“Data security risk is usually generated by everyday behaviors that eventually catch up with users if they are not constantly handling data in a safe manner”

The increasing number of data breaches means that CPAs must handle client data even more carefully.

“The theft of individuals’ Social Security Numbers and other personally identifiable information happens outside our tax system, but is fueling an increase in tax refund fraud,” reported Peggy Bogadi, commissioner of the IRS’s wage and investment division.

Data loss happens

While large businesses are mostly responsible for the more than 500 million personal information records that have been breached since 2005, even CPA firms that are good custodians of client data occasionally lose a laptop or USB (thumb) drive with unencrypted confidential data on it. Those losses give rise to a potential data breach, says Randy R. Werner, JD, LL.M./Tax, CPA, a loss prevention specialist for CAMICO (www.camico.com), the nation’s largest CPA-focused program of specialty liability insurance for the accounting profession.

“Data security risk is usually generated by everyday behaviors that eventually catch up with users if they are not constantly handling data in a safe manner,” says Werner.

Data breaches can be expensive for firms; the more cost-effective approach is to implement robust data security measures. Furthermore, firms that become proficient at security will be better able to assist clients with their own data security issues.

Loss prevention tips

Werner offers some basic loss prevention tips:

• Ensure that laptops, desktops, USB drives, servers, smart phones and other devices do not contain any confidential data that is unencrypted.
• Consider remote laptop security measures to prevent access to protected files in the event of theft or loss.
• Ensure that email messages and attachments containing confidential data are encrypted with file encryption and digital certificates.
• Use strong passwords, and do not write them down or share them. Passwords should be “salted” with random bits and symbols such as #, $, and &. Change passwords at least every 90 days.
• Physical security should be provided for computers and endpoints as with any other valuable assets, including building security and access codes, and locking up all servers, laptops, desktops and mobile devices.
• Do not download personal software onto business computers because of the risk of downloading viruses or worms along with the software.

Werner also recommends that firms engage in a continuous data security process that operates in three areas:

• outlines the specific ways the firm will protect data;
• sets forth policies, procedures and staff responsibilities, including what staff members are not allowed to do, and what they are required to do (such as immediately reporting any actual or potential security problems);
• covers areas such as the Internet, social media, email usage, and record retention and destruction; and
• details the reporting and other requirements of the states in question and the state agencies to which breaches are to be reported. Some states require firms to be compliant with the state’s privacy laws if the firm has the privacy data of a resident in that state. Some states require a written security plan by law.

Better data security measures will help ensure that private information remains confidential and available only to authorized parties. Firms will avoid or reduce the high costs associated with data breaches, and strong data security measures will become selling points that many clients will appreciate.

For more information regarding identity theft, data security, and Data Breach Coverage, call CAMICO at 1.800.652.1772.