Section 7216 restricts a tax return preparer’s disclosure or use of tax return information. If the law or regulations do not authorize the activity through an exception, the preparer generally needs the taxpayer’s valid written consent before proceeding.
The practical question is not simply whether a vendor is secure. It is what information will be shared, with whom, for what purpose, and under which authority. A well-protected system and a valid consent address different parts of the problem.
Key takeaways
- Identify the proposed disclosure or use and whether a specific exception applies.
- Where consent is required, obtain valid consent before the covered activity begins.
- Tax return information can include intake details and information derived during preparation.
- Follow the additional Form 1040-series requirements and keep security controls separate from legal permission.
Table of Contents
What information does Section 7216 protect?
Section 7216 is not limited to the finished return. Under 26 CFR 301.7216-1, tax return information can include a taxpayer’s name, address or identifying number furnished for or in connection with preparation, information supplied by third parties, and information derived or generated during preparation.
That scope matters when staff share an intake spreadsheet, upload source documents or reuse a client list. Review the information and purpose before the activity begins; waiting until the return is filed can miss the disclosure or use that needed assessment.
What is the difference between disclosure and use?
Disclosure concerns making tax return information available to another person or recipient. Use concerns employing that information for a purpose.
For example, sending return information to a third party and using it to market an unrelated service raise different questions. The firm’s reviewer needs to examine the actual facts and applicable exceptions rather than decide from a software label.
The IRS Section 7216 information center links the governing regulations and consent procedures. Use those primary sources when approving a new workflow.
Does every sharing activity require consent?
No. The regulations contain exceptions, and their conditions matter. A firm should assess whether a particular exception authorizes the proposed disclosure or use before requesting consent or treating the activity as prohibited.
That assessment should identify the parties, locations, purpose, information involved, and any limits on further use. Do not assume that all outsourcing, all IT support, or all AI use has the same treatment.
Create a review record for each recurring workflow. A decision made for one vendor and purpose should not silently extend to a different service, recipient, or data use.
What should the consent review cover?
26 CFR 301.7216-3 sets the core consent requirements and limitations. For a practical review, ask:
- Does the consent identify the taxpayer and preparer?
- Does it identify the information and the authorized recipient or particular use?
- Is the consent knowing, voluntary, signed, and obtained at the required time?
- Does it cover the relevant duration and the actual workflow?
- Are additional rules applicable because the taxpayer files a Form 1040-series return?
- Are special offshore disclosure or Social Security number conditions involved?
An engagement letter’s general confidentiality clause should not be treated as a universal permission slip. Have the reviewer confirm that the specific format and content requirements are met.
Do Form 1040 disclosure and use consents need separate documents?
Revenue Procedure 2013-14 prescribes additional requirements for Form 1040-series information. Disclosure consents and use consents belong in separate documents.
It also permits certain multiple disclosures within one disclosure consent, or multiple uses within one use consent, subject to its conditions. It is therefore too broad to say that every recipient always requires an entirely separate form.
The review should cover the required statements, affirmative selections, presentation, signature method, and any special disclosure language. Use the IRS consent procedure directly when preparing forms; an article summary should not replace the prescribed wording.
How should the firm approve a new data workflow?
Step 1: Map the proposed activity
Write down the information needed, the recipient, where access occurs, and why the information is necessary. Include subcontractors or tools that may receive it.
Step 2: Determine the legal basis
Ask the appropriate reviewer to identify the applicable exception or consent requirement. Record the reasoning and the scope of the decision.
Step 3: Configure access
Limit the users, client records, downloads, and retention to what the approved workflow needs. Confirm that the permissions work in practice before live client information is introduced.
Step 4: Keep the evidence together
Maintain the approval, relevant consent record, vendor agreement, and access instructions in a controlled location. Staff should be able to determine whether a particular client’s information is authorized for the proposed activity.
Step 5: Reassess material changes
Review a new recipient, offshore access, different purpose, or added AI feature before relying on the previous approval.
How does offshore access change the review?
Location can affect the analysis. Keeping a server in the United States does not by itself settle the rules when a person outside the country can view return information.
Offshore disclosure also raises special consent and Social Security number safeguards. The separate offshore staff consent and access guide covers the operational handoff between legal approval and technical permissions.
A client-access restriction should be tested inside the actual tax application and document system. A dedicated server alone does not prove that an individual can see only approved clients.
How can the WISP support the process?
The consent record establishes the authorized activity. The written information security plan should describe how the firm safeguards information in the systems used for that activity.
Useful connections include account approval, staff training, vendor oversight, incident reporting, and access revocation. Keep the policy consistent with the controls staff actually use.
How Verito helps implement approved data controls
VeritGuard managed IT can support device security, ongoing IT support, and relevant WISP assistance within the selected service scope. Discuss the permissions and records your approved workflow needs.
The firm’s qualified tax or legal reviewer should determine the consent requirements. The IT implementation should then enforce and document those decisions, rather than treating a hosting agreement as authorization to disclose.
Sources
- IRS: Section 7216 information center
- 26 CFR 301.7216-3: Consent requirements
- IRS: Revenue Procedure 2013-14
- 26 CFR 301.7216-1: Tax return information definitions
