This page follows the overview with the Safeguards Rule and HIPAA duties, numbers and a checklist. Marketing claims fall under the FTC Act.
What do the Safeguards Rule and HIPAA require?
| Rule | Requirement | Source |
|---|---|---|
| Safeguards | A Qualified Individual, employee or outside provider, runs the program; the firm stays responsible | 16 CFR 314.4(a) |
| Safeguards | Risk assessment, access controls, encryption or an approved alternative, multi-factor authentication or an approved equivalent, disposal two years after last use (with exceptions) | 314.4(b), (c) |
| Safeguards | Testing, training, provider oversight, incident response plan, FTC notice | 314.4(d)-(j) |
| HIPAA | Covered entities: privacy official, training, access requests answered in 30 days. Also business associates: security official, documented risk analysis | 45 CFR 164.308, 164.524, 164.530 |
| HIPAA | Business associate agreement before sharing health data; records kept 6 years | 164.502(e), 164.316 |
Key numbers and dates
| Item | Amount or date | Year in force |
|---|---|---|
| FTC breach notice | 500 or more consumers, within 30 days of discovery | Effective May 13, 2024 |
| Safeguards size relief | Under 5,000 consumers, four items | Current |
| HIPAA penalty per violation | $145 to $2,190,294 across four tiers | 2025 amounts, no 2026 adjustment |
Source: 45 CFR 102.3
What has changed, and what is pending?
We found no Safeguards Rule change after the breach-notice amendment published November 13, 2023, as of October 27, 2026. HHS said on October 21, 2026 there is no 2026 HIPAA penalty adjustment.
The Gate-and-Ledger Data Walk: a named checklist
The Gate-and-Ledger Data Walk guards client data and records where it sits.
- Name the Qualified Individual and who oversees that person.
- Build the ledger: where client data sits and in which country.
- Close the gates: need-based access, multi-factor sign-in, encryption or a written alternative.
- Review each outside provider and overseas team member: safeguards by contract.
- Write the program (IRS Publication 5708 is a template); train staff.
- Set a disposal date, two years after last use unless a business or legal need applies; see record retention.
- If health data arrives, check business associate status.
What mistakes recur?
- Treating the 5,000-consumer relief as a full exemption.
- No multi-factor sign-in on tax software, email or remote access.
- No contract terms with vendors or outsourced preparers.
- HIPAA: no documented, thorough risk analysis.
When should you bring in an attorney?
- A breach or ransomware event may trigger notices under several laws, including Illinois personal information protection.
- A letter or subpoena arrives from the FTC, HHS or IRS.
- Covered entity or business associate status is unclear.
How can we help?
We prepare U.S. returns for clients linked to India and Canada, coordinating with your Canadian CPA or Indian CA; your attorney handles contracts and breach notices. See cross-border tax services and bookkeeping and accounting.
Frequently asked questions
Is an accounting firm a HIPAA business associate?
Tax work alone does not make a firm a covered entity, but a firm receiving health data from a covered-entity client for accounting can be a business associate. A New York CPA firm paid $175,000 in a 2025 settlement; HHS's investigation found no accurate, thorough risk analysis.
Does HIPAA reach a vendor in India or Canada?
The business associate definition names no location test. Ask a health-care attorney.
When is a breach reported?
To the FTC within 30 days for unencrypted data on 500 or more consumers; to HIPAA individuals within 60 calendar days.
Does the Safeguards Rule list fines?
No. The FTC enforces through its general authority.
Official sources
- eCFR: 16 CFR Part 314, Safeguards Rule
- eCFR: 45 CFR Part 164, HIPAA privacy, security and breach rules
- eCFR: 45 CFR 102.3, HHS penalty adjustments
- IRS: Publication 4557, Safeguarding Taxpayer Data
- IRS: Publication 5708, Written Information Security Plan
This page summarizes public guidance in plain language. If anything here differs from the official source, the official source controls.