“...ensuring IRS volunteers and their partnering

Privacy,

Confidentiality,

and Civil Rights

- A Public Trust

“...ensuring IRS volunteers and their partnering

organizations safeguard taxpayer information and

understand their responsibilities ...”

Publication 4299 (Rev. 2-2025) Catalog Number 38128T Department of the Treasury Internal Revenue Service www.irs.gov

TABLE OF

CONTENTS

PRIVACY, CONFIDENTIALITY, AND CIVIL RIGHTS – A PUBLIC TRUST

INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1

BACKGROUND . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

PROTECTION AGAINST LEGAL ACTION . . . . . . . . . . . . . . . . . . . . . .

1

PENALTY FOR UNAUTHORIZED DISCLOSURES OR USES . . . . . . . . . . . . . . . 2

PRIVACY AND CONFIDENTIALITY – KEY PRINCIPLES . . . . . . . . . . . . . . . . . 2

TAXPAYER INFORMATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

TAXPAYERS MUST PARTICIPATE IN RETURN PREPARATION . . . . . . . . . . . . . . 2

PRIVACY DURING THE INTERVIEW . . . . . . . . . . . . . . . . . . . . . . . . 3

REQUESTING THE INFORMATION . . . . . . . . . . . . . . . . . . . . . . . . . 3

VALIDATING TAXPAYER(S) IDENTITY AND IDENTIFICATION NUMBER(S) . . . . . . . . . 3

SIGNING THE TAX RETURN . . . . . . . . . . . . . . . . . . . . . . . . . . .

4

SHARING THE INFORMATION . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

SHARING TAXPAYER INFORMATION THROUGH VIRTUAL VITA/TCE CHANNELS . . . . . . 5

TAXPAYER CONSENTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

RELATIONAL EFINS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

CONSENT REQUIREMENTS . . . . . . . . . . . . . . . . . . . . . . . . . . .

7

MANDATORY STATEMENTS . . . . . . . . . . . . . . . . . . . . . . . . . . .

9

CONSENT TO “DISCLOSE” . . . . . . . . . . . . . . . . . . . . . . . . . . 9

CONSENT TO “USE” . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

MAINTAINING CONFIDENTIALITY OF TAXPAYER INFORMATION . . . . . . . . . . . . 10

VITA/TCE SECURITY PLAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

PROTECTING PHYSICAL AND ELECTRONIC DATA . . . . . . . . . . . . . . . . . . 11

MINIMUM SECURITY PRACTICES FOR SAFEGUARDING TAXPAYER DATA . . . . . . . . 13

REPORTING DATA BREACHES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

REPORTING STOLEN AND LOST EQUIPMENT . . . . . . . . . . . . . . . . . . . . . . 16

STOLEN AND LOST INFORMATION – TAXPAYER NOTIFICATION . . . . . . . . . . . . 16

PROTECTION OF PARTNER/VOLUNTEER INFORMATION . . . . . . . . . . . . . . . . 17

RELEASE OF PARTNER INFORMATION . . . . . . . . . . . . . . . . . . . . . . 17

VOLUNTEER STANDARDS OF CONDUCT . . . . . . . . . . . . . . . . . . . . . 17

POTENTIAL CONSEQUENCES OF NONCOMPLIANCE . . . . . . . . . . . . . . . . . . 18

TABLE OF

CONTENTS

REFERRING PROBLEMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

VOLUNTEER SAFETY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

FORM 13533, PARTNER SPONSOR AGREEMENT . . . . . . . . . . . . . . . . . . . . 19

FORM 13533-A, FSA REMOTE SPONSOR AGREEMENT . . . . . . . . . . . . . . . . . 19

STATEMENT OF ASSURANCE CONCERNING CIVIL RIGHTS COMPLIANCE . . . . . . 19

STATEMENT OF ASSURANCE FILING REQUIREMENT . . . . . . . . . . . . . . . . 20

DATA COLLECTION REQUIREMENTS . . . . . . . . . . . . . . . . . . . . . . . 21

REFERENCE MATERIALS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

EXHIBIT 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

EXHIBIT 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

EXHIBIT 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

EXHIBIT 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Privacy, Confidentiality, and Civil Rights

– A Public Trust

Introduction

The Internal Revenue Service (IRS) sponsors the Volunteer Income Tax Assistance (VITA) and the Tax Counseling for

the Elderly (TCE) Programs that provides free tax return preparation for low to moderate income and elderly taxpayers.

Details governing the operation of these two programs exist in various resource materials; however, both programs must

guarantee confidentiality of taxpayer information to protect public trust. This document addresses areas where partners and

volunteers need to exhibit diligence to details when administering the requirements of these programs.

Section 7216 of the Internal Revenue Code (IRC) and a related provision, IRC 6713, provide penalties against tax return

preparer who make unauthorized use or disclosure of tax return information. A tax return preparer covered by IRC 7216

and 6713 can include a person who prepares tax returns or assists in preparing tax returns, whether or not a fee is

charged for preparing a tax return.

Background

Information provided by individual taxpayers to a VITA/TCE volunteer is not considered “return information” protected by

IRC 6103 until the IRS receives, records or collects it. However, VITA/TCE volunteers are subject to the criminal penalty

provisions of 18 USC 1905 for any improper disclosures of this information. It is critical to the programs’ success to ensure

volunteers and their partnering organizations safeguard taxpayer information and understand their responsibilities.

Taxpayers using volunteer program services provide Personally Identifiable Information (PII) to the volunteers, such as

names, addresses, Social Security Numbers (SSN), birth dates, and bank account information. This type of information

is a prime target for identity theft. Therefore, partners and volunteers must keep the information confidential and protect

it from unauthorized individuals and misuse. Partners and volunteers must minimize the retention of any taxpayer PII

records unless the taxpayer provides written consent to disclose and use as explained under Taxpayer Consents.

Protection Against Legal Action

Public Law 105-19, Volunteer Protection Act of 1997 (VPA) generally protects volunteers from liability for negligent acts

they perform within the scope of their responsibilities in the organization for whom they volunteer. The VPA is not owned

or written exclusively for Internal Revenue Service. This is a Public Law and relates to organizations that use volunteers to

provide services.

Under the VPA, a “volunteer” is an individual performing services for a nonprofit organization or a governmental entity

(including as a director, officer, trustee, or direct service volunteer) who does not receive for these services more than

$500 total in a year from the organization or entity as:

a. Compensation (other than reasonable reimbursement or allowance for expenses actually incurred), or

b. Any other thing of value in lieu of compensation.

Although an individual may not fall under the VPA definition of a “volunteer,” which means they may not be protected

under the VPA, the VITA/TCE Programs still considers them volunteers. To ensure protection, those who do not fit this VPA

volunteer definition must seek advice from their sponsoring organization’s attorneys to determine liability protection rights.

1

Penalty for Unauthorized Disclosures or Uses

IRC 7216(a) imposes criminal penalties on tax return preparers who knowingly or recklessly make unauthorized

disclosures or uses of information furnished in connection with the preparation of an income tax return. A violation of IRC

7216 is a misdemeanor, with a maximum penalty of up to one year imprisonment or a fine of not more than $1,000, or

both, together with the cost of prosecution.

Privacy and Confidentiality – Key Principles

To maintain program integrity and provide for reasonable protection of information provided by the taxpayers serviced

through the VITA/TCE Programs, it is essential that partners and volunteers adhere to the strictest standards of ethical

conduct and the following key principles.

•

Partners must ensure site coordinators are aware of security requirements covered in Publication 4299

and hold discussions with volunteers at the sites to review the requirements.

•

Partners and volunteers must keep confidential the information provided for tax return preparation.

•

Partners and volunteers must protect physical and electronic data gathered for tax return preparation both

during and after the filing season.

•

Partners using or disclosing taxpayer data for purposes other than current, prior, or subsequent year tax

return preparation must secure the taxpayer’s consent to use or disclose their data. Refer to the section on

Taxypayer Consents later in this publication for exceptions to securing the taxpayer’s consent.

•

Partners and volunteers must delete taxpayer information on all computers (Bring Your Own Device

(BYOD), partner owned and IRS loaned) after filing season tax return preparation activities end.

•

Partners and site coordinators must keep confidential all personal information the taxpayer provides.

Taxpayer Information

Partners and volunteers must keep confidential the information taxpayers provide for tax return preparation.

Taxpayers Must Participate in Return Preparation

Volunteers must prepare all tax returns at the site with the taxpayer present unless (1) preparing a joint return for a

married couple with one taxpayer present at the site or (2) preparing a return for a minor child in the presence of the

child’s parent or guardian or (3) when using an approved Virtual VITA/TCE service model (please note the exceptions for

Virtual VITA/TCE service model options in the paragraph below). Otherwise, VITA/TCE sites must not prepare a tax return

without the taxpayer’s participation even if the taxpayer authorized another person to represent them for the preparation of a

tax return.

Exception: Having the taxpayer present in the preparer’s site when the tax return is being prepared is not always

possible. In these cases, Virtual VITA/TCE Models offer alternative options to prepare returns without in person

contact with the taxpayer. Certified volunteers may interview taxpayers over the phone while preparing their returns.

The alternative filing methods partners choose to prepare returns must be approved by the responsible IRS Territory

Manager to ensure all procedures are in place as described in the Quality Site Requirements (QSR). Most importantly, the

taxpayer’s and government’s interests must be properly protected. Adequate security and privacy is expected to ensure

taxpayer records are properly safeguarded. Refer to Publication 5450, VITA/TCE Site Operations, for more information on

Virtual VITA/TCE Models.

In situations where a taxpayer presents information not sufficient to complete the return, the volunteer must return all

documents to the taxpayer with instructions to return to the site with all required documents for completion of the tax return.

2

Privacy During the Interview

To the extent possible, arrange tax preparation assistance areas to prevent others from easily overhearing or viewing the

information under discussion. Partners must ensure that taxpayer privacy is protected when sharing personally identifiable

information (PII) such as SSNs, address, bank account numbers, etc. During conversations with taxpayers, volunteers

must not discuss PII information out loud. For example, volunteers can point to the computer screen or supporting

document containing the PII information and the taxpayer could verify if the information is correct. While arranging the

layout of the VITA/TCE site, plan how you will accommodate taxpayers who may need more space or privacy. (Examples:

a deaf or hard of hearing taxpayer with one or more sign language interpreters, a limited English proficient taxpayer that

requires a language interpreter, a blind/visually impaired taxpayer with a service dog, or a taxpayer in a wheelchair).

Refer to the Site Coordinator’s Corner on www.irs.gov for additional information on how to accommodate taxpayers

with disabilities and limited English proficiency. Volunteers requesting assistance to complete a tax return must maintain

privacy during discussions.

Requesting the Information

When preparing tax returns, only request necessary and relevant information. The taxpayer provides their information

trusting the volunteer will not share or use the information in an unauthorized manner.

Tax return preparation requires taxpayer’s to provide information such as name, address, Social Security Numbers (SSN),

birth dates, marital status, bank account information for direct deposit, and other basic information. Volunteers must use

documents such as government issued photo ID, employer ID, school ID, social security cards, and ITIN letters to ensure

identity and accuracy.

Validating Taxpayer(s) Identity and Identification Number(s)

All volunteers must follow validation procedures prior to tax return preparation and before a taxpayer may sign or receive

a copy of a VITA/TCE prepared tax return.

IRS-tax law certified volunteers preparing tax returns must confirm the identity of each taxpayer signing the tax return to

prevent identity theft and tax fraud. The volunteer must review an original photo identification (ID) such as valid driver’s

license (U.S.), employer ID, school ID, state ID (U.S.), Military ID, national ID, visa, or passport. Volunteers must use

judgment when accepting any other valid form of identification. If a taxpayer cannot substantiate his/her identity, or if the

volunteer is uncomfortable accepting the items presented as proof of identity, the taxpayer must be advised to return

with an acceptable form of identification. Exceptions to requiring an original photo ID must only be made under extreme

circumstances and require site coordinator approval. For example, the site coordinator can confirm the identity of an

elderly person with a disability who has an expired driver’s license or passport but provides a valid birth certificate.

IRS-tax law certified volunteers preparing tax returns must also verify the taxpayer identification numbers (TIN) and the

correct spelling of names of all individuals listed on the tax return. Taxpayers must provide original or copies (paper or

electronic) of social security cards or an acceptable substitute such as Form SSA-1099 and/or any other verification

issued from the SSA. SSA verification documents with a truncated SSN (such as ***-**-1234) can be used as acceptable

documents at the site coordinator’s discretion. For taxpayers or dependents who do not qualify for an SSN, the volunteer

must review an IRS-issued ITIN card or letter or assist with applying for an ITIN. The mismatch of names and SSN or ITIN

information is one of the top reasons for delays in processing electronic tax returns.

Exception for validating identity and/or confirming TIN for taxpayers known to the site: The site coordinator has

the discretion to grant an exception to the requirement to provide a valid form of identification and/or the requirement to

provide proof of taxpayer identification number if the taxpayer is known to the site. The definition of “known to the site”

refers only to a taxpayer that frequently visits the same site every year for tax return preparation and is known to the site

3

coordinator or the volunteers at the site. Only the site coordinator has the authority to approve these exceptions. Just

because a taxpayer’s return was prepared at a site in a prior year, it does not automatically qualify as “known to the site”.

Example of known to the site: Larry goes to the local VITA/TCE site to have his taxes prepared and forgot his

Social Security card. Larry has been a client at this site for several years and knows the site coordinator The

volunteer at the intake desk asks for Larry’s Social Security card. Larry doesn’t have it. The volunteer gets approval

for Larry to be covered under Known to the Site from the site coordinator as the site coordinator knows Larry. The

volunteer notes the exception in the notes on Form 13614-C, Intake/Interview and Quality Review Sheet.

Example of not known to the site: Sally goes to the local VITA/TCE site to have their taxes prepared. They

forgot their identification and Social Security card. The coordinator does not know Sally, the known to site

exception doesn’t apply and Sally must return home to bring back their identification and Social Security card.

Partners and coordinators may maintain more stringent requirements for validating proof of identity and verifying a TIN. In

addition, if there is an increase in identity theft returns at a particular site or in a particular area, IRS may require stronger

requirements to deter this activity.

Signing the Tax Return

A taxpayer may sign a VITA/TCE-prepared tax return, whether a paper-filed tax return or Form 8879 for an e-filed tax

return, only upon completion of these validation procedures.

•

No tax return may be electronically filed unless all taxpayers sign Form 8879 giving permission to have their

tax return e-filed.

•

A parent or guardian of a minor child may sign Form 8879 or the tax return for the child by including the

statement, “By (parent/guardian’s signature), parent/guardian for minor child”, in the signature section of the

tax return. For additional information, see Publication 17, Your Federal Income Tax (For Individuals).

•

If two taxpayers file a joint tax return, one taxpayer may sign the tax return for a missing spouse if authorized

by Form 2848, Power of Attorney and Declaration of Representative, or a written statement (with the same

information) but only if the missing spouse is:

1. Unable to sign a tax return due to disease or injury (Form 2848 must be prepared in advance, while the

taxpayer is able to sign), or

2. Absent continuously from the U.S. (including Puerto Rico) for a period of at least 60 days prior to the due date

of the tax return.

Note: When a spouse signs Form 8879 under authority provided by Form 2848 or a written statement, Form

8453, U.S. Individual Income Tax Transmittal for an IRS e-file Return, must be mailed to the IRS with a copy of

Form 2848 or the written statement.

•

If taxpayers filing a joint tax return do not meet the above exception, both must be present at the site to

validate proof of their identity and verify their TIN and then sign their tax return. They do not have to be at the

site at the same time or on the same day, to do this. However, the tax return must not be e-filed, nor a copy

provided to the taxpayer(s) until both signatures are secured on the tax return or on Form 8879, IRS e-file

Signature Authorization.

Exception for signing the return for taxpayers known to the site:

• A taxpayer who is filing a joint tax return can be given permission by the site coordinator to take Form

8879 to a missing spouse to secure his or her signature if both taxpayers are known to the site. However,

the tax return cannot be e-filed for the taxpayers until both signatures are secured on Form 8879.

• If they choose not to return with Form 8879, the site can prepare a paper tax return and provide two

copies to the taxpayers. The volunteer must show the taxpayers where to sign their names on Form 1040

and provide the appropriate IRS processing center address for mailing.

4

Sharing the Information

Do not share information the taxpayer provides for tax return preparation with anyone who does not have a need to know.

Individuals have a need to know if processing the information to its final disposition requires their involvement. Examples

of “need to know” include sharing information for the purpose of obtaining guidance in tax return completion; electronically

transmitting the return; and reviewing a tax return and source documents used to prepare the return. This includes returns

submitted through the Virtual VITA/ TCE Model when a taxpayer is not present.

It is not acceptable to share information with others, even another volunteer, if the tax return preparation does not require

their involvement. For instance, sharing income information, birth dates, or even the marital status of taxpayers with other

volunteers, taxpayers, family, or friends as a matter of curiosity or interest, is not acceptable.

Sharing Taxpayer Information Through Virtual VITA/TCE Channels

Information sharing is normally done in-person in the VITA/TCE program. However, there may be situations where other

communication channels may be more efficient in the process of preparing, completing and filing tax returns. Any process

used under Virtual VITA/TCE must be documented on the Form 14446, Virtual VITA/TCE Taxpayer Consent, and signed

by the taxpayer. Please refer to Publication 5450, VITA/TCE Site Operations for the Virtual VITA/TCE Return Preparation

Models that maybe utilized.

Sites must outline in detail their virtual process on Form 15272, VITA/TCE Security Plan. The territory manager or

designee must approve the plan prior to implementation at the site. The volunteer must explain the virtual process to the

taxpayer. Volunteers must advise the taxpayer of the risks of using virtual methods for sharing information (lost/stolen

packages, accidents, information received/accessed by an unintended recipient) so they can make an informed decision

about how best to proceed with the preparation of their tax return. Sites must implement reasonable controls to ensure the

security of information sharing between parties.

Please refer to the list of communication channels (below) that may be used when operating a virtual VITA/TCE

Preparation Model.

1. US Mail:

• Permitted to send information between sites, and between sites and taxpayers.

• Volunteers must consider the use of certified mail when communicating with the taxpayer under the

following circumstances:

• Site is mailing personally identifiable information back to the taxpayer.

• Site is unable to advise the taxpayer beforehand that the personally identifiable information will

be mailed.

• Taxpayers must be encouraged to use certified mail when sending information back to the site.

2. Courier (in-house or nationally/locally recognized delivery service):

• Permitted to share information between parties.

• Using a courier service provides additional safeguards such as package tracking and delivery confirmation.

3. Email:

• Permitted. Both parties must consider using a supplemental program that secures the message with a password.

• Before emailing information to taxpayers, the volunteer and taxpayer must agree on passwords/identifiers

to ensure the secure transmission of information between parties.

• Volunteers must not use a public computer to send email.

• Sensitive email messages must be deleted from the computer and/or server use a once they are no longer

needed.

5

4. Telephone (Voice Communications):

• Permitted to share information.

• The volunteer and the taxpayer must use a password/identifier when communicating via telephone to

clarify personally identifiable information the volunteer needs to prepare, review, and or submit the return.

• The volunteer and taxpayer can use the same password/identifier combination for email transmissions as

with telephone communications.

• When any call is made between the volunteer and the taxpayer, each party must share their password before

discussions begin about the taxpayer’s return or other personally identifiable information.

• If the taxpayer cannot provide the password/identifier, the volunteer must inform the taxpayer that the call

cannot continue, ask the taxpayer to locate the correct password, and courteously disconnect the call.

• If the taxpayer cannot subsequently locate their password/identifier, they must return to the site to provide

the necessary information to complete the return preparation process. The site also has the option to use

another virtual method to verify the taxpayer’s identity.

• If taxpayers call a volunteer site unprompted (without an authentication protocol in place), the volunteer

must advise the taxpayer that they cannot discuss the taxpayer’s return and that they must return to the

site to resolve their issue.

5. Telephone (Text Communications):

• Sites must not initiate contact via text unless using a secure text messaging software. The site must

advise the taxpayer of the risk involved when using unsecure text messaging.

• If the taxpayer initiates contact via text, the site must advise the taxpayer of the risk of sharing personally

identifiable information via text message. Volunteers must delete all text messages when no longer needed.

6. Fax Machine:

• Permitted to share information.

• Volunteers must advise taxpayers of the risks of using a public fax machine to transmit documents (data

may remain in the queue while forms are being faxed).

• The volunteer or taxpayer must be present to receive the fax when using a public fax machine.

Individuals must be advised about the risks of transmitting documents to an unattended fax machine.

7. Video Conferencing System:

• Permitted to share information.

• Must have a video conferencing identification number and password.

• Taxpayer must consent to use of video conferencing to share their PII.

• Must encrypt all taxpayer data.

• Data must not be saved or stored.

• Partners who use this channel must consider options (such as closed captioning or chat features) that

allow hearing-impaired clients to use this technology effectively. Note that there may be costs incurred for

using these options.

• Volunteers may authenticate the taxpayer’s by validating the photo ID with the video picture of the taxpayer.

8. File Sharing System:

• Permitted to share information.

• Partners must use a program that maintains minimally–acceptable levels of security (user authentication

with password, 128-bit encryption, and audit trail capability) that monitors user activities. Partners must

ensure all taxpayer data is encrypted prior to uploading and downloading in file sharing programs. Some

file sharing programs charge a fee.

• Volunteers must delete all information once tax return preparation is complete.

6

Taxpayer Consents

Treasury Regulations under 26 § CFR 301.7216-2 provides rules relating to the tax return preparers’ use and/or

disclosure of tax return information without taxpayer consent. The regulations include rules on maintaining and compiling

lists for solicitation of tax return preparation services and disclosure and use of statistical compilations of data in support

of their tax return preparation business.

The statute limits tax return preparers’ use and disclosure of information obtained during the return preparation process to

activities directly related to the preparation of the return. The regulations describe how preparers, with the informed written

consent of taxpayers, may use or disclose return information for other purposes. The regulations also describe specific

and limited exceptions that allow a preparer to use or disclose return information without the consent of taxpayers.

Exception: All volunteer sites using or disclosing anonymous aggregate data for fundraising, marketing, publicity,

or other uses related to the volunteer sites’ tax return preparation business are not required to secure the taxpayers’

consent. Under the regulations, a statistical compilation is anonymous if it does not include any personally identifiable

information, such as the taxpayer’s name, SSN/ITIN, address or other personal information, and does not disclose cells

containing data from fewer than ten tax returns. This exception does not apply to the use or disclosure in marketing

or advertising of statistical compilations containing or reflecting dollar amounts of refund, credit, or rebate, or

relating to percentages.

Tax return preparers must obtain consent from the taxpayer before using or disclosing tax return information. Sites must

provide tax return preparation services regardless of the taxpayer’s decision. However, the services provided may be

limited to tax return preparation and tax return preparers must not use or disclose their data. Each partner must evaluate

the uses of taxpayer information against IRC 7216 requirements to ensure compliance.

Relational EFINs

Electronic filing sites using relational EFINs with their tax preparation software must solicit consent to “Disclose”. The

relational EFIN process requires the tax preparation software provider share the return data with a third party, the primary

sponsor. This sponsor must comply with IRC Sec. 7216 regulations. The taxpayer must consent to disclose their data prior

to e-filing the tax return. If the taxpayer does not grant consent, or does not enter the PIN and date at a VITA or non-TaxAide TCE site, the site cannot e-file the return because the relational EFIN process shares the data with the preparing site

and the primary sponsor at the point the return is acknowledged.

Consent Requirements

Revenue Procedure 2013-14 provides the mandatory language required in a consent to disclose or a consent to use tax

return information with respect to a Form 1040-series income tax return. A taxpayer need not sign a consent to engage a

tax return preparer to perform tax return preparation services if the preparer and taxpayer do not plan for the preparer to

disclose or use the taxpayer’s tax return information for any purpose other than preparing a return.

Partners must provide written notice to the taxpayer and receive signed consent on both notices when using or disclosing

taxpayer information for purposes other than preparing tax returns (current, prior, or subsequent year), fundraising, and/or

marketing activities in accordance with Treasury Regulation under IRC 7216. Both notices require taxpayer consent and

must contain specific language for the particular use and disclosure.

7

The two types of consents are as follows:

1. Consent to “Disclose”, taxpayer information. Disclose means the giving out of information, either voluntarily or to be

in compliance with legal regulations or workplace rules, and,

2. Consent to “Use” taxpayer information. Use means the act or practice of employing something.

These notices cannot be combined. They must be kept separate. Consents must meet the minimum requirements

provided in 26 CFR 301.7216-3(a)(3) and must include the requirements defined in Revenue Procedure 2013-14 or its

successor. The consent must:

• Identify the intended purpose of the disclosure or use.

• Identify the recipients and describe the specific authorized disclosure or use of the information.

• Identify the specific taxpayer information to be used or disclosed.

• Include the mandatory language outlined in Rev. Proc. 2013-14 or its successor.

• Include the consent duration if other than one year.

• Use 12-point type font on 8 ½ by 11-inch paper or, for an electronic consent, be in the same type as the

web site’s standard text; and include the taxpayer’s signature and date.

Disclosure and use require separate consents, although multiple uses may be included in the same use consent and

multiple disclosures may be included in the same disclosures consent. (Note: Multiple disclosures consents and multiple

use consents must provide the taxpayer with the opportunity, within the separate written document, to affirmatively select

each separate disclosure and use.)

Consent notices are valid for one year unless otherwise specified in the written notice to the taxpayer. There’s no legal

requirement to retain a taxpayer’s written consent for any specified time period. Instead, return preparers must retain each

signed consent for as long as needed to show the taxpayer or the government that the taxpayer consented to certain

actions the partner later took. SPEC recommends partners consider maintaining signed copies of consent notices for at

least three years after the disclosure and/or use of taxpayer information. Partners can maintain consent notices in paper

or electronic format. If the site chooses not to maintain the consent, the site may give the signed paper consent form to

the taxpayer.

Partners must consult with their legal advisors about the risks of not maintaining consents (electronic or paper) if a

taxpayer or the government brings a legal action and the partner has not printed or electronically saved its own copy of

the signed consent.

During the return preparation process, the preparer must enter the taxpayer’s PIN based on the taxpayer’s preference,

confirming the taxpayer’s decision. (Note: Preparers can only enter the taxpayer’s PIN on behalf of the taxpayer when the

taxpayer has signed a paper consent. If the taxpayer does not sign a paper consent, the taxpayer must enter his or her

own PIN in the tax preparation software if he or she is granting consent.)

If the preparer is entering the consent PIN and date into the tax preparation software the taxpayer must sign and date

a paper consent form before entering the consent PIN and date into the tax preparation software when the taxpayer is

granting consent. The site may give the signed paper consent form to the taxpayer or maintain it at the site. Whether the

signed copy is given to the taxpayer or maintained at the site, the preparer must provide a copy of the consent in the tax

preparation software with the PIN for his/her records. Note: There is no requirement the taxpayer must sign a consent if

he or she is not granting consent.

8

Requirements for Consent to Use and Disclose Taxpayer Information

Requires a

Consent to

Use?

Requires a

Consent to

Disclose?

Requires a signed paper

consent(s) if volunteers

are entering the PIN?

Preparing current, prior, or subsequent

year returns

No

No

No

Purposes other than prior, current, or

subsequent year returns

Yes

Yes

Yes

Reporting the number of returns

(number of types of returns such as

Earned Income Tax Credit (EITC), Child

Tax Credit (CTC), Prepared to use for

fundraising, marketing, publicity, or other

uses related to the volunteer sites tax

return preparation business.

No

No

No

Reporting any data containing return

dollar amounts for marketing or

advertising or any other non-fundraising

activities.

Yes

Yes

Yes

Reporting any data containing return

dollar amounts for fundraising activities.

No

No

No

Global Carry-Forward Consents

No

Yes

Yes

Relational Electronic Filing Identification

Number (EFIN) Consents

No

Yes

Yes

Using and Disclosing Taxpayer

Information:

Mandatory Statements

Partners must include the following statements in the consents to disclose and consents to use tax return information.

Select one of the following consent statements to Disclose (whichever applies) and the consent statement to Use for the

taxpayer’s signature.

Consent to “Disclose” (such as, financial aid, establishment of a bank account, other

government agency assistance or bank products):

Required Statements:

Federal law requires this consent form be provided to you. Unless authorized by law, we cannot disclose your tax return

information to third parties for purposes other than the preparation and filing of your tax return without your consent. If

you consent to the disclosure of your tax return information, Federal law may not protect your tax return information from

further use or distribution.

You are not required to complete this form to engage our tax return preparation services. If we obtain your signature on

this form by conditioning our tax return preparation services on your consent, your consent will not be valid. If you agree

to the disclosure of your tax return information, your consent is valid for the amount of time that you specify. If you do not

specify the duration of your consent, your consent is valid for one year from the date of signature.

9

If you believe your tax return information has been disclosed or used improperly in a manner unauthorized by law or

without your permission, you may contact the Treasury Inspector General for Tax Administration (TIGTA) by telephone at

1-800-366-4484, or by e-mail at complaints@tigta.treas.gov.

Consent to “Use” (such as, financial aid, establishment of a bank account, other

government agency assistance or bank products):

Required Statements:

Federal law requires this consent form be provided to you. Unless authorized by law, we cannot use your tax return

information for purposes other than the preparation and filing of your tax return without your consent.

You are not required to complete this form to engage our tax return preparation services. If we obtain your signature on

this form by conditioning our tax return preparation services on your consent, your consent will not be valid. Your consent

is valid for the amount of time that you specify. If you do not specify the duration of your consent, your consent is valid for

one year from the date of signature.

If you believe your tax return information has been disclosed or used improperly in a manner unauthorized by law or

without your permission, you may contact the Treasury Inspector General for Tax Administration (TIGTA) by telephone at

1-800-366-4484, or by e-mail at complaints@tigta.treas.gov.

Multiple Disclosures or Multiple Uses Within a Single Consent Form:

A taxpayer may consent to multiple uses within the same written document or multiple disclosures within the same written

document.

• You must provide disclosure consents and use consents in separate documents.

• Multiple disclosure consents and multiple use consents must provide the taxpayer with the opportunity,

within the separate written document, to affirmatively select each separate disclosure or use.

• You must provide the taxpayer the mandatory consent language for each separate disclosure or use.

• The mandatory statements need only be stated once in a multiple disclosure or multiple use consent.

Disclosure of Entire Return:

If a consent authorizes the disclosure of a copy of the taxpayer’s entire tax return or all information contained within

a return, the consent must provide that the taxpayer has the ability to request limits on what tax return information is

disclosed.

Refer to Publication 5683, VITA/TCE Handbook for Partners and Site Coordinators, for specific guidance on mandatory

consents in the tax preparation software (including Global and Relational EFINs consents).

Maintaining Confidentiality of Taxpayer Information

VITA/TCE Security Plan

All VITA/TCE sites, except Facilitated Self Assistance (FSA) remote sites, must prepare an annual security plan to

safeguard taxpayer data. Sites can use Form 15272, VITA/TCE Security Plan or a similar document which captures

the same information to meet this requirement. The security plan contains two sections: Section I – Security

Requirements and Section II – Virtual VITA/TCE Process. All sites must complete Section I- Security Requirements

which provides information on the procedures the site uses to help maintain the security of taxpayer information. Any

site using a virtual process must also complete Section II- Virtual VITA/TCE Process which must outline the entire

virtual model the site uses to assist taxpayers. For additional information on the virtual models see Publication 5450,

VITA/TCE Site Operations. All partners must approve the security plan. The site coordinator must sign the form and

10

submit the form to their SPEC territory manager (or local SPEC designee) prior to opening of the site but no later than

December 31.

Sites must also identify the type of equipment and the total count of each type used to support the VITA/TCE program.

This includes partner owned, IRS owned, and volunteer owned equipment. There is an equipment inventory form

Exhibit 4 in this document that sites can use to track all equipment the site uses.

The local territory office must approve the security plan before the site opens. Volunteers must be familiar with the

security plan policies to keep taxpayer information secure and confidential.

Protecting Physical and Electronic Data

Technology comes with inherent risks. IRS and, if applicable, local governments require e-file sites to maintain certain

taxpayer information. These requirements pertain to both electronic and printed data. This requirement increases the

responsibility of all volunteers and partners to be vigilant in safeguarding the information. Protection involves the physical

protection of the equipment used, as well as the protection of the electronic data. Partners and volunteers must protect

physical and electronic data gathered for tax return preparation both during and after the filing season.

Volunteers and sponsors must protect individual information during return preparation and once the tax return is

complete. Protecting the information is not limited to preventing theft but to ensuring the information is recoverable.

If on-line tax preparation software is not used, partners must regularly make backup copies of the data they process

in the event of computer failure. The tax software provided by IRS for tax preparation automatically encrypts tax data

whether it is stored on the user’s computer or on removable media. This action reduces the chance that the taxpayer

could be harmed by the inability to file a return.

Partners and volunteers must take the following steps to protect both printed and electronic data when using the methods

below to retain taxpayer data.

• Printed Media – Secure printed documents containing taxpayer information during and after operating hours.

• Ensure Forms 8879 and 13614-C, along with any related information, is not inadvertently

revealed to others. There is no requirement for VITA/TCE volunteers to retain Form 8879, IRS

e-file Signature Authorization and supporting documents such as Form 13614-C, Form W-2

and Form 1099. The taxpayer(s) must sign and date Form 8879, after reviewing the return and

confirming the information is accurate. The volunteer must return the signed Form 8879 to the

taxpayer along with a copy of their tax return. Forms 8879 are not sent to the IRS.

• Store paper documents away from the flow of traffic, and out of the reach of clients who may

inadvertently retrieve these documents with their own papers. Documents retained after the

volunteer leaves the site must be stored in locked cabinets.

• Protect reports showing Submission ID Numbers and e-file Acknowledgments. Note: Any

sensitive information not returned to the taxpayer or authorized by the taxpayer to be kept for

retention by the site, must be shredded or burned when no longer needed.

• Ensure volunteers do not maintain copies of tax returns (electronic or paper) and any

related information unless it complies with IRC 7216 or return retention guidelines outlined

in Publication 1345, Handbook for Authorized IRS e-file Providers of Individual Income Tax

Returns.

• Stored Data – Take basic steps to protect data stored on your systems. Use drive encryption to lock files

and all devices including mobile devices; encrypted files require a password to open.

• Avoid attaching USB drives and external drives with client data to public computers.

• Avoid installing unnecessary software or applications to the business network; avoid offers

for “free” software, especially security software, which is often a ruse by criminals; download

software or applications only from official sites.

11

• Perform an inventory of devices that store client tax data, i.e., laptops, smart phones, tablets,

external hard drives, etc.; inventory software used to process or send tax data, i.e., operating

systems, browsers, applications, tax software, web sites, etc.

• Limit or disable internet access capabilities for devices that have stored taxpayer data.

• Delete all information from devices, hard drives, USBs (flash drives), printers, tablets or

phones before disposing of devices; some security software include a “shredder” that

electronically destroys stored files.

• Portable Mass Storage Devices (PMSD) – Encrypt and protect PMSD, such as external hard drives

(CDs, DVDs, USBs) or cloud storage.

• Place identification labels on the PMSD and establish a system to control and account for them.

• Store devices in a secure location to prevent theft/loss of information. If using the cloud,

encrypt the data before uploading.

• Destroy hard drives, tapes, USBs, CDs, tablets or phones by crushing, shredding or burning;

shred or burn all documents containing taxpayer information before throwing away.

• Electronic Information Stored on Computers – Taxpayer information stored on computers may be

subject to unauthorized access. The ERO should work with the site coordinator to ensure every possible

precaution is in place to protect taxpayer information and privacy. Desktop software encrypts data stored

in Desktop; however, the same precautionary measures must be taken regardless of which software is used.

• Use antivirus and firewall software on all computers used for tax preparation and when

connecting to the Internet to prevent unauthorized access.

• Use of online software requires that online providers follow the six security and privacy

standards in Publication 1345; however, below are some general steps for staying safe while

using the Internet to access your Online software.

■

■

■

■

Keep your web browser software up to date so that it has the latest security features.

If your browser homepage changes, it could be a sign of malware or an intrusion.

Scan files using your security software before downloading to your computer.

Delete web browser cache, temporary internet files, cookies and browsing history on a

regular schedule.

Look for the “S” in “HTTPS” connections for Uniform Resource Locator (URL) web

addresses. The “S” stands for secure, e.g., https://www.irs.gov.

■

Avoid accessing emails or information from public wi-fi connections.

■

Disable stored password feature offered by some operating systems.

■

■

Enable your browser’s pop-up blocker. Do not call any number from pop-ups claiming your

computer has a virus or click on tools claiming to delete viruses.

Do not download files, software or applications from unknown websites.

• Networking Desktop Software - We strongly encourage partners to use IRS loaned computers when

using desktop software to protect taxpayer PII. Using LANs at sites is also recommended. A sub-network

with its own router creates a secure system, separate from your site host’s computers and simplifies

printer setup. Using a LAN for Desktop software also has numerous advantages especially for the e-file

site manager, as listed below:

• Only one computer holds the data;

• Only one computer requires Desktop updates;

• Only one computer needs to be backed up;

• All networked computers have access to all returns when the network is running;

• Quality Review can be conducted from any one of the networked workstations;

12

• Printer sharing is easy as printer switches are not required. NOTE: When using network printers,

always set them up with a “static IP address” to ensure the printer will not be “lost” by the

network when a router can randomly reassign IP addresses each time the network is setup.

• File Sharing – Peer-to-peer (P2P) file sharing is a popular way to exchange or “share” files. Any software

or system allowing individual users of the Internet to connect to each other and trade files is considered

P2P. This includes applications that allow users to immediately communicate with each other via instant

messaging and those that allow multiple computers to pool their processing power and memory to create

a supercomputer. Before using P2P file sharing ensure you understand the risks. P2P software causes

problems that may not be fully understood. Some files can be made public using this software. Therefore, all

volunteers must properly protect non-IRS computers. Use of P2P applications introduce security risks, such as:

• Exposing data/system to viruses/malicious code;

• Placing personal and/or sensitive information at risk of unauthorized access;

• Imposing capacity constraints on computers and networks.

• Encryption Software – Desktop and Online software encrypts all taxpayer information; the use of

separate encryption software is not necessary. Each partner needs to self-assess the risk to determine if

they will continue to use encryption software on the computer hard drives used for tax return preparation.

The IRS loaned computers will continue to use encryption software to protect the whole disk on these

computers as required by current government policy.

Minimum Security Practices for Safeguarding Taxpayer Data

Partners and volunteers must implement a process that protects the taxpayer’s information. The process must include:

• Securing taxpayer data on computer systems

• Position computer screens so unauthorized individuals cannot see taxpayer information.

• Require computers which store taxpayer information be password protected to prevent

unauthorized access. The ERO must work with the Site Coordinator and/or volunteers to

develop a system that uses strong passwords. Volunteer must change their passwords

periodically (at a minimum, every 90 days) or as required to protect taxpayer information.

Desktop software requires the use of a strong password. A strong password must:

■

Include at least 8 characters and include numbers or symbols. The longer the password,

the tougher it is to compromise.

■

Avoid common words - some hackers use programs that can try every word in the dictionary.

■

Not use personal information, your login name, or adjacent keys on the keyboard as passwords.

• Do not post the passwords on or near equipment or in a laptop case.

• Do not put passwords in an automatic script routine or program.

• Each user must have a unique username and unique password. Administrator passwords

must be unique and only known to select Admin level users. Partners must have a process in

place to identify every volunteer that prepares or make changes to every tax return.

• Multi-factor authentication (MFA) should be used whenever there is an option. An example of

two-factor authentication requires your username and password plus a security code sent as

a text to your mobile phone before you can access an account. IRS tax preparation software

currently uses (MFA). It is a requirement for ALL professional web-based software providers.

• Sign off and lock equipment when not in use. Use screen savers and automatic computer

lockout after a preset period of inactivity.

• Ensure computers and printers always remain in the control of a volunteer while in use and

stored in a controlled, limited access (preferably) locked location when not in use.

• Ensure information is not accessible to general computer users that share equipment.

• Ensure computer settings do not store passwords and any other key data that could provide

access to information on the computer.

13

• Keep devices (i.e. diskettes, CDs, flash drives, pen drives, key drives, thumb drives, etc.)

containing taxpayer information secure and password protected.

• Using tax preparation software security features

• Modify users’ permissions, as appropriate, to ensure users only have the necessary

permissions to perform their duties. To minimize security risks volunteers should not have

multiple user roles in the tax software.

• Partners using IRS provided tax preparation software are strongly encouraged to use the prepopulated security templates for both volunteer preparers and administrators. These templates

were created to maximize the security of return information. Volunteer access to taxpayer data

should generally be limited outside of site operating hours.

• When volunteers quit, resign, or are no longer working at the site, the ERO or Site Coordinator

must immediately deactivate their usernames.

• The site must not use generic use names or passwords, such as “volunteer”.

• Storing and disposing of taxpayer data

• Ensure the information provided during tax return preparation always remain under the care of

the volunteer. Documents retained after the volunteer leaves the site must be stored in locked

cabinets. These documents include but are not limited to tax returns, Forms W-2, W-8 BEN,

and 1099.

• Once a site no longer needs the taxpayer’s information, it must return it to the taxpayer or

properly dispose of it including burning or shredding the data.

• Dispose of all electronic media and hardware in a timely manner and make sure the data is not

recoverable.

• Delete taxpayer information stored on partner owned or IRS loaned equipment once the filing

season activities are completed as indicated in the site closing activities. Follow procedures to

delete data shown in Publication 4473, Computer Loan Program - Welcome Package.

• Use of secure wireless networks

• Partners and volunteers should use security protected wired connections when transmitting

taxpayer information via the Internet. If partners/volunteers, after conducting a comprehensive

risk assessment, decide to use wireless devices to transmit taxpayer information to the tax

preparation software provider, they must ensure that only an encrypted password protected

wireless network is used. The use of unprotected public wireless networks is prohibited. At a

minimum partners and volunteers should use:

1. Wi-Fi Protected Access-2 (WPA2) certified equipment and software. WPA2 uses government

strength encryption in the Advanced Encryption Standard (AES).

2. AES with a minimum of 256-bit encryption.

3. WPA2 Robust Security Network (RSN) framework must be used with authentication to establish

a secure wireless connection between WLAN (Wi-Fi Local Area Networks) devices.

4. The default SSID (Service Set Identifier) must not be used. The SSID character string must not

reflect names associated with VITA, TCE, IRS, or tax preparation.

5. If using unknown networks or working from home, partners and volunteers are strongly

encouraged to establish an encrypted Virtual Private Network (VPN) to allow for a more secure

connection. A VPN provides a secure, encrypted tunnel to transmit data between a remote user

via the internet and the company network.

• Partners and volunteers are encouraged to use the tax preparation software provider’s online

system that stores all taxpayer data on a secure server located within the tax preparation

software provider’s data center.

• Partners and volunteers must exercise caution and properly safeguard the taxpayer’s return

and personal information. Partners and volunteers must have sufficient knowledge of the

14

equipment (computer, software, routers, and wireless devices) they use to adequately assess

their security risks and take reasonable steps to mitigate those risks.

• Recognizing Phishing Scams

• Partners and volunteers must be educated on the dangers of phishing scams. These scams

can result in cybercriminals taking over your computer or accounts to steal client data. The

thief may pose as your tax software provider, your data storage provider, the IRS or even a

prospective client.

• Phishing emails sometimes have an urgent subject line such as “your account password has

expired”. The objective is to entice you to open a link or an attachment.

■

■

The link may take you to a fake site made to appear like a trusted source to steal your

username and/or password.

The attachment may contain malware, which secretly downloads and allows thieves to

eventually steal all the tax preparers passwords.

• Create “trusted customer” policies; contacting potential clients by phone or video conference.

• Do not respond to suspicious or unknown emails. For more information on reporting tax

scams, go to: www.irs.gov/alerts

Reporting Data Breaches

A VITA/TCE data breach occurs when a taxpayer’s personally identifiable information (PII) is shared, used or disclosed,

whether physical or electronic, without taxpayer permission. There are two types of data breaches:

a) Unintentional (a mistake) – volunteer mistakenly provided a copy of another taxpayer’s tax return or tax

documents in error.

b) Intentional (on purpose) – data loss incidents such as accessing a volunteer preparer network without

permission and/or theft of PII.

When a potential data breach occurs, (unintentional or intentional) partners must contact their local SPEC Territory Office

immediately upon confirmation of the incident. The territory office must review the details of the incident and determine if it meets

the criteria of a potential data breach. If determined to be a potential data breach, partners must provide the following information:

• Date the incident occurred

• Brief description of the data breach

• Full name and telephone number for the point of contact who reported the data breach

• Partner name and address

• Site name and address

The local SPEC territory will work with headquarters to determine if the potential data breach must be forwarded

immediately to the IRS Returns Integrity and Compliance Service (RICS) data loss mailbox. If forwarded to RICS data loss

mailbox, a member from the IRS RICS team will contact you to discuss the potential data breach and obtain the partner

client list and any other breached items. The information requested is based on the specifics of the data breach but could

include SSNs EFINs, PTINs, etc. Do not submit any taxpayer information to SPEC.

In addition, partners must also report data breaches to the following:

• Local police – File a police report on the breach

• States – Contact states in which you prepare state returns:

» Email the Federation of Tax Administrators at StateAlert@taxadmin.org to get information on

how to report victims.

» State Attorneys General for each state in which you prepare returns. Most states required the

attorney general be notified of data breaches.

15

Note: For a complete checklist, refer to Data Theft Information for Tax professionals.

Reporting Stolen and Lost Equipment

Unfortunately, a few partners report incidents of lost or stolen computers and printers each year. Please remember these

safeguarding rules to prevent a loss:

• Do not leave the laptop or printer in a vehicle where it is visible. When transporting equipment, place in

the trunk or under cover on the floor of the vehicle.

• Do not store the laptop or printer in a vehicle; use vehicles for transporting only.

• Do not leave the laptop or printer unattended in a public location.

• Do not leave the laptop or printer in a closet or cabinet that does not lock and where access is not limited.

• Record the make, model and serial number of all computer equipment used and keep in a secure location.

This can save valuable time if it is necessary to report the equipment as lost or stolen.

With heightened attention on security of data and computers used in support of the volunteer program, partners and

volunteers must report all incidents of stolen and lost equipment (including partner owned) to the IRS.

As a condition of IRS-loaned equipment, the recipient agrees to immediately notify IRS of IRS loaned equipment

(computers and printers) that is stolen or lost, but not later than the next business day after confirmation of the incident.

Partners must immediately notify IRS, but not later than the next business day after confirmation of the incident, if a

partner owned computer is stolen or lost. If the lost or stolen equipment contained taxpayer PII data, the partner must

report the loss of PII data based on data breach guidance.

Partners must provide what is readily available to their local relationship manager or territory office. The territory office

must complete an incident assessment and supporting documentations within ten days. To assist IRS with documentation,

partners must provide the following:

• Serial number

• Barcode

• Make

• Model of computer or printer

• Description of what occurred

• Taxpayer data that is at risk (include number of records)

• Whether the computer was encrypted

• If not encrypted, did the computer have a strong password

• Whether the taxpayer was or will be notified of theft/loss (if notified, method used)

• A copy of police report filed with local law enforcement (if applicable)

Stolen and Lost Information – Taxpayer Notification

No matter how partners and volunteers diligently protect taxpayer information, there is always a chance that it will be

stolen or lost. If this occurs, notify the appropriate authorities and then thoroughly evaluate the incident. Be sure to

take action to prevent other losses of equipment. Because each incident of loss is unique, partners must evaluate the

circumstances surrounding the loss and decide whether the risk of identity theft warrants notification of the individuals

whose information may have been compromised.

16

The following table depicts situations that have occurred and will prove helpful in evaluating risk and determining whether

the partner must consider notifying the taxpayer. All examples assume that individual tax return information is present.

Situation

Risk Assessment

A laptop and bag are stolen. The passwords to the

computer programs were recorded on a note card in

the bag.

Risk is high because the password was with the

computer and makes the data easily accessible.

A laptop is stolen. Passwords are required to access

the programs on the computer and they were not

compromised. The software program (Desktop and

Online) used to prepare returns encrypts the data and

return information is only stored within this software.

Risk is low. Use of passwords and encryption greatly

reduce the risk of compromised data.

A folder with information reports (Forms W-2, 1099)

and/or Forms 8879 is stolen from the site by an angry

taxpayer.

Risk is high because the information is easily accessible.

A disk containing return information is lost. The data on

the disk was saved using a tax preparation software

program that encrypts the data when saved to a disk.

Risk is low. Use of encryption on the disk greatly

reduces the risk of compromised data.

A laptop is stolen with encryption and the passwords are

not compromised but the briefcase contained a return

acknowledgement report for accepted returns.

Risk is high. The information on the return

acknowledgement report is easily accessible.

Protection of Partner/Volunteer Information

Partners and site coordinators must keep confidential any personal volunteer information provided.

Volunteer information is available to IRS employees for the purposes of administering the volunteer tax return preparation

program. Information pertaining to a potential volunteer, such as the name, home address, phone number, photo, foreign

language skill and other pertinent information may be provided to a partner for purposes of ensuring that the potential

volunteer is provided an opportunity to participate in the program. Similar information pertaining to current volunteers may

also be provided to a partner to help coordinate maximum efficient use of volunteer skills. IRS employees must encrypt

Sensitive But Unclassified (SBU) and Personally Identifiable Information (PII) within password protected attachments

when sharing volunteer PII information via email. This includes documents with the volunteer’s name, address, telephone

numbers, and/or email addresses. The IRS employee will provide the password via telephone. This information must be

kept confidential and should not be disclosed to unauthorized individuals.

Release of Partner Information

IRS will protect the information provided to the extent allowable by law. However, in some situations, IRS may be

compelled to provide information requested under 5 U.S.C. 552, Freedom of Information Act (FOIA). For example, a FOIA

request for copies of the Form 8633, Application to Participate in the IRS E-file Program, could require the release of the

applicant’s name, business address and whether the applicant is licensed or bonded in accordance with state or local

requirements. IRS cannot control how the information provided through a FOIA request is used by the requester.

17

Volunteer Standards of Conduct

To maintain the greatest degree of public trust in VITA/TCE Programs, all volunteers, whether paid or unpaid, must

complete Volunteer Standards of Conduct certification requirements in Link & Learn Taxes and sign Form 13615,

Volunteer Standards of Conduct Agreement, prior to working at a VITA/TCE site. Partners or site coordinators are required

to validate the volunteers’ identity, name and address using only government-issued identification prior to participation in

the Volunteer Program. Refer to Publication 4961, Volunteer Standards of Conduct – Ethics Training, for complete details.

Potential Consequences of Noncompliance

The Volunteer Protection Act of 1997 excludes conduct that is willful or criminal, grossly negligent, or reckless, or

conduct that constitutes a conscious, flagrant indifference to the rights or safety of the individual harmed by the volunteer.

If a volunteer discloses information, fails to protect personal information or is otherwise flagrantly irresponsible with

information entrusted to him/her, criminal charges or a civil lawsuit could be brought against the volunteer. Disclosure of

confidential information can result in fines or imprisonment.

Another potential consequence of failure to adequately protect taxpayer information is that the IRS may discontinue the

relationship with the partner or volunteer. Volunteers and partners released from the VITA/TCE program for egregious

actions and willful violations of the Volunteer Standards of Conduct, can be added to the IRS-SPEC Volunteer Registry

and not allowed to participate in the VITA/TCE program again. Federal financial assistance may no longer be provided

such as software, computer equipment or electronic filing privileges.

Referring Problems

If a volunteer has intentionally engaged in any activities that are in violation of the Volunteer Standards of Conduct and

would negatively impact the VITA/TCE program, advise the volunteer that due to these activities, they cannot participate in

the VITA/TCE program. Ask the volunteer to leave the site and report the incident to your local SPEC territory office, your

partner and email IRS at mailto:ts.voltax@irs.gov. Include your name, site name, contact information, and a detailed

description of the incident including the individuals full name, date the incident occurred and the number of taxpayer’s

affected by the violation if applicable.

If you suspect an individual or company is violating the tax laws, you may report this activity on Form 3949-A, Information

Referral. You may complete this form online at www.irs.gov/pub/irs-pdf/f3949a.pdf. Print the form and mail to: Internal

Revenue Service, Fresno, CA, 93888.

If a taxpayer is a victim of identity theft refer to the IP PIN Guidance for Identity Theft Victims located in Publication 4012,

VITA/TCE Volunteer Resource Guide, or review the Taxpayer Guide to Identity Theft on IRS.gov to assist the taxpayer.

If a taxpayer believes that he or she has been discriminated against, a written complaint should be sent to the Department

of the Treasury - Internal Revenue Service at the following:

If a taxpayer believes that he or she has been discriminated against, a written complaint should be sent to the Department

of the Treasury - Internal Revenue Service at the following:

Internal Revenue Service, Civil Rights Unit

1111 Constitution Avenue, NW, Room 2413

Washington, DC 20224

(Email complaints) civil.rights.division@irs.gov

18

Refer taxpayers with account questions such as balance due notices and transcript or installment agreement requests to

www.irs.gov. Refer federal refund inquiries to www.irs.gov/refund. Refer state/local refund inquiries to the appropriate

revenue office.

If taxpayers come into a VITA/TCE site with a tax problem, and they have been unsuccessful in resolving their issue

with the IRS, the Taxpayer Advocate Service may be able to help. The taxpayer’s Local Taxpayer Advocate can

offer special help to a taxpayer experiencing a significant hardship as the result of a tax problem. The taxpayer can

access www.irs.gov/advocate for more information.

Return Preparer Fraud or Misconduct

The IRS may provide relief to a taxpayer when the volunteer return preparer intentionally altered a taxpayer’s tax return

data or misdirected a portion or the entire refund without the taxpayer’s knowledge or consent. The following are a couple

of scenarios that could result in the IRS providing relief to a taxpayer:

●

●

The VITA/TCE volunteer income tax preparer prepared a correct return but intentionally misdirects the

refund by placing the volunteer’s bank account information on the tax return without the taxpayer’s

knowledge or consent.

The taxpayer signs Form 8879, IRS e-file Signature Authorization, and receives the expected refund, but later

becomes aware of inflated items added but the taxpayer did not receive the inflated amount of the refund.

Assist taxpayers alleging preparer misconduct at VITA/TCE sites to complete Form 14157-A, Tax Return Preparer Fraud

or Misconduct Affidavit and Form 14157, Return Preparer Complaint.

●

●

Refer to Form 14157-A page 3 for specific instructions and required documents for consideration of the

complaint.

Follow the mailing instructions indicated on the Form 14157-A to submit the completed forms and

documentation.

Volunteer Safety

If a volunteer is threatened by a taxpayer at any time, first contact your local police department or 911 to have the

taxpayer immediately removed from the facility. In addition, the incident should be reported to:

●

Treasury Inspector General for Tax Administration - TIGTA 1-800-366-4484

●

Local IRS territory office, and

●

IRS SPEC Headquarters via e-mail at mailto:ts.voltax@irs.gov

Form 13533, Partner Sponsor Agreement

Form 13533, Partner Sponsor Agreement, is requested annually. The Sponsor Agreement reiterates the key principles

of privacy and confidentiality. By signing this agreement, the sponsor agrees to educate and enforce the Volunteer

Standards of Conduct and the Civil Rights Laws and the impact on volunteers, sites, taxpayers and the VITA/TCE

Programs for not adhering to them. National and local SPEC offices must secure and maintain a signed Form 13533 for

each partner. AARP Tax-Aide and the military sponsor agreements are maintained at the SPEC Headquarters office. All

other partner agreements are maintained in the territory office partner file.

19

Form 13533-A, FSA Remote Sponsor Agreement

Form 13533-A, FSA Remote Sponsor Agreement, is requested annually. The FSA Remote model provides taxpayers

with access to free self-prep tax software, while assistance is provided by third-party electronic means. By signing this

agreement, the sponsor agrees to adhere to the volunteer standards of conduct, and provides assurances that they will

not receive any compensation from the user in exchange for access through the established web portal. National and

local SPEC offices must secure and maintain a signed Form 13533-A for each partner.

Statement of Assurance Concerning Civil

Rights Compliance

By signing the Form 13533, Partner Sponsor Agreement, the organization agrees to comply with the following civil rights

laws and assurances in consideration of and for the purpose of obtaining federal property or other federal financial

assistance from the Internal Revenue Service.

1. Title VI of the Civil Rights Act of 1964 (Pub L. 88-352), as amended, which prohibits discrimination on the basis

of race, color, or national origin; Section 504 of the Rehabilitation Act of 1973 (Pub L. 93-112) as amended which

prohibits discrimination on the basis of disability; Title IX of the Education Amendments of 1972 (Pub L. 92-318),

as amended, which prohibits discrimination on the basis of sex in education programs or activities; and the Age

Discrimination Act of 1975 (Pub L. 94-135), as amended, which prohibits discrimination on the basis of age; in

accordance with those laws and the implementing regulations.

As clarified by Executive Order 13166, Improving Access to Services for Persons with Limited English Proficiency,

national origin discrimination includes discrimination on the basis of limited English proficiency (LEP). To ensure

compliance with Title VI, the “Partner” and its “Sub-Recipients” must take reasonable steps to ensure that LEP

persons have meaningful access to its programs in accordance with Department of Treasury implementing regulations

and Department of Justice LEP Policy Guidance. Meaningful access may entail providing language assistance

services, including oral interpretation and written translation, where necessary. The Partner and its Sub-Recipients

are encouraged to consider the need for language services for LEP persons served or encountered when developing

budgets and in conducting programs and activities. Resources on language assistance and information regarding LEP

obligations may be found at www.lep.gov or by contacting the IRS Civil Rights Unit.

2. The Partner will conduct its activities so that no person is excluded from participation in, is denied the benefits of, or

is subject to discrimination, as prohibited by the statutes identified in paragraph 1, in the distribution of services and/

or benefits provided under this federal financial assistance program.

3. To compile and submit information to the Internal Revenue Service (IRS) Civil Rights Unit concerning its compliance

with Title VI of the Civil Rights Act of 1964 (Pub L. 88-352), as amended, Section 504 of the Rehabilitation Act of

1973 (Pub L. 93-112), as amended, Title IX of the Education Amendments of 1972 (Pub L. 92-318), as amended,

and the Age Discrimination Act of 1975 (Pub L.94-135), as amended, in accordance with those laws and the

implementing regulations. All civil rights assurances signed by partners will be maintained by the IRS. Civil rights

assurances signed by sub-recipients will be maintained by partners.

4. Within 30 days of any finding issued by a federal or state court or by a federal or state administrative agency that

the “Partner” has discriminated on the basis of race, color, national origin (including limited English proficiency),

disability, sex (in education programs or activities), or age in the delivery of its services or benefits, a copy of such

finding shall be forwarded to the following:

Internal Revenue Service Civil Rights Unit

1111 Constitution Avenue, NW, Room 2413

Washington, D.C. 20224

civil.rights.division@irs.gov

20

5. To inform the public that persons who believe they have been discriminated against on the basis of race, color,

national origin (including limited English proficiency), disability, sex (in education programs or activities), or age, in

the distribution of services and benefits resulting from this federal financial assistance program may file a complaint

with the Civil Rights Unit, at the above address. Civil Rights posters indicating the process for filing complaints of

discrimination for the public must be conspicuously displayed at all times at each “Partner’s” location, as well as by

its sub-recipients.

6. To forward to the Civil Rights Unit for investigation, all complaints of discrimination filed by the public against the

“Partner” that is directly related to the services and/or benefits provided by this IRS federal financial assistance

program.

Statement of Assurance Filing Requirement

A signed Form 13533, Partner Sponsor Agreement, is required annually from partners and its sub-recipients receiving

federal financial assistance. Partners and its sub-recipients receiving federal financial assistance are obligated to comply

with this assurance for one year from the date the Form 13533, Partner Sponsor Agreement, is signed.

The organizational official whose signature appears on the Form 13533, Partner Sponsor Agreement, is authorized to

sign this assurance and commit the “Partner” to the above provisions. The partner and sub-recipients, its successors,

transferees and assignees, upon the breach or violation of this agreement, the IRS may, at its option: a) Terminate or

refuse to render or continue federal financial assistance for the aid of the property, facility, project, service, or activity, b)

Enforce this agreement by suit for specific performance or by any other available remedy under the laws of the United

States or the state in which the breach or violation occurs.

Data Collection Requirements

Currently, recipients of Federal financial assistance from the Department of the Treasury are required to meet certain

legal requirements relating to nondiscrimination and nondiscriminatory use of Federal funds. Those requirements include

ensuring that entities receiving Federal financial assistance from the Treasury do not deny benefits or services, or

otherwise discriminate on the basis of race, color, national origin, disability, and age, or on the basis of sex in educational

programs and activities. The Department of the Treasury has an obligation to enforce nondiscrimination requirements

to ensure that its Federally-assisted programs and activities are administered in a nondiscriminatory manner. In order to

carry out its enforcement responsibilities, the Department must obtain a signed assurance of compliance and collect and

review information from recipients to determine their compliance with applicable requirements before and after providing

financial assistance (see 31 CFR 22.5, 22.6 and 28 CFR 42.406).

In accordance with the Title VI regulations (see 31 CFR 22), the Department of the Treasury is authorized to request

data from its recipients and those applying to receive financial assistance from the Department. Treasury will request

recipients to submit a Title VI narrative describing their compliance status at the time of the application for assistance. The

Department will also request recipients to submit data during post-award compliance reviews. Please note that Treasury

will make available sample policies and procedures to assist recipients in completing these requests for data, and will

provide technical assistance directly to recipients as needed.

The purpose of the information collection is to advise recipients of their civil rights obligation; obtain an assurance of

compliance from each recipient, and collect pertinent civil rights information to determine if the recipient has adequate

policies and procedures in place to achieve compliance, and to determine what, if any, further action may be needed

(technical assistance, training, compliance review, etc.), to ensure the recipient is in compliance and will carry out its

programs and activities in a nondiscriminatory manner. Treasury will also collect civil rights related information from all

primary recipients of Federal financial assistance from the Department. Primary recipients are non-federal entities that

receive Federal financial assistance in the form of a grant, cooperative agreement, or other type of financial assistance

directly from the Department and not through another recipient or “pass-through” entity. Please note that this information

21

collection does not apply to sub-recipients, Federal contractors (unless the contract includes the provision of financial

assistance), nor the ultimate beneficiaries of services, financial aid, or other benefits from the Department.

Many recipients already collect information, including race and national origin data, on the beneficiaries that receive tax

preparation assistance. Recipients will also be required to provide information with their application for Federal financial

assistance. Treasury anticipates that data, records or files that will be used to respond to the information collections are

already maintained in electronic format by the recipient, so providing the information electronically will further minimize

administrative burden. Treasury will also allow recipients to scan and submit documents that are not already maintained

electronically. If the recipient is unable to submit their information electronically, alternative arrangements will be made to

submit responses in hard copy.

Recipients can submit comments to the Civil Rights Unit concerning data collection for civil rights compliance and

enforcement purposes under Title VI of the Civil Rights Act, and similar statutes applicable to Federal financial assistance,

by emailing civil.rights.division@irs.gov.

Reference Materials

For further information and guidance, please refer to the following:

●

Publication 1345 – Handbook for Authorized IRS e-file Providers of Individual Income Tax Returns

●

Publication 1101 – Application Package and Guidelines for Managing a TCE Program

●

Publication 4473 – Computer Loan Program - Welcome Package

●

Publication 4557 – Safeguarding Taxpayer Data A Guide for Your Business

●

Publication 5027 (en/sp) – Identity Theft Tool Kit

●

Publication 5683 – VITA/TCE Handbook for Partners and Site Coordinators

22

Exhibit 1

Form 13533

(September 2020)

Department of the Treasury - Internal Revenue Service

VITA/TCE Partner Sponsor Agreement

We appreciate your willingness and commitment to serve as a sponsor in the Volunteer Income Tax Assistance (VITA) or

Tax Counseling for the Elderly (TCE) volunteer tax return preparation programs.

To uphold taxpayers’ civil rights, maintain program integrity and provide for reasonable protection of information provided

by the taxpayers serviced through the VITA/TCE Programs, it is essential that partners and volunteers adhere to the

strictest standards of ethical conduct and the following key principles be followed.

• Partners and volunteers must keep confidential the information provided for tax return preparation.

• Partners and volunteers must protect physical and electronic data gathered for tax return preparation both during and

after filing season.

• Partners using or disclosing taxpayer data for purposes other than current, prior, or subsequent year tax return

preparation must secure the taxpayer’s consent to use or disclose their data.

• Partners and volunteers must delete taxpayer information on all computers (both partner owned and IRS loaned) after

filing season tax return preparation activities are completed.

• Partners and site coordinators are expected to keep confidential any personal volunteer information provided.

• Partners will educate and enforce the Volunteer Standards of Conduct and Civil Rights Laws and the impact on

volunteers, sites, taxpayers and the VITA/TCE Programs for not adhering to them.

1. Sponsor name

2. Street address

3. City

4. State

6. Telephone number

5. Zip code

7. E-mail address

Please review this form and Form 13615, Volunteer Standards of Conduct. By signing and dating this form, you are

agreeing:

a) To the key principles,

b) All volunteers participating in your return preparation site will complete the volunteer standards of conduct

training, and

c) All volunteers will agree to the Volunteer Standards of Conduct by signing and dating Form 13615.

d) To read, understand and follow the Statement of Assurance Concerning Civil Rights Compliance listed in

Publication 4299, Privacy, Confidentiality and Civil Rights.

e) Form 13615 will be validated and signed by a partner designated official (Site Coordinator, partner, instructor or

IRS contact).

The IRS may terminate this agreement and add you to a volunteer registry, effective immediately for disreputable conduct

that could impact taxpayers’ confidence in any VITA/TCE Programs operated by you or your coalition members.

Sponsor signature

Date

Print name

Title

Privacy Act Notice

The Privacy Act of 1974 requires that when we ask for information we tell you our legal right to ask for the information, why we are asking for it, and how it will

be used. We must also tell you what could happen if we do not receive it, and whether your response is voluntary, required to obtain a benefit, or mandatory.

Our legal right to ask for information is 5 U.S.C. 301.

We are asking for this information to assist us in contacting you relative to your interest and/or participation in the IRS volunteer income tax preparation

and outreach programs. The information you provide may be furnished to others who coordinate activities and staffing at volunteer return preparation sites or

outreach activities. The information may also be used to establish effective controls, send correspondence and recognize volunteers.

Your response is voluntary. However, if you do not provide the requested information, the IRS may not be able to use your assistance in these programs.

Catalog Number 38129E

www.irs.gov

23

Form 13533 (Rev. 9-2020)

Exhibit 2

Form 13533-A

(September 2022)

Department of the Treasury - Internal Revenue Service

FSA Remote Sponsor Agreement

We appreciate your willingness and commitment to serve as a sponsor of a Facilitated Self Assistance (FSA) Remote site,

by promoting web link(s) to a third-party provider offering free online tax preparation services to taxpayers.

This Remote Sponsor Agreement must only be completed if you are not required to complete the Form 13533.

This form only covers partners who are supporting remote Facilitated Self Assistance web links, and not any other VITA/

TCE tax assistance programs, either separately or together with FSA Remote.

To maintain program integrity and provide for reasonable protection of information provided by the taxpayers serviced

through the FSA Program, it is essential that partners adhere to the following key principles:

• Partner agrees not to connect the promotion of the above referenced web link(s) with any request for compensation or

donation from the user.

• Partner agrees to offer IRS-certified volunteer support to taxpayers who have tax law-related questions. This can occur

either directly through that organization's volunteers, or by referring taxpayers to another partner/resource that can

supply that service within a reasonable time-frame (usually 48 hours).

• Partner agrees to connect taxpayers to IRS VolTax (Publication 4836) and Civil Rights (Publication 4053) guidance.

• Partner agrees to refer any taxpayer questions about the FSA Program back to their SPEC Relationship Manager for

resolution.

• Partner agrees to follow any SPEC guidance on sharing the vendor link(s) with taxpayers to ensure the integrity of the

FSA program, and to work with their Relationship Manager to resolve any issues that arise from the posting, distribution

and/or use of the vendor link(s).

• Partner agrees not to engage in criminal, infamous, dishonest, notoriously disgraceful conduct, or other conduct

deemed to have a negative effect on the FSA Program.

1. Sponsor name

2. Street address

3. City

4. State

6. Telephone number

7. Email address

5. ZIP code

By signing and dating this form, you are agreeing to the key principles outlined above.

Website(s) where FSA link will be located (if more space is needed, list the additional websites on a separate document)

The IRS may terminate this agreement and add you to a volunteer registry, effective immediately for disreputable conduct

that could impact taxpayers’ confidence in the FSA Program operated by you or your coalition members.

Sponsor signature

Name (print)

Date

Title

Privacy Act Notice

The Privacy Act of 1974 requires that when we ask for information we tell you our legal right to ask for the information, why we are asking for it, and how

it will be used. We must also tell you what could happen if we do not receive it, and whether your response is voluntary, required to obtain a benefit, or

mandatory. Our legal right to ask for information is 5 U.S.C. 301. We are asking for this information to assist us in contacting you relative to your interest

and/or participation in the IRS volunteer income tax preparation and outreach programs. The information you provide may be furnished to others who

coordinate activities and staffing at volunteer return preparation sites or outreach activities. The information may also be used to establish effective

controls, send correspondence and recognize volunteers. Your response is voluntary. However, if you do not provide the requested information, the IRS

may not be able to use your assistance in these programs.

Catalog Number 66299X

www.irs.gov

24

Form 13533-A (Rev. 9-2022)

Exhibit 3

Form

15272

Department of the Treasury - Internal Revenue Service

VITA/TCE Security Plan

(October 2022)

Purpose: This form provides information on the procedures used at the VITA/TCE site location to help maintain the security of taxpayer

information and adherence to the security requirements outlined in Publication 4299, Privacy, Confidentiality, and Civil Rights – A Public

Trust. In addition, it also provides information on any Virtual VITA/TCE Models the site uses to assist taxpayers and if the site adheres

to all Quality Site Requirements outlined in Publication 5166, VITA/TCE Quality Site Requirements.

Directions: All sites (excluding FSA remote sites) must complete Section I- Security Requirements of this form. Any site using a virtual

process must also complete Section II-Virtual VITA/TCE Model. The site coordinator must sign the form. Sites must submit this form for

approval to their SPEC territory manager (or local SPEC designee) prior to the site opening but no later than December 31. Sites can

use this form or a similar document that captures the same information to meet this requirement. Sites and the territory office must

maintain a (physical or electronic) copy of the SPEC approved security plan.

Site name

Site address

Partner name

EFIN

Type of software used

TaxSlayer online

TaxSlayer desktop

Date completed

SIDN

Other (list name)

Completed by

Role

Name

Telephone Number

Email Address

Site Coordinator

Alternate Site Coordinator

Complete equipment inventory log. Identify the type of equipment and the number used to support the site. Include only IRS owned,

partner owned, and volunteer owned equipment.

Type of Equipment

# IRS Owned

# Partner Owned

# Volunteer Owned

Laptops

Portable mass storage devices (ex. CD, DVD, or USB)

Other (ex. tablets, printers, smartphones, etc.)

Section I - Security Requirements

Refer to Publication 4299, Privacy, Confidentiality, and Civil Rights – A Public Trust, that outlines the security requirements for

questions 1 through 9. At the end of each question, the section heading is listed for additional information.

1. Are procedures in place at the site to confirm volunteer awareness of the security requirements in

Publication 4299, Privacy, Confidentiality, and Civil Rights (i.e., privacy during the interview, validating

taxpayer identity and identification numbers)? If no, explain. Refer to Privacy and Confidentiality – Key

Principles

Yes

No

2. If using a wireless network at the site, are volunteers following the requirements in Publication 4299 to

restrict unauthorized access to the site's wireless network? If no, explain. Refer to Use of secure wireless

networks

Yes

No

3. Are software access privileges limited based on the volunteers assigned roles as outlined in Publication

4299 (i.e., security templates for preparers, quality reviewers, super users, etc.)? If no, explain. Refer to

Utilizing tax preparation software security features

Yes

No

Catalog Number 74696W

www.irs.gov

25

Form 15272 (Rev. 10-2022)

Exhibit 3

Page of

4. Are volunteers following security requirements for protecting all equipment (computers, printers, flash drives,

thumb drives, external hard drives, etc.) to ensure proper use, storage and disposal at the site during and

after site operating hours? If no, explain. Refer to Portable Mass Storage Devices/Electronic information

Stored on Computers

Yes

No

5. Are there site procedures to limit unauthorized access to taxpayer information (i.e., positioning computer

screens, protecting taxpayer documents and preventing others from hearing sensitive information) and to

ensure privacy? If no, explain. Refer to Privacy During the Interview

Yes

No

6. Does the site coordinator generally restrict volunteer access to the tax preparation software (changing active

to inactive) after site operating hours as described in Publication 4299? If no, explain. Refer to Utilizing tax

preparation software security features

Yes

No

7. Is the site coordinator aware of the process for reporting a lost and/or stolen computer (both IRS loaned and

partner owned) immediately but no later than the next business day after confirmation of the incident? If no,

explain. Refer to Reporting Stolen and Lost Equipment

Yes

No

8. Are you aware of the procedures for reporting a data breach to your SPEC Territory Office as described in

Publication 4299? If no, explain. Refer to Reporting Data Breaches

Yes

No

9. Are volunteers properly securing ((physical and or electronic) taxpayer Personally Identifiable Information

(PII) in their possession and disposing of the information when no longer needed? If no, explain. Refer to

Protecting Physical and Electronic Data

Yes

No

10. Are you aware of how to report unethical violations as outlined in the Publication 4961, Volunteer Standards

of Conduct-Ethics Training? If no, explain

Yes

No

11. Does the site coordinator follow the guidelines in, Publication 5683, VITA/TCE Handbook for Partners and

Site Coordinators, for closing the site? If no, explain

Yes

No

12. Does the site plan to use a Virtual VITA/TCE Model to assist taxpayer's with tax preparation? If yes,

complete Section II Virtual VITA/TCE Process. If no, skip to Part III. Refer to Publication 5450, VITA/TCE

Site Operations

Yes

No

Catalog Number 74696W

www.irs.gov

26

Form 15272 (Rev. 10-2022)

Exhibit 3

Page of

Section II - Virtual VITA/TCE Process

Part I - Virtual Model and Site Information

Select the Virtual VITA/TCE Model from the drop-down menu. Refer to Publication 5450, VITA/TCE Site Operations for a description of

the virtual models.

Virtual VITA/TCE model

Part II - Virtual Process

Describe in detail how the site remotely performs each virtual return preparation process. If the site performs any of the virtual

processes listed at the site directly with the taxpayer, indicate N/A by the appropriate question. Refer to Publication 5450, VITA/TCE

Site Operations for more information.

1. Describe the sites appointment scheduling process (if applicable)

2. Describe the process for securing Form 14446, Virtual VITA/TCE Taxpayer Consent

3. Describe the sites intake process. List the documents the site requires during intake and how they receive documents at this stage

of the process

4. Describe the process to authenticate the taxpayer and the spouse. Address the video conferencing or file sharing systems the site

uses and the documents they review

5. Describe the site interview process

6. Describe the sites virtual tax return preparation process

7. Describe the site quality review process

8. Describe the site process for sharing the completed return for the taxpayer to review and sign

9. If the original source documents are dropped off, how does the site secure, return and dispose of the documents after use

Catalog Number 74696W

www.irs.gov

27

Form 15272 (Rev. 10-2022)

Exhibit 3

Page of

10. Describe the process and timeframe for transmitting returns and working rejects

Part III - Disclaimers

IRS/SPEC does not endorse any specific data-sharing service. VITA/TCE sites should select the vendor and/or product that best meets

the partner's needs as determined by their own organization’s information technology support function or chief information officer.

By signing this form you are approving the security requirements and virtual processes used by the site.

Approver's signatures

Site Coordinator name

Signature (electronic)

Signature (type/print)

Date

Signature (type/print)

Date

Signature (type/print)

Date

OR

Relationship Manager's name

Signature (electronic)

OR

Territory Manager's name (or designee)

Signature (electronic)

OR

28

Catalog Number 74696W

www.irs.gov

Form 15272 (Rev. 10-2022)

Exhibit 4

Exhibit 4

Equipment Inventory

*Record all computer equipment used at the site and keep in a

secure location.

*Serial #

1

*Barcode #

(if applicable)

*Make

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

29

*Model

*Password

*Encrypted Protected

Yes / No

Yes / No