AICPA's Revised Confidentiality Rule and Sec. 7216: The Recently Revised AICPA Code of Professional Conduct Includes a New Confidential Client Information Rule under Section 1.700.001, Which Expands the Guidance on Maintaining the Confidentiality of Client Information
[ILLUSTRATION OMITTED] The general thought previously has been that if CPA tax practitioners were complying with Sec. 7216 and revisions of its related regulations that went into effect six years ago (Regs. Secs. 301.7216-1 through 301.7216-3), they were complying with the less detailed AICPA code Rule 301, Client Confidential Information. Now that the new AICPA guidance with its expanded interpretations has taken effect (on Dec. 15, 2014), members are encouraged to assess their practices for compliance with both sets of rules. NEW AICPA CONFIDENTIAL CLIENT INFORMATION RULE Former Rule 301 stated that "a member in public practice shall not disclose any confidential client information without the specific consent of the client," but did not state the method for obtaining the consent. However, Rule 391, Ethics Rulings on Responsibilities to Clients, suggested that the consent be in writing (see Interpretation 391-2, "Disclosure of Client Information to Third Parties"). Former Rule 301 provided exceptions to the consent requirement for complying with Rule 202, Compliance With Standards, and Rule 203, Accounting Principles' complying with a valid subpoena, summons, or applicable statutes and government regulations; conducting a review of a member's professional practice under AICPA or state CPA authority; or initiating or responding to a complaint made by a professional ethics organization. One interpretation under the rule regarding confidential information and the purchase, sale, or merger of a practice stated that client consent is not required in connection with a review of client confidential information in connection with the purchase, sale, or merger of a practice. The member, however, should take appropriate precautions (i.e., use nondisclosure agreements) to protect against the prospective purchaser's disclosing confidential information. New Rule 1.700.001 did not change former Rule 301 and maintained the existing exceptions. However, the revised AICPA code adds 11 interpretations under the rule to provide further guidance on confidentiality issues. These interpretations are largely based on ethics rulings made under the former code. They include: * 1.700.005, "Application of the Conceptual Framework for Members in Public Practice and Ethical Conflicts"; * 1.700.010, "Client Competitors"; * 1.700.020, "Disclosing Information From Previous Engagements"; * 1.700.030, "Disclosing Information to Persons or Entities Associated With Clients"; * 1.700.040, "Disclosing Information to a Third-Party Service Provider"; * 1.700.050, "Disclosing Client Information in Connection With a Review of the Member's Practice"; * 1.700.060, "Disclosure of Client Information to Third Parties"; * 1.700.070, "Disclosing Client Information During Litigation"; * 1.700.080, "Disclosing Client Information in Director Positions"; * 1.700.090, "Disclosing Client Names"; and * 1.700.100, "Disclosing Confidential Client Information as a Result of a Subpoena or Summons." Interpretation 1.700.005 addresses the use of the new Conceptual Framework that is incorporated into the revised AICPA code to help members identify, evaluate, and address threats to compliance with the ethics rules resulting from a specific relationship or circumstance not addressed in the code. Notably, the Conceptual Framework requires members to evaluate whether safeguards can be applied to mitigate a threat of noncompliance. A member will be considered to have violated the Confidential Client Information Rule if the member cannot demonstrate that safeguards were applied to eliminate or reduce significant threats to an acceptable level (see Interpretation 1.700.005). Revised AICPA code Rule 1.000.010, Conceptual Framework for Members in Public Practice, provides additional guidance. This mandate to apply safeguards should give members pause--an unauthorized data breach could certainly represent a threat of noncompliance with the Confidential Client Information Rule. …