CBA interprets 54.1: Board offers FAQs on client confidentiality regs.

• Author: Allen, Bruce C.
• Position: Governmentrelations

The California Board of Accountancy has published Frequently Asked Questions related to Rule 54.1 regarding client confidentiality and the CPAs obligation to protect client information. CPAs should review these answers carefully to ensure that they are in compliance.

For reference, the FAQs and text of rules 54 and 54.1 is provided below. They are also available at www.dca.ca.gov/cba/faqs/faqenfor#Rule_54.1.

Q 1. If a CPA uses an external service provider (separate legal entity) to process confidential information such as tax returns, will written permission from the client be required?

Yes, if confidential information is disclosed to an outside third party, written permission from the client is required.

Q 2. What constitutes written permission?

Any reasonable written document that acknowledges the client is aware that the information may be disclosed and confirms in writing the client's permission for the disclosure. The approval always should be secured in advance of the disclosure. Written consent may be through an engagement letter or in a separate consent agreement. Written permission includes faxes and e-mails.

Q 3. Can the written permission be obtained through the use of an engagement letter that discloses the anticipated use of the external service provider?

Yes, an engagement letter signed and dated by the client could serve as written permission, provided it complies with the requirements of Sec. 54.1.

Q 4. If software, such as tax or accounting software, is typically used wholly within the CPA firm's office, but confidential client information needs to be disclosed to an external technician or software vendor to resolve software problems, will written permission from the client be required?

Yes.

Q 5. If CPAs anticipate that their external service provider will disclose confidential client information to persons or entities outside the U.S., will the fact of anticipated disclosure require specific informed written consent of the client?

Yes. Disclosure of confidential information to persons or entities outside the United States will require written client notification and permission, even if the information will be going to persons within the same firm.

CPAs who use external service providers should always inquire regarding the provider's transfer of information to persons or entities outside the U.S. If it is anticipated that this will occur (CPA or external service provider will disclose), under Sec. 5063.3 and Sec. 54.1, the...