Tax Preparers: Emailing Tax Returns

E-Filing of tax returns and paperless office initiatives are two growing trends for today's tax return preparers.  Whether using dedicated document management systems or just saving scanned documents in network folders, the savings in paper, file cabinets, toner, and storage space are compelling.  I myself have been going down that path. Along with filing electronic returns and saving electronic images of client information, comes sending electronic copies of tax returns to clients, usually by email.  

At a meeting of local CPAs last month, one of the attendees said something about a legal or ethical requirement to password protect and encrypt copies of tax returns that are emailed to a client.  I have not been doing that. My practice has been to tell clients that I would like to email the taxpayer copy of their return to them and obtain their permission to do so.  If they had a concern, I would mail them a paper copy of the return.  This news that I might not be doing enough to comply with the law was an immediate concern.

Being a Texas CPA, I checked the websites for the Texas Society of CPAs and the Texas State Board of Public Accountancy for information concerning ethical requirements for CPAs pertaining to email communications.  I found nothing on this topic.  Similarly, I could not find any information on the American Institute of Certified Public Accountants website or in the AICPA Code of Ethics.  I called the Texas Society of CPAs and received a call back from a very helpful committee member who spent considerable time following up on my request.  The conclusion, for now, appears to be that Texas does not have any ethical or legal requirement for CPAs to password protect or encrypt electronic copies of tax returns that a CPA emails to clients.  

The US Internal Revenue Code includes a provision (Section 7216 for you Code-heads) that empowers the IRS to impose a criminal penalty for knowingly and recklessly disclosing or using tax information for a purpose other than preparing a tax return.  The regulations under this provision require data protection after January 1, 2009 on Form 1040 tax information disclosures to tax return preparers located outside of the United States.  However, these data protection standards are not applicable to communications between the return preparer and his or her client.  

Certainly, the IRS and other regulatory bodies recommend using password protection and encryption to protect sensitive client information, but there are currently no ethical or legal requirements requiring these measures that I can find.  I'm going to look into this further.  I'd love to hear from any fellow tax return preparers if you have suggestions on securing client communications or on some legal requirements that I might have overlooked in my investigation of the matter.  Please leave a comment or send me an email.