC. After several years of losses, her partner Seth remains committed, but she is done. If Seth pays her $10,000 for her interest, the transaction may look small, but it isn’t.

The transaction also relieves Jessica of her $40,000 share of partnership liabilities. For tax purposes, that debt relief helps produce a $50,000 amount realized. The check alone doesn’t tell the whole story.

In a recent episode of Tax in Action, Jeremy Wells, EA, CPA, closes his four-part partnership series by connecting outside basis, distributions, and dispositions. These topics belong together because outside basis helps determine whether distributions are taxable and how much gain or loss a partner recognizes when leaving.

Outside basis belongs to the partner

Outside basis is a partner’s adjusted tax basis in the partnership interest. It is not the partnership’s basis in its assets, and it is not the partner’s capital account.

A capital account is a separate partnership-level measure of a partner’s equity. It may be negative and generally does not include the partner’s share of liabilities or partner-level basis adjustments.

Jeremy emphasizes individual partners must maintain the record. “Individual partners, not partnerships, are responsible for tracking the partner’s basis in their partnership interest.”

Initial outside basis may come from:

• The adjusted basis of property contributed under Section 722
• The cost of a purchased partnership interest
• Section 1014 basis for an inherited interest
• Section 1015 basis for an interest received by gift

Basis then increases for income, gains, additional contributions, and increases in the partner’s share of liabilities. It decreases for distributions, losses, deductions, and reductions in the partner’s liability share.

The order matters, too. Positive adjustments come first, followed by nonliquidating distributions and then losses and deductions. This ordering generally preserves tax-free distribution treatment when possible. You normally calculate basis at year-end, but if the partner disposes of their interest during the year, you calculate it on the disposition date.

That leads to a practical warning. Tax software may produce a basis worksheet, but the worksheet might not appear if you didn’t enter an original basis. If the records are missing, practitioners may need to reconstruct basis using prior K-1s, capital account information, contributions, distributions, and annual liability changes. The partner carries the burden of proving enough basis to deduct losses.

Section 704(d) suspends losses above basis. They can become deductible if income or a contribution later restores basis. For an individual, outside basis is only the first limitation. Sections 465, 469, and 461(l) may also restrict losses. Suspended Section 704(d) losses generally don’t transfer to another taxpayer, so an exit can leave them unused permanently.

Debt relief counts even when no cash changes hands

Partnership liabilities make outside basis especially important. Section 752 treats an increase in a partner’s share of partnership debt like a cash contribution. It treats a decrease like a cash distribution.

The rule reflects the economics. When a transaction relieves a departing partner of debt exposure, that partner receives a financial benefit even if no money changes hands.

Liability allocations don’t automatically follow ownership percentages. You generally allocate recourse debt to the partner or related person who bears the economic risk of loss, such as through a qualifying guarantee or pledged collateral. Nonrecourse debt follows a different, more complex allocation process.

For Jessica, $0 of tax-basis capital plus a $40,000 liability share (assuming no other partner-level basis adjustments) gives her an assumed $40,000 outside basis. You treat her as receiving $40,000 when that liability share falls to zero.

Hot assets can convert capital gain into ordinary income

A sale or exchange of a partnership interest generally produces capital gain or loss under Section 741. Section 751(a) creates an important exception for “hot assets,” including unrealized receivables and appreciated inventory.

Having receivables or inventory on the balance sheet alone does not settle the issue. We must examine whether the partnership has unrealized receivables or appreciated inventory and whether the transaction is a sale, exchange, or disproportionate distribution covered by Section 751.

Without Section 751, a partner can sell an interest priced partly on future ordinary income and report the entire gain as capital. The rule instead treats the portion tied to hot assets as ordinary.

Suppose Seth pays Jessica $10,000. Her amount realized is $50,000 ($10,000 of cash plus $40,000 of debt relief). After subtracting her $40,000 outside basis, she has a preliminary gain of $10,000. If a hypothetical sale of Lighthouse’s hot assets would allocate $6,000 of ordinary income to Jessica, the result is $6,000 of ordinary gain and $4,000 of capital gain.

You might not see that exposure looking at a cash-basis balance sheet. Practitioners need to examine the tax bases and fair market values of the underlying assets.

Four exits follow different paths but similar arithmetic

Jessica has $40,000 of assumed outside basis, $25,000 of suspended Section 704(d) losses, and potential Section 751 income. Jeremy considers four options:

1. Abandon the interest. Jessica must show both an intent to abandon and an affirmative act. Silence or nonuse isn’t enough. Assuming Section 751(b) does not apply, her $40,000 liability reduction is treated as money received, using up her $40,000 basis. She recognizes no gain or loss and can’t use the $25,000 of suspended losses.
2. Sell to Seth. The $10,000 payment plus $40,000 of debt relief creates a $50,000 amount realized and a $10,000 preliminary gain. In the example, Section 751 divides it into $6,000 of ordinary gain and $4,000 of capital gain.
3. Have Lighthouse redeem the interest. This follows the liquidating-distribution rules under Section 736 rather than beginning with Section 741, but the example still produces a $10,000 gain and a similar hot-asset analysis.
4. Sell to Grady. Jessica’s calculation remains similar. Grady begins with $10,000 of purchase basis and may then receive an allocated share of partnership liabilities. Practitioners shouldn’t assume he automatically receives Jessica’s exact $40,000 share. You have to review guarantees, the operating agreement, and creditor arrangements.

There is also an entity-classification issue. If Jessica leaves without a replacement, Lighthouse becomes a single-member LLC and is disregarded for federal tax purposes by default. If Grady replaces her, Lighthouse remains a partnership.

Plan for the exit before anyone wants out

The practical steps are:

1. Maintain an outside-basis worksheet with the partner’s return each year
2. Reconstruct missing basis before claiming losses or completing an exit
3. Review agreements, guarantees, and collateral before allocating liabilities
4. Measure suspended losses and consider whether basis can be restored before departure
5. Test underlying assets for Section 751 ordinary-income potential
6. Confirm whether the exit changes the LLC’s federal tax classification

As Jeremy explains, abandoning an interest is not a case where “you walk away and nothing happens.” The decisive tax facts often developed years before the exit documents appeared.

Listen to the full Tax in Action episode for Jeremy’s complete walkthrough of the Lighthouse LLC case study.