IRC 7216 Disclosure Rules and Preparer Restrictions

The disclosure rules in Internal Revenue Code Section 7216 make it a federal crime for a tax return preparer to share or use your tax return information without your written consent, with narrow exceptions written into the regulations. The rule reaches everyone who handles your data in the course of preparing the return, not only the person who signs it, and violations can carry up to a year in prison, per-incident fines, civil penalties, and professional discipline. Knowing what a preparer can and cannot do with your information is the difference between catching a problem early and finding out after your identity has been used to file a fraudulent return.

What the Rule Protects and Who Is Bound by It

Tax return information under Section 7216 includes anything you provide to a preparer for purposes of preparing your return and anything the preparer derives from it. Social Security numbers, bank account details, wage statements, and investment records all qualify. So do figures the preparer calculates, such as your adjusted gross income or refund. Even the fact that you are a client of a particular firm is protected, because that fact was furnished in connection with return preparation. Information the preparer pulls from third parties during the engagement, such as an IRS transcript or a document from your employer, receives the same protection.

The definition of “tax return preparer” is deliberately broad. It covers anyone in the business of preparing returns, anyone else who prepares a return for compensation, and every employee whose duties involve assisting in those activities.¹ Data entry clerks, quality reviewers, and administrative staff at a tax firm are all bound, even though they never speak with clients. Software developers and e-file providers also fall within the definition because they handle taxpayer data as part of providing auxiliary services connected to return preparation.² The regulations even reach someone paid to help a friend or relative with a return outside a business setting. Roughly the only people clearly outside the scope are those who help for free and have no business reason to be involved.

The Written Consent You Have to Sign First

If a preparer wants to use or disclose your tax return information for any purpose beyond preparing your return, they need your written consent, and that consent has to meet detailed federal requirements. Revenue Procedure 2013-14 sets out mandatory language every consent form must include. For disclosures to third parties, the form has to state that federal law requires the consent to be provided to you, explain that the preparer cannot share your information without your permission, warn that once disclosed the information may not be protected from further distribution, and tell you plainly that you are not required to sign as a condition of getting your return prepared.³ If a preparer conditions services on your consent, the consent is invalid.

The form also has to identify the preparer, name the specific recipient, describe the particular information being shared, and explain the purpose of the disclosure or use. Each consent must be signed and dated.⁴ A single document cannot authorize both uses and disclosures; those are separate consents.⁵ So if your preparer wants to use your data for internal marketing and also share it with, say, a mortgage broker, you should be signing at least two forms.

If the form does not specify a duration, the consent expires one year from the date you signed it.⁴ For individuals filing Form 1040-series returns, the consent must be a standalone document. Business-entity clients may see consent language embedded in an engagement letter, which the regulations allow.⁵

Disclosures That Do Not Require Your Consent

Some categories of disclosure are allowed without your written permission. These are the situations where the legal system’s need for information or the practical requirements of running a tax practice override the default confidentiality rule.

Court orders and grand jury or congressional subpoenas. A preparer must comply with an order from any federal, state, or local court, a subpoena from a federal or state grand jury, or a subpoena from Congress.⁶
Administrative orders, summonses, or subpoenas from a federal agency or from a state agency that regulates tax preparers.
Disclosures to any IRS officer or employee.
Ethics and oversight reviews, including professional association ethics committees, the Public Company Accounting Oversight Board, and peer reviewers, to the extent necessary for the review.
Internal firm operations, so that employees and contractors within the same firm may access return information to assist in preparation, perform quality control, or run conflict-of-interest checks.
Legal advice, when the preparer discloses information to an attorney to get advice about the preparer’s own obligations.

These are the categories built into the regulation itself. Anything outside them still needs your signed consent.

When Your Data Is Sent Outside the United States

Firms that outsource preparation work to offices or contractors overseas face stricter rules. If a U.S.-based preparer wants to share your tax return information with someone at the same firm located outside the country, the preparer must first get your written consent under the standard consent rules.⁶ The internal-firm-operations exception does not apply when the recipient is abroad.

Social Security numbers get extra protection. The regulations originally barred sending SSNs outside the United States at all. A 2008 amendment created a narrow exception: a preparer may include your SSN in an offshore disclosure only if both the U.S. preparer and the foreign recipient maintain an “adequate data protection safeguard” as defined by the IRS, and the consent form states that both parties maintain those safeguards. Qualifying frameworks include the AICPA/CICA Privacy Framework, IRS Publication 1075, EU data protection standards, and certain financial industry security programs.³ Without the safeguard, the preparer must redact or mask your SSN before sending the file overseas.

Penalties for Preparers Who Violate the Rule

Section 7216 violations carry consequences under both criminal and civil law, and the numbers get sharper when identity theft is involved.

Criminal Penalties

A knowing or reckless violation of IRC 7216 is a misdemeanor punishable by up to one year in prison and a fine of up to $1,000 per unauthorized disclosure, plus the costs of prosecution. When the disclosure is connected to identity theft, the maximum criminal fine rises to $100,000.¹

Civil Penalties

IRC 6713 imposes a separate civil penalty of $250 for each unauthorized disclosure or use, capped at $10,000 per calendar year for any single preparer. For disclosures connected to identity theft, the per-incident penalty rises to $1,000 and the annual cap rises to $50,000.⁷ The identity-theft cap applies separately from the standard cap, so a preparer involved in both types of violations could face up to $60,000 in civil penalties in a single year. The fines are cumulative across clients, so a firm that shares data on 40 clients without consent for marketing hits the $10,000 ceiling at the standard $250 rate.

Professional Discipline

CPAs, enrolled agents, and attorneys who practice before the IRS face a further layer through the IRS Office of Professional Responsibility under Circular 230. Willfully disclosing or using tax return information in a manner not authorized by the Internal Revenue Code is defined as disreputable conduct, and practitioners can be censured, suspended, or permanently disbarred from practice before the IRS. The IRS may also impose a monetary penalty up to the gross income the practitioner derived from the misconduct.⁸ Disciplinary actions are published in the Internal Revenue Bulletin.⁹

If You Think Your Preparer Misused Your Information

The primary reporting mechanism is IRS Form 14157, “Complaint: Tax Return Preparer.” The form asks for your contact information, the preparer’s identifying details, and a description of what happened. Submit it with any supporting documentation by fax to 855-889-7957 or by mail to the IRS Return Preparer Office in Atlanta.¹⁰ The IRS may investigate and contact you for additional details, but the agency does not typically provide status updates on individual investigations.

If a preparer’s systems have been breached, the IRS recommends applying immediately for an Identity Protection Personal Identification Number. The IP PIN is a six-digit number that prevents anyone from filing a return using your Social Security number without it, and the IRS describes it as the top security tool available to taxpayers.¹¹ Anyone with an SSN or ITIN can apply through their IRS online account, by submitting Form 15227 if adjusted gross income is below $84,000 ($168,000 for joint filers), or by visiting a Taxpayer Assistance Center in person.¹² Preparers are also required to notify affected clients after a breach; if you suspect a breach and your preparer has said nothing, that silence is itself worth reporting.

One boundary matters for anyone considering a lawsuit. IRC 7216 itself does not give taxpayers a private right to sue a preparer for damages; the criminal and civil penalties above are collected by the government, not paid to the victim. A separate statute, IRC 7431, does create a private civil cause of action with statutory damages of $1,000 per unauthorized disclosure, plus actual damages, attorney’s fees, and punitive damages for willful or grossly negligent violations.¹³ Section 7431 is tied to violations of Section 6103, which primarily governs confidentiality of tax information held by the IRS and government agencies, and courts have not uniformly extended it to the typical preparer-client situation covered by Section 7216. Taxpayers may also have state law claims for negligence, breach of fiduciary duty, or breach of contract, which do not depend on federal tax statutes and can reach identity theft expenses and emotional distress. An attorney familiar with tax privacy law and your state’s civil remedies can evaluate which route fits the facts.

1
Office of the Law Revision Counsel. 26 USC 7216 – Disclosure or Use of Information by Preparers of Returns
2
eCFR. 26 CFR 301.7216-1 – Penalty for Disclosure or Use of Tax Return Information
3
Internal Revenue Service. Revenue Procedure 2013-14
4
GovInfo. 26 CFR 301.7216-3 – Disclosure or Use Permitted Only With the Taxpayers Consent
5
eCFR. 26 CFR 301.7216-3 – Disclosure or Use Permitted Only With the Taxpayers Consent
6
eCFR. 26 CFR 301.7216-2 – Permissible Disclosures or Uses Without Consent of the Taxpayer
7
Office of the Law Revision Counsel. 26 USC 6713 – Disclosure or Use of Information by Preparers of Returns
8
Internal Revenue Service. Treasury Department Circular No. 230
9
Internal Revenue Service. Announcements of Disciplinary Sanctions in the Internal Revenue Bulletin
10
Internal Revenue Service. Form 14157 – Return Preparer Complaint
11
Internal Revenue Service. Tax Professionals Must Act Fast After Discovering a Data Breach
12
Internal Revenue Service. Get an Identity Protection PIN
13
Office of the Law Revision Counsel. 26 USC 7431 – Civil Damages for Unauthorized Inspection or Disclosure of Returns and Return Information