These are the requirements, numbers and dates for the FTC Safeguards Rule and HIPAA. See the overview for coverage and the checklist for steps.
What the law requires
Safeguards Rule: tax preparers and other non-bank financial firms
| Requirement | In plain words | Section |
|---|---|---|
| Qualified Individual | Someone runs the program; an outside provider is allowed, but the firm stays responsible | 314.4(a) |
| Risk assessment | Assess risks to customer data and repeat it; written unless under 5,000 consumers | 314.4(b) |
| Safeguards | Limited access, data inventory, encryption or approved alternatives, multi-factor authentication, activity logs | 314.4(c) |
| Disposal | Dispose of customer data within two years of last use, unless a business, legal or practical need exists | 314.4(c)(6) |
| Testing | Continuous monitoring, or yearly penetration tests plus scans every six months | 314.4(d) |
| Training and vendors | Staff training; vendors chosen with care and bound by contract | 314.4(e), (f) |
| Response plan | A written incident plan and a yearly written report to the board or senior officer | 314.4(h), (i) |
| FTC breach notice | Report breaches of unencrypted data on 500 or more consumers | 314.4(j) |
IRS guidance adds a written security plan for tax preparers (Publication 5708); see identity theft and the IRS.
HIPAA: covered entities and business associates
| Requirement | In plain words | Section |
|---|---|---|
| Privacy duties | Covered entities name a privacy official, train staff, give a privacy notice and answer access requests within 30 days | 164.530, 164.520, 164.524 |
| Risk analysis | A documented, accurate and thorough risk analysis, then a risk management plan | 164.308(a)(1)(ii) |
| Business associate agreement | Signed before PHI is shared, including with subcontractors | 164.502(e), 164.504(e) |
| Records | Documentation kept 6 years | 164.316(b)(2), 164.530(j) |
Key numbers and dates
| Item | Amount or date | Year in force | Source label |
|---|---|---|---|
| Safeguards relief | Fewer than 5,000 consumers excuses four items | 2026 | 16 CFR 314.6 |
| FTC breach notice | 30 days after discovery, 500 or more consumers | Since May 13, 2024 | 16 CFR 314.4(j) |
| HIPAA notice to individuals | 60 calendar days | 2026 | 45 CFR 164.404 |
| HIPAA breaches under 500 | To HHS within 60 days after year end, about March 1 | 2026 | 45 CFR 164.408(c) |
Source: 16 CFR 314.4(j); 45 CFR 164.404 and 164.408
Recent and pending changes
- Safeguards Rule, final: amendments issued Dec 9, 2021; most applied from June 9, 2023; breach notice effective May 13, 2024. No substantive change since, through October 2026.
- HIPAA penalty amounts, final: the 2025 amounts were published Jan 28, 2026. HHS said on Oct 21, 2026 there is no 2026 adjustment, so they continue.
Penalties and enforcement
The FTC enforces the Safeguards Rule. OCR enforces HIPAA, and state attorneys general may sue.
| Tier or law | Applies to | Amount per violation |
|---|---|---|
| Safeguards Rule | Non-bank financial firms | No dollar schedule; the FTC uses its general authority (FTC Act guide) |
| HIPAA Tier 1 | Did not know | $145 to $73,011 (2025) |
| HIPAA Tier 2 | Reasonable cause | $1,461 to $73,011 (2025) |
| HIPAA Tier 3 | Willful neglect, corrected within 30 days | $14,602 to $73,011 (2025) |
| HIPAA Tier 4 | Willful neglect, not corrected | $73,011 to $2,190,294 (2025) |
| 26 U.S.C. 6713 | Preparer disclosure of return information | $250 each, $10,000 yearly cap |
The $2,190,294 figure is a ceiling, not a typical result. A 2019 HHS notice says OCR applies lower yearly caps for the lower tiers; check HHS for current figures. In 2025 OCR announced a $175,000 settlement with a New York CPA firm after ransomware, citing no accurate and thorough risk analysis.
Official sources
- eCFR: 16 CFR Part 314, Standards for Safeguarding Customer Information
- eCFR: 45 CFR Part 164, HIPAA Security and Privacy
- eCFR: 45 CFR 102.3, Civil Monetary Penalty Adjustments
- HHS: OCR Settles HIPAA Ransomware Investigation with BST & Co. CPAs
- Cornell Law: 26 U.S.C. 6713, Disclosure or Use of Information by Preparers
This page is a plain-language summary. The official source controls if there is any difference.