
Episode #22
The Data Security Plan Every Tax Preparer Must Have Before Taking Clients
Tax preparers handle highly sensitive personal and financial information. Federal law requires them to protect it. In this episode, Jason Carr explains the data security requirements that apply to tax preparers, including solo practitioners. Jason covers the FTC Safeguards Rule, IRS WISP requirements, and the practical steps every new preparer should take before accepting client documents. Jason covers: Why tax preparers are classified as financial institutions What the FTC Safeguards Rule requires What a Written Information Security Plan includes How to manage access control, device security, and document handling Why multi-factor authentication is required How to handle data retention and disposal What an incident response plan should include A practical September setup checklist Key Takeaways Tax preparers are financial institutions: The FTC Safeguards Rule classifies tax preparation firms as covered financial institutions. A WISP is required: The IRS and FTC both require a written plan describing how client data is protected. Multi-factor authentication is expected: Every system touching client data should require more than a password. Secure document exchange matters: Unencrypted email is a risk for sensitive tax documents. Data disposal must be secure: Shred paper. Wipe electronic files properly. An incident response plan is part of the WISP: Know what to do if data is compromised. IRS Publication 5708 provides a template: You do not need to build a WISP from scratch. Resources Mentioned MuseSpring: https://musespring.com Tax Business Blueprint Program: https://musespring.com The Law Office of Jason Carr, PLLC: https://carrtaxlaw.com Disclaimer Content on this channel is provided by MuseSpring LLC for educational and informational purposes only. It does not constitute legal or tax advice or establish an attorney-client relationship. MuseSpring LLC is not a law firm. Jason D. Carr appears in MuseSpring content in his capacity as an educator and founder of MuseSpring LLC, not in his capacity as an attorney with The Law Office of Jason Carr, PLLC. For advice specific to your situation, consult a qualified tax professional or licensed attorney. Comment Policy Please do not post confidential, sensitive, or personally identifiable tax information in the comments. We do not provide individualized legal or tax advice in the comments or social media replies.

