The FTC Safeguards Rule is the data-security part of the Gramm-Leach-Bliley Act (GLBA, 1999). It names tax preparation firms, ours included, among the businesses that must protect customer information. The Health Insurance Portability and Accountability Act (HIPAA, 1996) is a separate law for health information. This page is for owners of cross-border businesses who hold client data, or whose vendors in India or Canada may handle someone's health data.
Who does the FTC Safeguards Rule cover?
| Rule | Coverage |
|---|---|
| Safeguards Rule | Businesses whose activity is financial in nature, including tax preparation firms, mortgage brokers, finance companies, check cashers, collection agencies and credit counselors. It covers all customer information in the firm's possession |
| Size relief | Under 5,000 consumers: no written risk assessment, penetration testing and scans, written incident response plan or annual board report. Everything else applies |
| HIPAA covered entity | Health plans, clearinghouses and providers that use standard electronic transactions such as claims. Group health plans count with 50 or more participants, or if someone other than the employer runs them |
| HIPAA business associate | A person who handles protected health information for a covered entity, including some accounting services, and subcontractors |
What does it mean for a foreign-owned or cross-border business?
| Situation | What the law says | What to check |
|---|---|---|
| Tax firm with clients linked to India or Canada | The rule's "consumer" depends on the purpose of the service and names no residence test | A written program covering every client file |
| Preparer sends files to overseas staff or a vendor | Select capable providers, require safeguards by contract, reassess them (16 CFR 314.4(f)) | Contracts, access limits, multi-factor sign-in |
| Back-office vendor in India or Canada handles U.S. patient data | The business associate definition names no location test. A covered entity needs a written agreement first | The agreement and any subcontractors |
The rules and checklist page has the details. Retention periods are in our record retention guide, and phishing in our scam alerts. Related laws: FTC Act, CAN-SPAM and Illinois personal information protection.
Frequently asked questions
Does the Safeguards Rule apply to a small tax preparer?
Yes. 16 CFR 314.1(b) lists tax preparation firms, as does 314.2(h)(2)(viii). The 5,000-consumer relief covers four items.
Official sources
- eCFR: 16 CFR Part 314, Safeguards Rule
- Federal Trade Commission: FTC Safeguards Rule, what your business needs to know
- eCFR: 45 CFR Part 160, HIPAA general administrative requirements
- HHS: Covered Entities and Business Associates
This page summarizes public guidance in plain language. If anything here differs from the official source, the official source controls.