QSR 10: Security, Privacy, and Confidentiality

Publication 4299, Privacy, Confidentiality, and Civil Rights - A Public Trust, is the resource document for guidance on securing and protecting personally identifiable information (PII) shared by taxpayers, volunteers, and partners. A copy (paper or electronic) must be available at the site. Sites must follow all security, privacy, and confidentiality guidelines as outlined in Publication 4299.

All coordinators must have security procedures in place as described in Publication 4299 for the following processes:

• Preparing an annual security plan to safeguard taxpayer data. Sites can use Form 15272, VITA/ TCE Security Plan, or a similar document that captures the same information.

• Protecting all computers with passwords.

• Using a hard-wired internet connection or encrypted and password protected wireless internet connection.

• Securing computers, printers, and all equipment.

• Safeguarding PII at the site by safely storing and/or properly disposing of the information.

• Properly securing signatures on IRC Section 7216 required consent notices.

• Limiting volunteer access privileges to the tax software based on assigned roles.

• Generally restricting volunteer access to the tax returns.

• Deactivating usernames in the tax software when volunteers quit, resign, or are no longer working at the site.

All partners must approve the security plan. The site coordinator must sign the form and submit the form to their SPEC territory office prior to opening of the site but no later than December 31. The relationship manager and the territory manager must sign Form 15272 acknowledging approval of the security plan before the site opens.

The territory office must maintain the approved security plans for each site. The approved security plan (Form 15272) is no longer required to be maintained at the site. Territory offices must inform partners of the approval and SPEC encourages the territory to send a copy of the approved form to the partner. Publication 4299, Privacy, Confidentiality, and Civil Rights – A Public Trust, is required to be available at all sites. Volunteers must be familiar with the security plan policies to keep taxpayer information secure and confidential.

To help prevent identity theft at VITA/TCE sites, IRS-certified volunteers must identify themselves to the taxpayers they assist. Volunteers at in-person sites must wear or display name identification, including work identification badges, IRS name badges, and Tax-Aide name badges. At a minimum, this identification must include the full first name and first letter of the volunteer’s last name. Form 14509, Volunteer ID Insert, is an optional product for volunteers to display their names, which are available from the relationship manager. Virtual sites can use electronic means to give the volunteers’ names to the taxpayers.

QSR #10: Security, Privacy, and Confidentiality 55