Does the FTC Safeguards Rule Apply to Your Ohio Tax or Accounting Firm?

This is a plain-English summary for business owners, not legal advice. The rule text is linked throughout; your attorney or compliance advisor has the final word on how it applies to your firm.

The FTC's Safeguards Rule (16 CFR Part 314) requires covered businesses to run a written information security program. Most people read "financial institution" and think of banks. The rule means something much broader, and it names tax preparers specifically.

Who Is Covered

The rule's list of examples includes mortgage brokers, finance companies, collection agencies, credit counselors and other financial advisors, investment advisors that aren't required to register with the SEC, entities acting as finders, and tax preparation firms. It spells the last one out: an accountant or other tax preparation service that is in the business of completing income tax returns is a financial institution.

So, for a Northeast Ohio practice:

• CPA firms and enrolled agents that prepare returns: covered.
• Seasonal tax offices: covered.
• Mortgage brokers and small investment advisors not registered with the SEC: covered.
• Bookkeeping-only practices: the IRS reads the rule broadly for accounting professionals, but the rule's own example is about tax returns. Ask your advisor.
• Insurance agencies: generally not under this FTC rule, because section 314.1 limits the rule to financial institutions under the FTC's jurisdiction, and insurance is regulated by the states. Ohio agencies have their own law instead (more below).

The IRS points tax professionals to the same obligation. Its Publication 5708 says that under the GLBA and the Safeguards Rule, tax and accounting professionals are considered financial institutions regardless of size, and that the law requires a written information security plan. It includes a sample plan to start from.

What the Rule Requires

Section 314.4 lists the elements. In plain terms, your firm needs:

1. One person in charge. A "Qualified Individual" who oversees the program. It can be an outside provider, but the firm stays responsible and must name a senior person to supervise them.
2. A written risk assessment of what could expose client information, and how each risk is handled.
3. Safeguards that match the risks, including: access limited to staff who need it; an inventory of your data, devices and systems; encryption of client information in transit and at rest; multi-factor authentication for anyone accessing any information system; secure disposal of client information no later than two years after it was last used (unless you need to keep it); change management; and logging of what authorized users do.
4. Testing. Continuous monitoring, or else an annual penetration test plus vulnerability scans at least every six months.
5. Staff training on security, kept current.
6. Oversight of your vendors, including a contract requiring them to protect client data. That covers your IT provider, your tax software and your cloud storage.
7. A written incident response plan.
8. A yearly written report from the Qualified Individual to the owners or partners.
9. Breach notice to the FTC. Since May 13, 2024, if unencrypted information on at least 500 consumers is taken, you must notify the FTC as soon as possible and no later than 30 days after you find out.

The Small-Firm Exception

Section 314.6 exempts firms that hold customer information on fewer than 5,000 consumers from four items: the written risk assessment, the continuous-monitoring-or-pen-test requirement, the written incident response plan, and the annual report. That helps a small practice, but read it carefully. MFA, encryption, access control, training, vendor oversight, the Qualified Individual and the FTC breach notice all still apply. And many firms with a few hundred clients a year have far more than 5,000 people in their files once you count dependents, spouses and past years.

For Ohio Insurance Agencies

Ohio insurance licensees are covered by the state's Insurance Data Security law, Ohio Revised Code Chapter 3965. It has its own information security program requirement in section 3965.02 and notice to the superintendent in 3965.04. Under section 3965.07, a licensee with fewer than 20 employees, less than $5 million in gross annual revenue, or less than $10 million in assets is exempt from the program requirement in 3965.02. The other sections, including notification, are not part of that exemption.

An Ohio Bonus: The Data Protection Act

Ohio gives businesses a reason to do this well. Under Ohio Revised Code 1354.02, a business whose written cybersecurity program reasonably conforms to a recognized framework is entitled to an affirmative defense against tort claims that a failure to implement reasonable security caused a data breach. Section 1354.03 lists Title V of the Gramm-Leach-Bliley Act among the laws a program can conform to. A real, followed WISP is the start of that defense. Ask your attorney how it applies to you.

A Checklist for Before Tax Season

1. Name your Qualified Individual, in writing.
2. Count roughly how many people are in your client files. Decide whether the 5,000 exception applies.
3. Turn on MFA for email, tax software, remote access, the client portal and cloud storage. Every account.
4. Confirm laptops are encrypted (BitLocker on Windows, FileVault on Mac) and that client files go out through a secure portal, not plain email.
5. List every vendor that touches client data and check each contract for a security clause.
6. Remove accounts for anyone who has left, and limit admin rights to the people who need them.
7. Shred or securely delete client records past your retention period.
8. Start the WISP from the IRS sample in Publication 5708 and make it describe what you actually do.
9. Write down who calls whom if there is a breach, including the FTC 30-day notice.
10. Schedule the training and put next year's review on the calendar.

When to Call Someone

A small office can write a decent WISP from the IRS sample. The part that trips firms up is the gap between the document and the computers. Call for help when:

• You can't say for certain that every account has MFA, including the old shared logins.
• Client files live on a server or a NAS in the office and nobody has tested a restore.
• You need the continuous monitoring or the six-month vulnerability scans and have no tools for them.
• Your IT provider can't show you, in writing, how they protect your data.

We work with accounting and tax firms across Canton, Akron and Cleveland; our accounting firm IT page covers how. Or call (330) 305-2750 and ask for an hour before tax season starts.

Common questions