Protecting client data: the Safeguards Rule and HIPAA
Tax preparers, including us, are covered by the FTC Safeguards Rule. HIPAA is narrower, but some accounting firms fall under it. Here is the short guide, with the numbers that apply in 2026.
Prepared by Prem Tax and Accounting Corp. Last checked against official sources on October 29, 2026.
The Gramm-Leach-Bliley Act (GLBA) makes financial businesses protect customer data, and the Federal Trade Commission (FTC) enforces its Safeguards Rule against tax preparers, ourselves included. HIPAA is a separate health-privacy law. We boil both down to the Lockbox-and-Logbook Review. Official text: 16 CFR Part 314; 45 CFR Parts 160 and 164.
- The Safeguards Rule names tax preparation firms, so tax preparers, including this firm, are covered.
- It requires a written security program overseen by a named Qualified Individual.
- With data on fewer than 5,000 consumers, only four items are excused.
- HIPAA covers health plans, clearinghouses, certain providers and business associates. Tax work alone is not enough.
Who it covers
| Group | Covered? | Note |
|---|---|---|
| Tax preparation firms, including ours | Yes, Safeguards Rule | Named in 16 CFR 314.2(h) |
| Health plans, clearinghouses, providers using standard electronic transactions | HIPAA covered entities | Not providers that never use such transactions |
| Accounting firm given patient data by a covered client | Business associate | Only for that data |
The numbers
| Item | Amount or date | Year |
|---|---|---|
| FTC breach notice | 500 or more consumers, within 30 days | Since May 13, 2024 |
| HIPAA breach notice to individuals | No unreasonable delay, 60 days at most | 2026 |
| HIPAA penalties per violation | Tier 1 $145 to $73,011; Tier 2 $1,461 to $73,011; Tier 3 $14,602 to $73,011; Tier 4 $73,011 to $2,190,294 | 2025 amounts, no 2026 change |
- Revised rule published
- Main new duties apply
- FTC breach notice takes effect
Source: 16 CFR Part 314
Our checklist
We call it the Lockbox-and-Logbook Review.
- Lockbox: a Qualified Individual designated; client data inventoried.
- Lockbox: multi-factor authentication and encryption, or approved alternatives.
- Lockbox: vendor contracts; old files disposed of within two years of last use, with exceptions.
- Logbook: written program, training dates, breach steps for the 30-day FTC notice.
- Logbook: if a covered client shares patient data, a business associate agreement and risk analysis, kept six years.
Mistakes people make
- Skipping multi-factor authentication on tax software or email.
- Keeping client files forever instead of following a disposal schedule.
- Assuming every CPA is a HIPAA business associate, or that none is.
When to call an attorney: a breach, ransomware event or lost laptop (several notice laws can apply, including Illinois's), or a letter from the FTC, HHS or a state attorney general. A CPA cannot advise on those.
Common questions
Are small tax preparers exempt from the Safeguards Rule?
No. Under 5,000 consumers, only four items are excused: the written risk assessment, testing and scans, the written response plan and the annual report.
Is a CPA firm covered by HIPAA?
Only as a covered entity or a business associate, and tax work alone is neither. HHS treated the CPA firm BST & Co. as a business associate when it settled for $175,000 in 2025 after a ransomware attack.
Did HIPAA penalties go up in 2026?
No. HHS said on October 21, 2026 that there is no 2026 adjustment, so the 2025 amounts continue.
Official sources
- FTC: Safeguards Rule, what your business needs to know
- eCFR: 16 CFR Part 314, standards for safeguarding customer information
- IRS: Publication 5708, creating a Written Information Security Plan
- eCFR: 45 CFR Part 164, HIPAA privacy, security and breach rules
- eCFR: 45 CFR 102.3, HIPAA penalty amounts
Keep reading
Let's talk about your taxes, your business, your plans.
Tell us what you need and we will get back to you quickly. There is no pressure: just a friendly conversation and a clear next step.
4260 Westbrook Dr, Suite 107
Aurora, IL 60504
Monday to Friday, 9:00 am to 5:00 pm, by appointment. Saturday and Sunday by appointment when needed.