JOURNAL TAXPRO HOME OFFICE SAFE HARBOR METHOD. Affordable Care Act. Security. Same-Sex. Education Tax Breaks. Marriage

Transcription

1 TAXPRO FALL 2013 JOURNAL National Association of Tax Professionals natptax.com Same-Sex Affordable Care Act Marriage 32 Security 36 Education Tax Breaks 14 HOME OFFICE SAFE HARBOR METHOD MAY HAVE ITS DRAWBACKS

2 SECURITY SEC 32 NATP TAXPRO Journal Fall 2013 natptax.com

3 RITY for the Tax Professional AAccording to the 1999 Gramm-Leach-Bliley Act (GLBA), all paid tax preparers and others who provide financial services fall under the category of financial institutions. The GLBA prohibits financial institutions from using unencrypted to exchange any nonpublic personal information (NPI) such as social security numbers, dependent information, etc. Tax organizers, W-2 forms, tax returns and any other document with NPI cannot be transmitted as unencrypted attachments in a regular message. The IRS issued a notice in 2002 that the consumer privacy provisions of the GLBA do not modify the requirements of IRC (and by extension, Circular 230). However, the GLBA does add additional restrictions on how the tax professional can exchange information with his or her clients, as noted in IRS Publication Unenrolled tax preparers who believe that Circular 230 does not apply to them are still covered under the provisions of the GLBA, with enforcement by the Federal Trade Commission (FTC). With the increased attention being paid to identity theft, the GLBA may be used more often to punish businesses that do not take security seriously. The fines can be as high as $100,000 to the firm for each violation, or up to $10,000 for the individual, and/ or imprisonment for up to five years for each incident. If other federal laws are violated, the fines and penalties can be doubled. By Frank Hagan, CRTP NATP TAXPRO Journal Fall 2013 natptax.com 33

4 Why is Not Secure When we mail a letter, we know the United States Postal Service picks up the envelope and transfers it to a sorting facility, then routes the letter to the destination post office. A USPS employee then delivers it to the client, unopened and unread. The letter is within the strict control of the USPS at all times. follows a different route entirely. Unencrypted does not have an envelope to protect the contents; it is sent in plain text similar to a postcard. The route an takes from you to your client s computer can include several servers under private control. Each of those servers will have from one to dozens of people who have access to your . Any one of these people can read and copy the . Imagine that instead of ing a letter with your client s NPI, you put the client s information on a postcard, take it to the mall and hand it to a stranger with instructions to get it to your client. You have no idea how many times it will be passed off to another stranger, or how many times it will be read or copied. From a security standpoint, sending a client s NPI in an unencrypted is the same as sending a postcard. Password Protection is Not Enough The GLBA requires containing NPI to be encrypted. 3 This is a term of art to describe using an encryption algorithm ( cipher ) to render a document unreadable by anyone not in possession of the encryption key. Simply protecting a PDF file with a password may not encrypt the file, giving an identity thief the opportunity to view the contents using specialized software. While some PDF programs do provide encryption, the password security Preparers need to do more than just ensure secure exchange of documents and messages. itself is weak. A web search for PDF password removal provides thousands of links to programs that break PDF password protection. Password protection provided by spreadsheet or word processing software is similar, with many free and inexpensive utilities available to defeat it. Encryption Methods Clients who are technically savvy enough to receive an archive (i.e, a zip file ) can be sent an encrypted archive. Several archive programs, such as 7-Zip 4 for the PC and WinZip Mac 5 for Apple, can encrypt a file using AES-256 encryption, which complies with the GLBA. However, because the archive file stores the encryption key in the file, it is possible to use a program to uncover the password. Separate file encryption programs can be used to encrypt and attachments. Some, like GnuPG 6 ( Gnu Pretty Good Privacy ) are free. However, they require you to set up the encryption on your computer and the same encryption program on your client s computer. An encryption key must be provided to the client separately. Because there are no programs to defeat the encryption, this method is more secure than PDF password and archive file protection. However, it requires a level of technical expertise the average consumer may not possess. The Encryption Program Everyone Has Clients have varying levels of technical expertise. Most clients know how to use a web browser to log into services such as Facebook. Every modern web browser comes equipped with built-in encryption secure enough for compliance with the GLBA. Web browsers use the secure sockets layer (SSL) 7 to encrypt and decrypt information on the fly, without intervention by the client. Banks, brokerage firms and other financial institutions use SSL for client access to information. Using SSL meets the requirements of the GLBA. Website addresses that start with the prefix are using SSL (note the s in the prefix.) SmartVault.com, ShareFile. com and LeapFile.com all provide file sharing portals with the required security. Most of these services work in two ways. In the first method, the tax preparer has the client set up a free login account with the portal, recording their address. When a file is uploaded into the portal, the client is notified. They log in and download the file to their computer. The second method uses a little-known feature of some desktop programs, such as Microsoft Outlook, to use SSL to upload an with attachments to the portal. The portal provides software to integrate with the program and enable sending of secure and file attachments 34 NATP TAXPRO Journal Fall 2013 natptax.com

5 using the SSL. Clients who also have a desktop program with this ability can set it to automatically download the with attachments when it becomes available without having to log in with their password and download the files manually. In truth, these s are not at all; they do not travel through the normal system, but are encrypted and traverse the Internet using the SSL. An advantage to this method is that there are no extra steps involved for exchanging s and documents. Secure file portals range from $20 per month to several hundreds of dollars. More economical options exist for the independent tax professional. For example, SendInc.com 8 offers a free Basic plan and a more generous Pro plan for $5 per month (the Basic plan has lower limits on the size of file attachments and number of clients you can serve). SendInc.com offers a Microsoft Outlook plugin to provide the automatic log-in capability of the secure file portals. Many tax software vendors have a secure file portal of their own, although not all of them include the ability to integrate with desktop clients. In addition, some tax preparers have reported that their clients receive marketing from the software company for do-ityourself tax products. Review the website privacy policy your clients agree to when they set up their portal account; it may allow the company to send them marketing . Secure /file portals provide a good combination of security and ease of use. unsecured transport system as regular and have the same privacy problems. A number of e-fax services provide a method to ensure compliance with GLBA or its close cousin, HIPAA (Health Insurance Portability and Accountability Act). A secure e-fax will use a portal similar to the secure file portals, and will not transmit the fax through regular . Efax.com, RingCentral.com and others offer the option to log into the secure portal to download faxes rather than receive them by . Tax preparers using e-fax services should disable delivery of faxes and always log in and download them through the portal. Note that the IRS may not send documents to your e-fax number due to privacy concerns. Client Behavior The FTC s Safeguards Rule states we must caution customers against transmitting sensitive data, like account numbers, via or in response to an unsolicited or pop-up message. This implies that we have an affirmative duty to warn our clients against sharing NPI with us via or other unsecure methods, including an e-fax service they use. Adding a message to website contact forms, links and in our signatures will help us comply with this mandate. Example: The confidentiality of Internet cannot be guaranteed. Do not include private or confidential information such as social security numbers, passwords, etc., in s to us. Instead, ask about our secure, encrypted system available at no cost to our customers. More to Privacy Than Just The GLBA, IRS Publication 4557, and other laws compel the modern tax preparer to do more than just ensure secure exchange of documents and messages. Protecting our client s NPI extends to office policies, computer access, backup programs and more. Now is a good time to review your firm s security and privacy policies to ensure they meet the legal requirements. End Notes 1. IRS, Notice : irs.gov/pub/irs-drop/n-02-6.pdf 2. IRS, Pub. 4557: gov/pub/irs-pdf/p4557.pdf 3. FTC, documents/bus54-financialinstitutions-and-customerinformation-complying-safeguardsrule index.htm jsp?id=how-ssl-works 8. Secure e-fax Services E-fax services use for sending and delivering faxed documents as attachments. They use the same Frank Hagan, CRTP is the president and CEO of Acumen Consulting LLC, a management consulting firm providing IT, web, business management and tax preparation services in southern California. NATP TAXPRO Journal Fall 2013 natptax.com 35