GLBA Safeguards Rule and HIPAA Checklist and FAQs

Both laws come down to one habit: know what private data you hold, protect it and be able to show your work. The Two-Key Records Check below gives one key to each law, drawn from the rules and numbers and the GLBA and HIPAA overview. It is general information, not legal advice.

The Two-Key Records Check

Key one: the Safeguards Rule

For tax preparers and other non-bank financial firms.

1. Name a Qualified Individual to run the security program and record who it is.
2. Complete a risk assessment of where client data sits and who can reach it, in writing (the rule requires writing at 5,000 or more consumers).
3. Use multi-factor authentication, encrypt client data or document an approved alternative, and set a disposal schedule.
4. Add safeguard terms to contracts with software, cloud and outsourced-preparer vendors.
5. Write an incident response plan that includes the 30-day FTC report for breaches affecting 500 or more consumers.
6. Train staff and keep the plan current; tax preparers can start from the IRS Publication 5708 template.

Key two: HIPAA

Only for covered entities and business associates.

1. Work out whether HIPAA reaches you: covered entity, business associate or neither.
2. Sign a business associate agreement before PHI is shared.
3. Complete a documented risk analysis and risk management plan, and name a security official.
4. Train the workforce; covered entities answer access requests within 30 days.
5. Plan breach notices (60 calendar days) and keep documentation for 6 years.

Common mistakes

• No risk assessment, or no Qualified Individual, in a tax practice.
• Treating the 5,000-consumer relief as an exemption. It excuses four items only.
• No multi-factor authentication on tax software, email or remote access.
• Keeping client files forever instead of using a disposal schedule (see how long to keep tax records).
• Handling PHI for a client without a business associate agreement.
• No documented HIPAA risk analysis, the central finding in a 2025 OCR settlement with a CPA firm.
• Missing a breach clock: 30 days for the FTC, 60 days for HIPAA notices to individuals.

When to talk to an attorney

A CPA cannot answer these.

• A breach, ransomware event or lost laptop. Several laws may require notices at once, and counsel usually directs the response.
• A letter, subpoena or investigation notice from the FTC, OCR, the IRS or a state attorney general.
• Deciding whether you are a covered entity or business associate, or negotiating a business associate agreement with indemnity terms.
• Sharing return information with an affiliate or lender, or using it for marketing, which the preparer-disclosure rules of 26 U.S.C. 7216 restrict.

A CPA can help with the payroll, tax and accounting side of data protection and works alongside the owner's attorney.

Frequently asked questions