GLBA Safeguards Rule and HIPAA: Small Business Guide
Find out who falls under the GLBA Safeguards Rule and HIPAA, including tax preparers, with slides, a coverage table and links to rules, numbers and a checklist.
Last reviewed October 29, 2026 · General information, not legal advice
General information only, not legal advice. CPA Tax Payroll and Accounting Corp is a CPA firm, not a law firm. Laws change: confirm with the official source or a licensed attorney before you act. Read the full notice.
The Gramm-Leach-Bliley Act (GLBA) and the Health Insurance Portability and Accountability Act (HIPAA) are two federal laws about protecting private data. Through its Safeguards Rule, GLBA makes non-bank financial firms guard customer information. HIPAA protects health information held by health care organizations and their business partners. This guide is for small business owners, tax preparers and professionals deciding which law, if either, reaches them.
The Safeguards Rule applies to tax professionals, and because we are a tax preparer, it applies to our own firm. HIPAA is narrower: it reaches only covered entities and their business associates.
Slide show: GLBA and HIPAA in seven slides
What the laws do
The Safeguards Rule makes non-bank financial firms protect customer information. HIPAA protects health information held by covered organizations.
Who is covered
Tax preparation firms are named in the FTC rule. HIPAA reaches health plans, clearinghouses, providers using standard electronic claims, and their business associates.
The core rule
A written security program, run by a Qualified Individual and built on a risk assessment. Encryption (or an approved substitute) and multi-factor authentication are part of it.
The number to know
Fewer than 5,000 consumers relaxes only four Safeguards items. The firm is still covered.
The deadline
The rule requires a report to the FTC within 30 days after discovery of a breach of unencrypted data on 500 or more consumers. HIPAA notice to individuals is due within 60 days at the latest.
The penalty
The Safeguards Rule lists no dollar amounts. HIPAA civil penalties are tiered and start at $145 per violation (2025 amounts).
The tip
Many firms start with a documented risk analysis. It is the focus of OCR's Risk Analysis Initiative.
Who is covered by the Safeguards Rule and HIPAA?
Group
Law
Notes
Tax preparation firms, mortgage lenders and brokers, finance companies, collection agencies, other financial advisors
Safeguards Rule
Tax preparation firms are named in 16 CFR 314.1(b) and given as an example in 314.2(h)(2)(viii)
Firms holding data on fewer than 5,000 consumers
Safeguards Rule, with limited relief
Only four items are excused, not the whole rule
Health plans, clearinghouses (including some billing services) and providers using standard electronic transactions such as claims
HIPAA covered entity
A provider with no such transactions is not covered
Accounting, legal, consulting or administrative firms serving a covered entity
HIPAA business associate
Only when protected health information (PHI) is shared with the firm; subcontractors count too
HHS says an organization that is neither a covered entity nor a business associate does not have to follow HIPAA. Tax or accounting work does not by itself make a firm a covered entity, and it makes a firm a business associate only when PHI is involved.
How it touches your taxes and payroll
The IRS expects tax professionals to keep a written information security plan, and its Publication 5708 offers a template. Separate tax-code penalties apply to improper disclosure or use of return information (26 U.S.C. 7216 and 6713). Fines paid to the government for HIPAA or Safeguards violations are generally not deductible under IRC 162(f). See identity theft and the IRS, how long to keep tax records and our business tax preparation service.
