IRS began exchanging federal taxpayer data with state tax administration agencies in the 1920s, but it was not until the Tax Reform Act of 1976 that Congress declared federal tax returns and return information to be confidential. The Tax Reform Act specified IRS’ responsibilities for safeguarding taxpayer information against unauthorized disclosure while authorizing IRS to share this information with state agencies for tax administration purposes. Congress also authorized the sharing of taxpayer information with child support programs to assist with enforcement, such as locating individuals owing child support. In 1984, Congress authorized IRS to share data to support federal and state administration of other programs, such as Aid to Families With Dependent Children and Medicaid, to assist in verifying eligibility and benefits. Disclosures of federal taxpayer information to an agency are restricted to the agency’s justified need for and use of such information. Unauthorized inspection, disclosure, or use of taxpayer information is subject to civil and criminal penalties. The objective of this study was to provide the Committee with information on how federal, state, and local agencies use the taxpayer information they are authorized to obtain under section 6103. To meet our objective, we met with officials in IRS’ Office of Governmental Liaison and Disclosure, Office of Safeguards, and select IRS District Disclosure Offices. We also reviewed IRS documentation of reports submitted by federal, state, and local agencies on the safeguard procedures used to protect taxpayer information. In addition, we reviewed IRS reports of its monitoring efforts at these agencies. IRS provided us with lists of federal, state, and local agencies that had received taxpayer information during 1997 or 1998. We surveyed the agencies, asking them under what authority they received taxpayer information, how they received it, what they used the information for, and whether there were alternate sources of data they could use in lieu of taxpayer information. We also asked them about IRS’ monitoring efforts and to identify any safeguard deficiencies that have been noted during recent internal or external reviews. Copies of our questionnaires are reproduced in appendix IX. We surveyed all of the federal agencies in the Washington, D.C., metropolitan area that IRS identified as having received taxpayer information. The response rate was 100 percent from these agencies. In some cases, we sent a questionnaire to more than one contact for a particular agency. For example, for the Department of Labor, IRS identified four separate components as receiving taxpayer information. Thus, IRS gave us the names of four separate contact persons at Labor. We mailed our questionnaire to 50 agency contact persons. In our cover letter, we encouraged them to distribute copies of the questionnaire to all other entities within the agency that received taxpayer information from IRS and asked that an appropriate representative from those units return a completed questionnaire. Several agencies that had only one contact person listed by IRS returned multiple questionnaires from different units within their agencies that use taxpayer information. For example, the Department of Transportation had only one contact person to whom we mailed our questionnaire, but staff in the Department completed and returned 10 questionnaires. In total, we received 98 questionnaires from the 50 agency contacts from whom we requested information. From the list IRS provided of 215 state and local entities that had received taxpayer information, we drew a simple random probability sample of 35 entities. Each entity on the IRS list had an equal, nonzero probability of being included in the sample. Our sample, then, is only one of a large number of samples that we might have drawn because we followed a probability procedure based on random selection. Each sample could have provided different estimates; thus, we can express our confidence in the precision of our particular sample’s results as a 95-percent confidence interval. This is the interval that would contain the actual population value for 95 percent of the samples we could have drawn. As a result, we are 95- percent confident that each of the confidence intervals in this report will include the true values in the study population. We mailed questionnaires to the contact persons at each of the selected entities. Like the federal agencies, some of the state and local agencies completed more than one questionnaire. Thirty-four of the 35 state and local agencies we surveyed returned at least one questionnaire, for a response rate of 97 percent. Given the broad scope of our study and the required time frame for completion, our audit work focused on collecting and presenting the data from the agencies and IRS. As agreed with your office, we did not verify the information that we collected. We also did not evaluate the efforts of IRS or the federal, state, and local agencies to safeguard taxpayer information. We performed our work at IRS’ National Office of Safeguards and select IRS District Disclosure Offices. Our work was done between March and August 1999 in accordance with generally accepted government auditing standards. We requested comments on a draft of this report from the Commissioner of Internal Revenue. IRS provided written comments in an August 16, 1999, letter, which is reprinted in appendix X. The comments are discussed near the end of this letter. According to IRS, there were 37 federal and 215 state and local agencies that received, or maintained records containing, taxpayer information under provisions of IRC section 6103 during 1997 or 1998. We surveyed all of the 34 federal agencies in the Washington, D.C., metropolitan area that IRS identified as having received taxpayer information. In responding to our questionnaire, 3 of the 34 federal agencies—Agency for International Development, Department of Energy, and Environmental Protection Agency—indicated that they did not receive any taxpayer information during 1997 or 1998. In addition, two agencies—Equal Employment Opportunity Commission and Securities and Exchange Commission— indicated that they did not receive any taxpayer information during 1998. Among these 34 federal agencies, however, there were several that had more than one department or unit that utilized the taxpayer information received. From the list IRS provided of 215 state and local entities that were receiving taxpayer information, we drew a simple random probability sample of 35 entities. Only one of our sampled state and local entities— Alabama Department of Human Resources—indicated that it did not receive any taxpayer information in 1997, and all of them indicated that they had received taxpayer information in 1998. According to IRS officials, they generally categorize the agencies into one of the following: Child support agencies–IRS discloses certain tax return information to federal, state, and local child support enforcement agencies. Welfare/public assistance agencies–IRS discloses certain tax return information to federal, state, and local agencies administering welfare/public assistance programs, such as food stamps and housing. State tax administration/law enforcement agencies–IRS discloses certain tax return information to federal, state, and local agencies for tax administration and the enforcement of state tax laws. Federal agencies–IRS discloses certain tax return information to federal agencies for certain other purposes. The type of taxpayer information agencies receive varies in content, format, and frequency according to how agencies use the information. Agencies may receive paper copies of individual tax returns, electronic databases of IRS’ individual and business master files, or tape extracts from these files. The information can include such things as the taxpayers’ names, Social Security numbers, addresses, or wages. Table 1 shows examples of the different types of taxpayer information agencies receive. As shown in table 1, agencies receive taxpayer information in a variety of formats—for example, paper copy, electronic databases, and tape extracts. Some agencies receive this information on a regular schedule—for example, monthly, quarterly, or annually. Other agencies receive it on an as-needed basis—for example, while conducting criminal investigations. We asked the agencies we surveyed to indicate how they received taxpayer information from IRS during 1997 or 1998 and how often they received that information. Tables 2 and 3 show the survey results. Appendixes III and IV further describe the types of taxpayer information received by federal and state and local agencies, respectively; the format in which the information was received; and the frequency with which it was received, categorized by purposes for which the information might be used. In addition to the taxpayer information received from IRS, many agencies use other sources of information to fulfill their missions. We asked the agencies to indicate, in lieu of taxpayer information, what other sources of data are available that would allow them to accomplish their missions. As shown in table 4, the responses from the federal, state, and local agencies we surveyed generally fell into one of following categories: There was no other source of data available to them. They used other sources, but these other sources were less reliable than tax information. They used other sources, but these other sources were more costly to use than tax information. They used other sources in conjunction with the tax information. They did not respond to this question. Under various IRC section 6103 subsections, agencies may receive taxpayer information for one of several reasons, such as to administer state tax programs, assist in the enforcement of child support programs, or verify eligibility and benefits for various welfare and public assistance programs (e.g., food stamps or public housing). Agencies may also receive taxpayer data for use during a criminal investigation, to apprise appropriate officials of criminal activities or emergency circumstances, or to assist in locating fugitives from justice. One of the most common reasons why agencies said they received taxpayer information was their participation in the tax refund offset program. Pursuant to the IRC, agencies submitted qualifying debts, such as student loans or child support payments, for collection by offsetting the debt against the taxpayer’s refund. Seventy-five percent of the federal agencies and 15 percent of the state and local agencies in our sample indicated that they received taxpayer information for this purpose. Effective January 1, 1999, tax refund offset procedures for collecting qualifying debts were modified. The Department of the Treasury’s Financial Management Service was given the responsibility for the Federal Refund Offset Program, which was merged into the centralized administrative offset program known as the Treasury Offset Program. This program commingles tax refund information with other federal financial information (e.g., benefit payments, pensions). If a match is found when an individual has an outstanding debt and is receiving federal money in any form (e.g., tax refund, pension, or vendor payments), the individual is notified that his federal money can be withheld to pay off the debt. The source or sources of any money withheld is not revealed to the agencies, but simply the fact that an offset has been made. This information, then, is no longer identifiable as tax refund information; thus, it is no longer considered taxpayer information. Because of this change to the offset program, several agencies we surveyed indicated that they no longer needed taxpayer information. Thirty-four percent of the federal and 3 percent of the state and local agencies in our sample indicated that they are participating in the Treasury Offset Program and that they will no longer need to receive taxpayer information from IRS. We asked the agencies we surveyed to indicate how they use taxpayer information. We grouped their responses into the following categories: administering debt collection or offset program; administering tax laws; determining eligibility for welfare and public assistance programs; enforcing child support programs; conducting criminal investigations; and other purposes, such as statistical and economic research, auditing government programs, or storage of tax returns. Table 5 shows how the agencies we surveyed responded to our query about how they used the taxpayer information they received in 1997 or 1998. (App. V provides a listing of possible uses of taxpayer information received from IRS.) Before receiving taxpayer information from IRS, agencies are required to provide IRS with a detailed Safeguard Procedures Report (SPR) that describes the procedures established and used by the agency for ensuring the confidentiality of the information received. The SPR is a record of how the agency processes the federal taxpayer information and protects it from unauthorized disclosure. IRS Publication 1075 outlines what must be included in an agency’s SPR.In addition to requiring that it be submitted on agency letterhead and signed by the head of the agency or the head’s delegate, an agency’s SPR must contain information about responsible officer(s), location of the data, flow of the data, system of records, secure storage of the data, access to the data, disposal of the data, computer security, and agency’s disclosure awareness program. All federal agencies and the state welfare agencies are to submit their SPRs to IRS’ Office of Safeguards, which is to review the reports for completeness and acceptance. State taxing agencies and child support enforcement agencies are to submit their SPRs to the IRS District Disclosure Office in their respective states. Agencies are expected to submit a new SPR every 6 years or whenever significant changes occur to their safeguard program. IRS has taken steps to withhold taxpayer information from agencies if their SPRs did not fulfill the requirements set forth in IRC section 6103. Shown below are some recent examples of IRS notifying agencies that they would not be able to get taxpayer information because their SPRs were incomplete. In April 1999, IRS’ Office of Safeguards notified the Arizona Department of Economic Security that, since IRS had not received an acceptable SPR, it was recommending to IRS’ Office of FedState Relations that federal taxpayer information be withheld until the agency complied with the safeguarding requirements outlined in IRC section 6103. IRS’ Office of Safeguards further advised that it would recommend to the Social Security Administration that tax information contained in the Beneficiary Earnings Exchange Record should not be forwarded to the department. In May 1999, IRS’ Office of Safeguards notified the West Virginia Department of Health and Human Resources that additional information that IRS had requested in an earlier letter had not been provided and that it could not accept the procedures described in the department’s draft SPR as adequately protecting federal taxpayer information from unauthorized disclosure. In June 1999, IRS’ Office of Safeguards notified the Federal Bureau of Investigation that IRS was unable to accept the Bureau’s SPR as describing adequate safeguard procedures to protect federal taxpayer information from unauthorized disclosure. Agencies are also required to file a Safeguard Activity Report (SAR) annually with IRS to advise it of any minor changes to the procedures or safeguards described in their SPR. The SAR is also to advise IRS of future actions that would affect the agency’s safeguard procedures—for example, new computer equipment, facilities, or systems or the use of contractors, as permitted by law, to do programming, processing, or administrative services. Moreover, the SAR is to summarize the agency’s current efforts to ensure confidentiality and certify that the agency is protecting taxpayer information pursuant to IRC section 6103(p)(4) and the agency’s own security requirements. In addition to the SPRs and annual SARs that are sent to IRS, agencies’ OIGs may also review agency programs for safeguarding taxpayer information. For example, a March 1999 Department of Veterans Affairs (VA) OIG report outlined possible inappropriate requests for and subsequent use of taxpayer information by VA’s Health Eligibility Center because of erroneous information supplied to them by some VA medical facilities. The OIG found that a large percentage of sampled cases did not have certain required documentation on file and, consequently, should not have been referred for income matching and verification. Before we notified IRS about the VA OIG report, neither Treasury nor IRS was aware of the report or its findings. After meeting with IRS to discuss the OIG findings, VA agreed to work with IRS on corrective actions. According to IRS, federal agency OIGs are not required to notify IRS of their findings involving tax returns and return information. In July 1999, IRS issued a memorandum to federal agency OIGs asking for their assistance in working with IRS in this area. IRS is supposed to conduct on-site reviews every 3 years to ensure that agencies’ safeguard procedures fulfill IRS requirements for protecting taxpayer information. IRS’ National Office of Governmental Liaison and Disclosure, Office of Safeguards, has overall responsibility for safeguard reviews to assess whether taxpayer information is properly protected from unauthorized inspection, disclosure, or use as required by the IRC and to assist in reporting to Congress. The Office of Safeguards conducts the on- site reviews for all the federal agencies and state welfare agencies that receive taxpayer information. IRS’ District Offices of Disclosure and FedState Relations are responsible for conducting the on-site safeguard reviews at all other state and local agencies that receive taxpayer information. There are 33 district offices, 29 of which have responsibilities for overseeing the safeguard reviews at state and local agencies. As of June 1999, there were 230 professional and 24 support staff assigned to the national and district disclosure offices. (App. VIII shows the staffing levels of these offices.) In addition to overseeing the safeguarding program, the district offices have responsibility for a variety of other disclosure activities, such as responding to requests under the Freedom of Information Act or Privacy Act. According to IRS, staff from the responsible IRS office visit the agency to review the procedures established and used by the agency to protect taxpayer information from unauthorized disclosure. In addition, they assess the agency’s need for, and use of, this information. IRS staff are to meet with agency personnel, review agency records, and visit agency facilities where taxpayer information is kept. They then prepare a report detailing their assessment of the agency’s processes and ability to fulfill the requirements of IRC section 6103(p)(4). In addition to conducting the triennial safeguard reviews, IRS District Disclosure Office staff are to conduct annual “need and use” reviews at all state and local agencies involved in tax administration. These reviews are done to validate the agencies’ continued need for and use of the tax information they receive from IRS. IRS’ safeguard reviews over the last 5 years have identified discrepancies in agency safeguard procedures and made recommendations for corrections. The reviews have uncovered deficiencies with agency safeguarding procedures, ranging from inappropriate access of taxpayer information by contractor staff to administrative matters, such as the failure to properly document the disposal of information. Discrepancies found by IRS during the safeguard reviews generally were procedural deficiencies and did not result in known unauthorized disclosures of taxpayer information. In their responses to the discrepancies found and recommendations made by IRS, agencies indicated that they would institute corrective actions. (App. VII provides examples of the discrepancies found by IRS during its safeguard reviews.) As noted above, one of the discrepancies that IRS found during safeguard reviews was that some agencies that received taxpayer information were using contractor personnel in a manner that might allow them access to taxpayer information. In its Report on Procedures and Safeguards Established and Utilized by Agencies for the Period January 1 through December 31, 1998, IRS highlighted this problem to Congress. IRS found agencies using contractor personnel in setting up agency computer systems in a manner that permitted the contractors to see taxpayer information. IRS also found agencies using contractor personnel in the disposal of taxpayer information, without having agency personnel observe the process to ensure that contractor personnel did not “access” the information. One of the major changes to IRS Publication 1075 in March 1999 was the inclusion of a section devoted to the appropriateness of, and precautions with, using contractor personnel to assist an agency in fulfilling the part of its mission that requires the use of taxpayer information. Some types of administrative discrepancies found by IRS staff during safeguard reviews included, among other things, that agencies were not properly documenting what information had been agency recordkeeping systems at field offices did not always meet the statutory requirements for accountability; agencies were not properly tracking the shipment of paper documents containing federal taxpayer information; and employees were not always aware of the criminal and civil penalties that can be imposed for unauthorized inspection or disclosure. We requested comments on a draft of this report from the Commissioner of Internal Revenue. Officials representing the Assistant Commissioner for Examination and the Commissioner’s Office of Legislative Affairs provided IRS’ comments at an August 12, 1999, meeting. IRS also provided written comments in an August 16, 1999, letter, which is reprinted in appendix X. IRS was in overall agreement with the draft report and said it fairly represented the scope and use of IRC section 6103 provisions regarding safeguarding taxpayer information. IRS also provided some additional information and technical comments. Where appropriate, we made changes to this report on the basis of these comments. We are sending copies of this report to Senator Fred Thompson, Chairman, and Senator Joseph I. Lieberman, Ranking Minority Member, Senate Committee on Governmental Affairs, and Representative Charles B. Rangel, Ranking Minority Member, House Committee on Ways and Means. We are also sending copies to the Honorable Lawrence H. Summers, Secretary of the Treasury; the Honorable Charles O. Rossotti, Commissioner of Internal Revenue; the Honorable Jacob Lew, Director, Office of Management and Budget; and other interested parties. We will also send copies to those who request them. If you or your staff have any questions concerning this report, please contact me or Joseph Jozefczyk at (202) 512-9110. Other major contributors to this report are acknowledged in appendix XI. The Internal Revenue Service (IRS) provided us with the following list of federal agencies in the Washington, D.C., metropolitan area that received, or maintained records containing, taxpayer data under the authority of Internal Revenue Code (IRC) section 6103. In addition, IRS identified the following six entities not in the Washington, D.C., metropolitan area that received taxpayer information. These were: Army and Air Force Exchange, Dallas, TX Department of the Treasury, Bureau of Public Debt, Parkersburg, WV Navy Exchange Service Command, Virginia Beach, VA Department of the Treasury, U.S. Customs, Indianapolis, IN Department of Veteran Affairs, Fort Snelling, MN U.S. Railroad Retirement Board, Chicago, IL As agreed with your office, we did not include these six in our survey because they were located outside the Washington, D.C., metropolitan area. IRS provided us with the following list of state and local agencies that received, or maintained records containing, taxpayer data under the authority of IRC section 6103. Certain federal, state, and local agencies, and others are authorized under Internal Revenue Code (IRC) section 6103 to receive taxpayer information from the Internal Revenue Service (IRS). The following describes the agencies, bodies, commissions, and other agents authorized by IRC section 6103 subsections to obtain taxpayer information, subject to safeguarding requirements prescribed in IRC section 6103(p)(4). Disclosures of taxpayer information can be made to state taxing agencies and state and local law enforcement agencies that assist in the administration of state tax laws. Disclosures under this section are to be used only for tax administration purposes, and states must justify the need for this information and must use the data provided. Certain disclosures of taxpayer information can be made to Committees of Congress and their agents upon written request from the Chairman of the House Committee on Ways and Means, the Senate Committee on Finance, or the Joint Committee on Taxation. Taxpayer information that can be associated with, or otherwise identify (directly or indirectly), a particular taxpayer can only be furnished to the Committee when in closed executive session, unless a taxpayer otherwise consents in writing to the disclosure. Agents, such as the General Accounting Office, and certain other Committees may also receive taxpayer information under subsections (f)(3) and (4). 6103(h)(2)–Disclosures of taxpayer information can be made to the Department of Justice for proceedings involving tax administration before a federal grand jury or any proceedings or investigation that may result in a proceeding before a federal grand jury or federal or state court. 6103(h)(5)–Disclosures of the address and status of a nonresident alien, citizen, or resident of the United States to the Social Security Administration (SSA) and Railroad Retirement Board can be made for purposes of carrying out responsibilities for withholding tax under section 1441 of the Social Security Act for Social Security benefits. 6103(i)(l) and (2)–Disclosures of taxpayer and other information can be made for use in certain criminal investigations. 6103(i)(3)–Disclosures of taxpayer information can be used to apprise appropriate officials of criminal activities or emergency circumstances. 6103(i)(5)–Disclosures of taxpayer information can be made to locate fugitives from justice upon the grant of an ex parte order by a federal district court judge or magistrate. 6103(i)(7)–Disclosures of taxpayer information can be made to officers and employees of the General Accounting Office in conducting audits of IRS; Bureau of Alcohol, Tobacco and Firearms (ATF); and any agency authorized by 6103(p)(6). 6103(j)(1)–Disclosures of taxpayer information can be made to the Department of Commerce (Census and Bureau of Economic Analysis). 6103(j)(2)–Disclosures of taxpayer information can be made to the Federal Trade Commission for statistical purposes. Only corporate returns can be disclosed for legally authorized economic surveys of corporations. (According to IRS, this section is obsolete because the Federal Trade Commission no longer performs these economic surveys.) 6103(j)(5)–Disclosures of taxpayer information can be made to the Department of Agriculture for the purpose of structuring, preparing, and conducting the census of agriculture pursuant to the Census of Agriculture Act of 1997. Disclosures of taxpayer information can be made to the Department of the Treasury’s Financial Management Service (FMS) for levies related to any federal debt. IRC section 6103(l)(1) and (l)(5) allow a specific type of disclosure between IRS and SSA commonly known as the Continuous Work History Sample Program. Under this disclosure, a small sample (approximately 1%) of the U.S. population’s Social Security-related data, wage information, and self-employment data is collected and used (1) for various studies to monitor trends that may affect Social Security programs; (2) as a model to assist in determining the effects of proposed program changes, including proposed legislative or administrative changes; and (3) to assess funding requirements related to trust funds and the budget. 6103(l)(1)–Disclosures of taxpayer information can be made to the Social Security Administration and Railroad Retirement Board for the administration of the Social Security Act and the Railroad Retirement Act. The common name for this disclosure is the Administration of the Social Security Act Program. Section 6103(l)(1) is very specific as to what information may be disclosed to SSA, and part of this information may be used by SSA only for purposes of carrying out its responsibility under section 1131 of the Social Security Act. 6103(l)(2)–Disclosures of taxpayer information can be made to the Department of Labor and the Pension Benefit Guaranty Corporation for administration of titles I and IV of the Employee Retirement Income Security Act of 1974. 6103(l)(3)–Disclosures of taxpayer information can be made to any federal agency administering a federal loan program. 6103(l)(5)–Disclosures of taxpayer information can be made to the Social Security Administration for the purposes of (1) carrying out an effective return processing program pursuant to section 232 of the Social Security Act and (2) providing information regarding the mortality status of individuals for epidemiological and similar research in accordance with section 1106(d) of the Social Security Act. The common name for this disclosure is the Annual Wage Reporting Program. Section 6103(l)(5) permits SSA and IRS to work together to process and share certain information. SSA and IRS conduct a number of exchanges to identify whether employee, employer, and wage data are correct and employers are submitting information as legally required. 6103(l)(6)–Disclosures of taxpayer information can be made to federal, state, and local child support enforcement agencies for the purposes of establishing and collecting child support obligations from individuals owing such obligations, including locating such individuals. Under IRC section 6103(p)(2), in conjunction with section 6l03(l)(6), IRS has authorized SSA to make disclosures to the Office of Child Support Enforcement, a federal agency that oversees child support enforcement at the federal level and acts as a coordinator for most programs involved with child support enforcement. 6103(l)(7)–Disclosures of taxpayer information can be made to federal, state, and local agencies administering certain benefits programs for the purposes of determining eligibility for, or correct amount of, benefits under such programs. Section 6103(l)(7) states that SSA will provide its return information to other agencies to assist them with specific welfare programs. The states (and other authorized agencies) provide the names and Social Security numbers of welfare applicants or recipients, and SSA provides the authorized information, such as wages and self-employment (net earnings) and retirement income. This disclosure between SSA and the other agencies is called the Beneficiary and Earnings Data Exchange Program. A similar program, the 1099 Program, involves the disclosure of unearned income information between IRS and federal, state, and local agencies administering these programs. 6103(l)(8)–Disclosures of taxpayer information can be made by SSA to other state and local child support enforcement agencies for the same purposes as 6103(l)(6).6103(l)(9)–Disclosures of taxpayer information can be made to state administrators of state alcohol laws for use in the administration of such laws. The disclosure is limited to information on alcohol fuel producers only. 6103(l)(10)–Disclosures of specific taxpayer information relating to tax refund offsets can be made to the agency requesting such offsets in order to collect specified debts, such as student loans or child support payments. This disclosure between IRS and other agencies was known as the Tax Refund Offset Program. This program is currently undergoing a “transition.” In the past, agencies received pre-offset debtor addresses, debtor identity information, the filing status (if joint), and any payment amount to the spouse of a joint return from IRS. Effective January 1, 1999, Treasury’s Financial Management Service assumed complete responsibility for the Treasury Offset Program. Except in the case of tax refund offsets to collect child support debts, agencies are now receiving offset information under the Treasury Offset Program procedures. Tax refund offset will, in general, be blended, or amalgamated, with other Treasury “offsets,” such as salary offsets. FMS is to perform the blending and tax information is not to be identified beyond FMS, except for agencies involved in collecting child support debts. When tax refund offset information is blended and unidentifiable under the Treasury Offset Program procedures, it is no longer considered return information and section 6103(p)(4) safeguarding procedures are not required. 6103(l)(11)–Disclosures of taxpayer information can be made by SSA to the Office of Personnel Management (OPM) for the purpose of administering the federal employees’ retirement system (chs. 83 and 84 of title 5, U.S.C.). The common name for this disclosure between SSA and OPM is the Federal Employees’ Retirement System Program. It involves a computer match where OPM provides the names and Social Security numbers of federal employees participating in the federal retirement system and SSA provides the wages, self-employment earnings, and retirement income information obtained under IRC sections 6103(l)(1) and (l)(5). 6103(l)(12)–Taxpayer information can be disclosed by IRS to SSA and by SSA to the Health Care Financing Administration (HCFA) to administer the Medicare program. The common name for this type of disclosure is the Medicare Secondary Payer Project. The purpose of this disclosure is to identify the employment status of Medicare beneficiaries to determine if medical care is covered by group health plans. It permits IRS to provide SSA with identity information, filing and marital status, and spouse’s name and Social Security number for specific years for any Medicare beneficiary identified by SSA. It also permits SSA to disclose to HCFA the names and Social Security numbers of Medicare beneficiaries receiving wages above a specified amount. Additionally, it permits HCFA to disclose certain return information to qualified employers and group health plans. 6103(1)(13)–Disclosures of taxpayer information can be made to the Department of Education to administer the “Direct Student Loans” program.6103(l)(14)–Disclosures of taxpayer information can be made to U.S. Customs to audit evaluations of imports and exports, and to take other actions to recover any loss of revenue or collection of duties, taxes, and fees determined to be due and owed as a result of such audits. 6103(1)(16)–Disclosures of taxpayer information can be made by SSA to officers or employees of the Department of the Treasury, a trustee or any designated officer, employee, or actuary of a trustee (as defined in the D.C. Retirement Protection Act), for the purpose of determining an individual’s eligibility for, or the correct amount of, benefits under the District of Columbia Retirement Protection Act of 1997. 6103(l)(17)–Disclosures of taxpayer information can be made to the National Archives and Records Administration for the purposes of appraisal of records for destruction or retention. Section 6103 (m)(2), (4), (6), and (7) are not subject to 6103(p)(4) safeguarding requirements unless address and entity information is redisclosed to an agent. If redisclosed to an agent, both the agency and the agent must safeguard the information. 6103(m)(2)–Disclosures of taxpayer information can be made to federal agencies for collection of federal claims under the Federal Claims Collection Act. Section 6103(m)(2) authorizes IRS to provide the mailing addresses of taxpayers to any federal agency to locate taxpayers in an attempt to collect federal claims. The common names for this type of disclosure is Taxpayer Address Request Program or the Recovery and Collection of Overpayment Process. It involves the federal agency providing IRS with a listing of debtors, identified by Social Security number and name, and IRS then providing the agency with the same information and the latest known address. 6103(m)(4)–Disclosures of taxpayer information can be made to the Department of Education for collection of Student Loans. 6103(m)(6)–Disclosures of taxpayer information can be made to officers and employees of the Blood Donor Locator Service in the Department of Health and Human Services for the purpose of locating individuals to inform donors of the possible need for medical care and treatment relating to acquired immune deficiency syndrome. 6103(m)(7)–Disclosures of taxpayers’ mailing addresses can be made to SSA for the purpose of mailing the Personal Earnings and Benefit Estimate Statements (Social Security account statements). 6103(n)–Disclosures of taxpayer information can be made to contractors to the extent necessary and for the various activities and services related to tax administration. These disclosures can only be made by the Treasury Department, a state tax agency, SSA, and the Department of Justice and in accordance with regulations prescribed by the IRS Commissioner. 6103(o)(1)–Disclosures of taxpayer information can be made to ATF for administering certain taxes on alcohol, tobacco, and firearms. Tables II.1 and II.2 show, for the agencies we surveyed that received taxpayer information in 1997 or 1998, the authorization under which they received the information. Internal Revenue Code (IRC) section 6103 allows the Internal Revenue Service (IRS) to disclose taxpayer information to federal agencies and authorized employees of those agencies. Disclosure of taxpayer information is to be used strictly for the purposes outlined by federal statutes and in accordance with IRS policy and procedures. IRC sections 6103(h) and 6103(i) allow IRS to disclose taxpayer information to the employees and officers of any federal agency for tax administration purposes as well as for the administration of federal laws not related to tax. Under 6103(h), IRS can disclose information to the Department of Justice for federal tax investigations and to the Social Security Administration (SSA) and Railroad Retirement Board (RRB) for purposes of withholding taxes. IRC section 6103(i) allows the disclosure of information for use in federal nontax criminal investigations and other activities not related to tax administration. Table III.1 shows some types of taxpayer information disclosed and the disclosure format and frequency. IRC section 6103(j) allows IRS to disclose taxpayer information to the Departments of Agriculture and Commerce and to officers and employees of the Department of the Treasury for statistical use. Table III.2 shows the types of taxpayer information disclosed and the disclosure format and frequency. Taxpayer information provided Information returns master file (SSN, name, address) Individual master file extract (SSN, name, address, marital status, exemptions, dependents, income, and return type) Corporate income tax return information (name, address, EIN, net income or loss, assets, and gross receipts) Employment tax returns records (EIN, total compensation paid, taxable period, number of employees, total taxable wages paid, and tip income) Business master file entity (EIN, name, address, filing requirements, accounting period, and employment code) Weekly economic data and economic and agriculture census (SSN, EIN, address, receipts, accounting period, wages, interest, assets, and cost of goods) Information from application for EIN Statistics of income corporate sample (credits, balance sheet, income statement, and tax items) Under IRC section 6103(l), disclosures can be made to certain federal agencies for purposes other than for tax administration. Disclosure of taxpayer information can be made to any federal agency administering a federal loan program, as well as to those federal agencies administering certain programs under the Social Security Act, the Food Stamp Act of 1977, title 38 U.S.C., or certain other housing assistance and benefits programs. Disclosures can also be made to SSA, RRB, the Pension Benefit Guaranty Corporation, and the Department of Labor for the administration of the Employee Retirement Income Security Act of 1974 and for carrying out a return processing program. The Veterans Health Administration, Veterans Benefits Administration, and Department of Housing and Urban Development also receive federal taxpayer information from SSA and IRS under the authority of IRC section 6103(l)(7) for use in administering programs authorized under title 38 and certain housing assistance programs. SSA also receives unearned income information from IRS, which it uses in administering the Supplemental Security Income program. Additionally, IRC section 6103(l) allows disclosure by SSA to the Health Care Financing Administration and to certain other agencies for determining eligibility for, or the correct amount of, benefits. Table III.3 shows the types of taxpayer information disclosed and the disclosure format and frequency. Taxpayer information provided Form 8300 information Tax liability and delinquency information W-2s and W-3s (wage data submitted by employers) Unearned income from various Form 1099s Wages, self-employment earnings and retirement income SSN, filing and marital status, taxpayer name, addresses, employee EINs Individual income tax return information (SSN, filing status, amount and nature of income, number of dependents) IRC section 6103(m) allows the disclosure of taxpayer information for collecting federal claims and for locating registered blood donors. All federal agencies can receive the information for collection of claims, such as student loans, under the Federal Claims Collection Act. The Department of Health and Human Services receives the taxpayer information as part of its Blood Locator Service, for the purpose of locating donors. IRC section 6103(o) allows disclosures of the collection of certain taxes on alcohol, tobacco, and firearms. Table III.4 shows the types of taxpayer information disclosed and the disclosure format and frequency. Under the provisions of Internal Revenue Code (IRC) section 6103(d), the Internal Revenue Service (IRS) is authorized to make disclosures for state tax administration purposes to state tax officials and state and local law enforcement agencies. In general, taxpayer information can be disclosed to any state agency, body, or commission, or its legal representative for the administration of state tax laws, including for locating any person who may be entitled to a state income tax refund. Table IV.1 shows some of the types of taxpayer information disclosed and the disclosure format and frequency. In addition to the types of taxpayer information shown in table IV.1, in some states, the Attorney General’s Office receives inheritance tax and estate tax information from IRS, including tax credits and closing letters to taxpayers. This type of taxpayer information is disclosed quarterly on hard copy or magnetic tape. In certain states, such as Texas, that have no state income tax, the State Comptroller’s Office—which is responsible for collecting state sales and inheritance taxes—receives taxpayer information from IRS. The taxpayer information consists of estate and gift tax audit reports and income information, such as Form 1099s, on hard copy or magnetic tape, and transcripts of business returns. This information is received on an ongoing, as well as on a case-by-case, basis. The state of Wyoming also does not have an income tax, but its department of transportation enforces fuel tax laws. IRS provides Wyoming with fuel tax adjustment results on hard copy and only upon specific request. Some cities, such as St. Louis and Kansas City, levy an income-based tax on their residents and those taxpayers that work in the city. These cities receive income tax audit reports from IRS when adjustments are made to wages or self-employment income. This information is received quarterly on hard copy. IRC section 6103(l)(6) allows IRS to disclose taxpayer information to state and local child support enforcement agencies. In general, taxpayer information can be disclosed to any state or local child support enforcement agency for establishing and collecting child support obligations, including any procedure for locating individuals owing such obligations. IRC section 6103(l)(8) permits the Social Security Administration (SSA) to disclose certain taxpayer information to state and local child support enforcement agencies. However, section (l)(6) also permits the disclosure of the same information, and more, to federal, state, and local agencies. Currently, SSA is not making any disclosures of taxpayer information to state and local child support enforcement agencies under 6103 section (l)(8), but is making disclosures to the federal Office of Child Support Enforcement (OCSE) on behalf of IRS. OCSE provides the names and, if known, Social Security numbers. SSA performs computer matches and provides Social Security numbers from SSA records, the last known address from SSA records, and the address of the last known employer from W-2 and W-3 taxpayer information. OCSE then provides the information to the state and local child support enforcement agencies. Table IV.2 shows the other types of taxpayer information disclosed and the disclosure format and frequency. Under IRC section 6103(l)(7), disclosures can be made to state and local agencies administering certain programs under the Social Security Act, the Food Stamp Act of 1977, title 38 U.S.C., or certain other housing assistance and benefits programs. The Deficit Reduction Act of 1984 required state public assistance agencies administering certain programs under the Social Security Act or the Food Stamp Act of 1977 to establish an income eligibility verification system. These agencies receive federal taxpayer information under the authority of the IRC 6103(l)(7) from SSA and IRS to be used solely for the purpose of, and to the extent necessary in, determining eligibility for, or the correct amount of benefits,under, the specified programs. The agencies receive wage and self-employment information from SSA through electronic transmissions and unearned income information (Form 1099s) from IRS through magnetic tapes. Table IV.3 shows the type of information disclosed and the disclosure format and frequency. Internal Revenue Code (IRC) section 6103 is very specific about the authorized use of any federal taxpayer data. During our study, Internal Revenue Service (IRS) officials and other federal and state officials indicated that there are many possible authorized uses for tax returns and return information in accordance with IRC section 6103 requirements. Agency officials stated that taxpayer information is used for tax administration and law enforcement purposes, for the administration of federal laws not related to tax administration, for statistical uses, for establishing and collecting child support obligations, and for determining eligibility for benefits. Table V.1 outlines some of the specific uses of federal taxpayer information. Possible use Tax administration and tax withholding purposes Criminal investigation and litigation Reporting criminal activities Judicial or administrative procedures Enforce federal criminal or civil statutes Locate fugitives from justice Conducting government program audits Statistical purposes Offsets Storing and maintaining data for IRS Administration of welfare and public assistance programs Collection and enforcement of child support Verify taxpayer filed original or amended return and initiate state audit Initiate state penalty investigation Audit selection Provide listing of alleged violators of criminal tax laws Verify or update addresses Skip tracing Sales tax matching Identify nonfilers Determine discrepancies in reporting of income Identify S corporation shareholders who avoid state tax by taking dividends in lieu of wages Statistical and revenue forecasting Identify payers and employers not reporting to state and determine underreporters Identify partnerships with changes in number of partners to detect possible sale of partnership interest Compare officers’ salaries and total wages paid on corporate returns to withholding tax filed Compare federal tax withheld to state tax withheld Locate delinquent taxpayers Identify out-of-state income (Continued) As a condition of receiving taxpayer information, agencies must show, to the satisfaction of the Internal Revenue Service (IRS), that their policies, practices, controls, and safeguards adequately protect the confidentiality of the taxpayer information they receive from IRS. The agencies must ensure that the information is used only as authorized by statute or regulation and disclosed only to authorized persons. IRS has implemented specific guidelines that all federal, state, and local agencies are to follow to properly safeguard taxpayer information. These guidelines, outlined in IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies, are summarized below. Federal, state, and local agencies, and other authorized recipients, may request taxpayer information from IRS in the form of a written request signed by the head of the requesting agency or other authorized official. IRS also requires that a formal agreement—a Safeguard Procedures Report—be provided by the agency that specifies the procedures established and used by the agency to prevent unauthorized access and use and describes how the information will be used upon receipt. The Safeguard Procedures Report should be submitted to IRS at least 45 days before the scheduled or requested receipt of taxpayer information. Any agency that receives taxpayer information for an authorized use under Internal Revenue Code (IRC) section 6103 may not use the information in any manner or for any purpose not consistent with that authorized use. If an agency needs federal tax information for a different authorized use under a different provision of IRC section 6103, a separate request under that provision is necessary. An unauthorized secondary use is specifically prohibited and may result in discontinuation of disclosures to the agency and in the imposition of civil or criminal penalties on the responsible officials. Before granting agency officers and employees access to taxpayer information, officers and employees should certify that they understand security procedures and instructions requiring their awareness and compliance. Employees should be required to maintain their authorization to access taxpayer information through annual recertification. As part of the certification and at least annually, employees should be advised of the provisions of IRC 7213(a), 7213A, and 7431. Agencies should make officers and employees aware that disclosure restrictions and the penalties apply even after employment with the agency has ended. Taxpayer information may be obtained by state tax agencies from IRS only to the extent the information is needed, and is reasonably expected to be used, for state tax administration. Some state disclosure statutes and administrative procedures permit access to state tax files by other agencies, organizations, or employees not involved in tax matters. IRC 6103(d) does not permit access to taxpayer information for purposes other than for state tax administration. State and local tax agencies are not authorized to furnish taxpayer information to other state agencies, tax or nontax, or to political subdivisions, such as cities or counties, for any purpose, including tax administration. State and local tax agencies may not furnish taxpayer information to any other states, even where agreements have been made, informally or formally, for the reciprocal exchange of state tax information. Also, nongovernment organizations, such as universities or public interest organizations performing research, cannot have access to taxpayer information. Statutes that authorize disclosure of taxpayer information do not authorize further disclosures. Unless IRC section 6103 provides for further disclosures by the agency, the agency cannot make such disclosures. Each agency must have its own exchange agreement with IRS or with the Social Security Administration (SSA). When an agency is receiving data under more than one section 6103 authorization, each exchange or release of taxpayer information must have a separate agreement. An agency’s records of the taxpayer information it requests should include some account of the result of its use or why the information was not used. If an agency receiving taxpayer information on a continuing basis finds it is receiving information that, for any reason, it is unable to utilize, it should contact IRS to modify the request. Federal, state, and local agencies authorized under IRC section 6103 to receive taxpayer information are required by IRC section 6103 (p)(4)(A) to establish a permanent system of standardized records of requests made by or to them for disclosure of the information. The records are to be maintained for 5 years or for the applicable records control schedule, whichever is longer. When taxpayer information is received in electronic form, authorized employees of the recipient agency must be responsible for securing magnetic tapes or cartridges before processing and ensuring that the proper acknowledgment form is signed and returned to IRS. Tapes containing federal taxpayer information, any hard-copy printout of a tape, or any file resulting from the processing of a tape is to be recorded in a log that identifies (1) date received; (2) reel or cartridge control number contents; (3) number of records; (4) movement; and (5) if disposed of, the date and method of disposition. Taxpayer information, other than that in electronic form, must be maintained by (1) taxpayer name; 2) tax year(s); (3) type of tax return or return information; (4) reason for the request; (5) date requested; (6) date received; (7) exact location of the taxpayer information; (8) who has had access to the data; and (9) if disposed of, the date and method of disposition. If the agency has the authority to make further disclosures, information disclosed outside the agency must be recorded on a separate list that reflects to whom the disclosure was made, what was disclosed, and why and when it was disclosed. IRS has categorized taxpayer and privacy information as high-security items. Security for a document, item, or an area may be provided by locked containers of various types, vaults, locked rooms, locked rooms with reinforced perimeters, locked buildings, guards, electronic security systems, fences, identification systems, and control measures. The required security for taxpayer information received depends on the facility, the function of the agency, how the agency is organized, and what equipment is available. Agencies receiving taxpayer information are required to establish a uniform method of protecting data and items that require safeguarding. The Minimum Protection Standards System, which is utilized by most agencies, has been designed to provide agencies with a basic framework of minimum-security requirements. Since some agencies may require additional security measures, they should analyze their individual circumstances to determine the security needs at their facility. Care must be taken to deny access to areas containing taxpayer information during normal working hours. This can be accomplished by restricted areas, security rooms, or locked rooms. In addition, taxpayer information in any form (computer printout, photocopies, tapes, notes, etc.) must be protected during nonworking hours. This can be done through a combination of methods, including a secured or locked perimeter or secured area. When it is necessary to move taxpayer information to another location, plans must be made to properly protect and account for all of the information. Taxpayer information must be in locked cabinets or sealed packing cartons while in transit. Accountability should be maintained to ensure that cabinets or cartons do not become misplaced or lost. The handling of taxpayer information and tax-related documents must be such that the documents do not become misplaced or available to unauthorized personnel. Only those employees who have a need to know and to whom disclosures may be made under the provisions of the statute should be permitted access to information. In the event that taxpayer information is hand-carried by an individual in connection with a trip or in the course of daily activities, it must be kept with that individual and protected from unauthorized disclosure. Data stored and processed by computers and magnetic media should be physically secured and controlled in a restricted access area. If the confidentiality of the taxpayer information can be adequately protected, alternative work sites, such as employees’ homes or other nontraditional work sites, can be used. Despite location, taxpayer information remains subject to the same safeguard requirements and the highest level of attainable security. Agencies are required by IRC 6103(p)(4)(C) to restrict access to taxpayer information only to persons whose duties or responsibilities require access. Taxpayer information should be clearly labeled “federal tax information” and handled in such a manner that it does not become misplaced or available to unauthorized personnel. Access to taxpayer information must be strictly on a need-to-know basis. Information must never be indiscriminately disseminated, even within the recipient agency. Agencies must evaluate the need for taxpayer information before the data are requested or disseminated. An employee’s background and security clearance should be considered when designating authorized personnel. No person should be given more taxpayer information than is needed to perform his or her duties. To avoid inadvertent disclosures, it is recommended that taxpayer information be kept separate from other information to the maximum extent possible. In situations where physical separation is impractical, the file should be clearly labeled to indicate the taxpayer information is included and the file should be safeguarded. Any commingling of data on tapes should be avoided. Processing of taxpayer information in magnetic media format, microfilms, photo impressions, or other formats should be performed by agency- owned and -operated facilities, or contractor or agency shared facilities. All systems that process taxpayer information must meet the provisions of OMB Circular A-130, appendix III and Treasury Directive Policy 71-10. The Department of Defense Trusted Computer System Evaluation Criteria (DOD 5200.28-STD), commonly called the “Orange Book,” should be used as the basis for establishing systems that process taxpayer information. All computer systems processing, storing, and transmitting taxpayer information must have computer access protection controls (controlled access protection level C-2). To meet C-2 requirements, the operating security features of the system must have (1) a security policy, (2) accountability, (3) assurance, and (4) documentation. Agencies should assign overall responsibility to an individual (security officer) who is knowledge about information technology and applications. This individual should be familiar with technical controls used to protect the system from unauthorized entry. The two acceptable methods of transmitting taxpayer information over telecommunications devices are encryption and the use of guided media. Encryption involves the altering of data objects in a way that the objects become unreadable until deciphered. Guided media involves the use of protected microwave transmissions or the use of end-to-end fiber optics. Connecting the agency’s computer system to the Internet will require “firewall” protection to reduce the threat of intruders accessing data files containing taxpayer information. Agencies receiving taxpayer information from IRS are also required to conduct internal inspections. The purpose of these inspections is to ensure that adequate safeguard and security measures are maintained. Agencies should submit copies of these inspections to IRS with their annual Safeguard Activity Report. IRC section 6103 (p)(4)(E) requires agencies receiving taxpayer information to file a report that describes the procedures established and used by the agency for ensuring the confidentiality of the information received from IRS. The Safeguard Procedures Report is a record of how taxpayer information is to be processed and protected from unauthorized disclosure. Agencies should submit a new Safeguard Procedures Report every 6 years or whenever significant changes occur in their safeguard program. Agencies must file an annual Safeguard Activity Report, which advises IRS of changes to the procedures or safeguards described in the Safeguard Procedures Report. The Safeguard Activity Report also (1) advises IRS of any future actions that will affect the agency’s safeguard procedures, (2) summarizes the agency’s current efforts to ensure the confidentiality of the taxpayer information, and (3) certifies that the agency is protecting taxpayer information in accordance with IRC section 6103 requirements and the agency’s own security requirements. A safeguard review is an on-site evaluation of the use of federal tax information received from IRS and the measures used by the receiving agency to protect that data. IRS conducts on-site reviews of agency safeguards regularly. Reviews of state and local agencies are conducted by IRS District Disclosure personnel. Reviews of federal agencies and state welfare agencies are conducted by the IRS Office of Governmental Liaison and Disclosure, Office of Safeguards. IRS safeguard reviews cover the six requirements of IRC section 6103(p)(4), which are (1) recordkeeping, (2) secure storage, (3) restricting access, (4) other safeguards, (5) reporting requirements, and (6) disposal. Agencies are required by IRC section 6103(p)(4)(F) to take certain actions upon completion of their use of taxpayer information in order to protect its confidentiality. Agency officials and employees should either return the information, and any copies, or make the information “undisclosable” and include in the agency’s annual report a description of the procedures used. If the agency elects to return the information, a receipt process should be used. Taxpayer information should never be provided to agents or contractors for disposal unless authorized by the IRC. The Internal Revenue Service (IRS) routinely conducts on-site reviews of agencies’ safeguard procedures to ensure that the procedures fulfill IRS requirements for protecting taxpayer information from unauthorized disclosure. After completing the review, IRS prepares a report of its findings and recommendations and sends the report to the agency for comment. Upon receiving the agency’s comments, IRS annotates its report to indicate whether it accepts responses as correcting any discrepancies reported. The following excerpts are examples of the findings, discussions, recommendations, agency responses, and IRS comments found in recent IRS reports of safeguard reviews. The agency permitted a number of contractors to have access to return information. Some of the contractors are authorized to have access, while others are not. Also, when contractor access was authorized, the agency was not always including “safeguarding” clauses in all contracts. The agency uses hundreds of contractors. Internal Revenue Code (IRC) section 6103 generally does not authorize contractors to have access to federal taxpayer information. Certain exceptions exist, such as section 6103(n), which permits contracts for tax administration purposes, and section 6103(m)(2) and (7), which permit disclosures for the collection of federal debt and for the mailing of personal earnings and benefits estimate statements, respectively. However, there is not an exception for the purposes of administering the agency responsibilities under the act, nor for most other IRC section 6103 authorized disclosures. The agency uses contractors for the printing of the personal earnings and benefits estimate statements and has included a “safeguarding” clause, which requires that the contractor’s employees be made aware of the taxpayer information, its restricted access and use, and the penalty provisions for unauthorized access or use. The agency also uses a contractor for developing microfilm with taxpayer information. This contractor is authorized access, but the contract does not contain “safeguarding” language relating to taxpayer information. It does have confidential clauses relating to the Privacy Act provisions. The agency has also contracted out for the disposal of the paper Form W- 2s and W-3s received. An earlier contract allowed for the contractor to shred the material to 2-inch strips or less, which does not meet the IRS required standard of 5/16-inch or less for shredding. The current contract states that all material will be totally destroyed beyond legibility or reconstruction through shredding, maceration, or pulping. However, a visit to the contractor’s site revealed that the contractor is shredding material, but not always to the original 2-inch requirement. The required “safeguarding” clauses are not in the contract, and the employer is not advising his employees of the confidentiality and penalties associated with accessing taxpayer information. Many other storage, retrieval, and disposal activities are contracted out by the agency. Two units of the agency use contractors to conduct most of the activities at their facilities, where beneficiary files (with taxpayer information) are stored in open boxes. This is also true of the records center that the agency contracts with to store, dispose of, and retrieve millions of beneficiary files. Other units of the agency are also contracting out for disposition of information. IRC section 6103 does not authorize these contractors to have access to taxpayer information, which they do. In order to comply with IRC section 6103 and with IRS standards, the agency needs to review its use of contractors. When contractors are authorized to have access to taxpayer information, the agency needs to ensure that “safeguarding” clauses are included in the contracts. When contractors are not authorized access to this information, the agency needs to ensure that it is not permitting such access. Specific examples include adding the safeguarding clauses to the microfilm development contract; adding the safeguarding clauses to the contract for the disposal of paper return information, mainly W-2s and W-3s; ensuring that disposal methods meet IRS standards; developing policies and procedures to ensure that contractors who are not authorized to have access do not have access; and making units and field offices aware of “unauthorized access” by contractors. The agency agreed that safeguarding clauses need to be included in contracts when contractors are authorized to have access to taxpayer information and that contractors should not have access unless authorized. IRS was still being reviewing this agency’s safeguard report and had not finalized its comments at the time we prepared our report. The recordkeeping system at the agency’s field offices does not meet all of the statutory requirements for tax information accountability. When federal tax returns or return information are received, agencies are required to maintain a record of taxpayer name, tax year(s), type of information, reason for request, date requested, date received, exact location of data, and who has had access to the data. Further, if and when the data are disposed of, agencies are required to maintain a record of the date and method of disposition. Agency field offices maintain a system of records for tracking documents and evidence obtained during a criminal investigation. Returns and return information are generally placed in an evidence envelope and associated with the case files, which are kept in the office’s filing area. The envelope is annotated as to contents and any additional descriptive information the case agent may write down. The agency’s system of standardized records contained many of the required items listed above, but not all of them. Further, tax documents controlled by the agency’s seizure team unit may not necessarily show who has had access to the information. Since information used to track returns and return information is dependent upon information furnished by the case agent, the agency should ensure that the agents are aware of the elements required to meet the statutory requirements for tracking federal tax data. Also, the seizure team unit may wish to consider using some type of “charge-out” form to record accesses to tax information. The agency uses a central recordkeeping system for maintaining all investigative files. The system is outlined in the Federal Register. During IRS’ review, access to information by the IRS team was limited to the federal tax return and return information contained in the evidence envelope, and not to the entire file. Information regarding the taxpayer name, tax year(s), reasons for request, and data requested is contained in the case file and supplied to IRS during the request for the information. The date received and type of information is maintained in the evidence log. Access to case information is restricted based on the need-to-know and to individuals having a file on the case. Agency procedures used for controlling access to federal tax return and return information within the seizure team unit are the same procedures used for investigative information. Information is restricted to individuals with a role in the asset forfeiture. Along with the agency’s response, the appropriate Federal Register cite was provided. The agency’s response was accepted. Agency employees that have access to federal tax data are not aware of the criminal and civil penalties that can be imposed for unauthorized disclosure of the data. IRS Publication 1075 requires that, as part of an agency’s employee awareness program, each employee that has access to federal tax data should receive copies of IRC sections 7213(a) and 7431, which describe the criminal and civil penalties applicable to the unauthorized disclosure of federal tax data. In addition, employees must be advised at least annually of these provisions. Personnel that IRS’ review team talked with could not recall receiving copies of the IRC penalty provisions. Employees receive periodic reminders about protecting sensitive information; however, they are not specifically reminded of the provisions of IRC sections 7213(a) and 7431. All employees that are authorized to have access to federal tax data should receive a copy of IRC section 7213(a) and 7431, and they should be reminded at least annually of the criminal and civil penalties that can be imposed under the IRC for the unauthorized disclosure of federal tax data. Although employees were not specifically aware of the penalties for unauthorized disclosure of federal tax data as contained in the IRC, agency employees knew about the penalties for unauthorized disclosure of information contained in investigative files. The revised IRS Publication 1075 now contains penalty provisions in exhibits 3 and 4. Along with the agency response, IRS received a copy of Security Bulletin 96-03 with attachments A-2 and A-3, with instructions that the information in the document be reviewed annually by all personnel who have access to tax return and return information provided to the agency by IRS. Observance of Security Bulletin 96-03 will satisfy the IRS requirement. The last Safeguard Activity Report for this agency was dated June 29, 1995—2 years before the review. Also, the report did not contain the information as required in IRS Publication 1075. Additionally, IRS records showed the last Safeguard Procedures Report was submitted in 1988. The statute requires reports to be furnished to IRS describing the procedures established and utilized to ensure the confidentiality of tax data received from IRS. After the submission of the Safeguard Procedures Report, a written Safeguard Activity Report is to be submitted annually to give information regarding the agency’s safeguard program. The Safeguard Procedures Report should be updated as changes occur, and a new report submitted when warranted. A Safeguard Activity Report must be submitted to IRS no later than January 31 each year. The report must contain the required information as shown in IRS Publication 1075. Because of changes within the agency since 1988, a current Safeguard Procedures Report was requested. The agency responded that it would comply with all reporting requirements. It assigned its internal audit unit the annual inspection as required by IRS Publication 1075 and planned to submit the Safeguard Activity Report. The agency submitted an updated Safeguard Procedures Report. IRS accepted the response, but explained to the agency that the Safeguard Procedures Report was not a “one-time” report and that it should be updated as changes occur and a new one submitted when warranted. IRS requested that a revised version be submitted reflecting changes made as a result of IRS’ review. The agency’s records did not list some employees who were receiving and using taxpayer information to determine Medicaid eligibility. The Deficit Reduction Act of 1984 requires states to have an income and eligibility verification system for use in administering certain benefits programs. State welfare agencies are required to obtain and use unearned income data from IRS and other wage and income data from SSA in the verification process of these benefits programs. Accordingly, IRC section 6103 authorizes the disclosure of taxpayer information to federal, state, and local agencies by IRS or SSA for use in the administration of these benefits programs. As a condition of receiving taxpayer information, state welfare agencies are required to maintain a permanent system of standardized records that documents all requests for, receipt of, and disclosures of taxpayer information made to or by the agencies. During its review of this agency, IRS found that, while some employees acknowledged using taxpayer information, the agency’s records did not list the employees as having received taxpayer information. IRS found that taxpayer information, in the form of a printout, was being disclosed to Medicaid technicians who are stationed at various state hospitals. The technicians receive the information to determine Medicaid eligibility for applicants who were hospitalized. Upon receipt from the agency’s mailroom, the printout is accompanied by an acknowledgment form that employees must sign, indicating receipt of taxpayer information. IRS found that technicians were properly signing the acknowledgment form and returning it to the mailroom to indicate receipt of the information. However, the agency’s records did not reflect that taxpayer information was being disclosed from the agency to its employees located at these various state hospitals. The state hospitals that get taxpayer information should be included so that the agency’s records reflect a complete and accurate listing of all requests, receipts, and disclosures of taxpayer information. The Medicaid technicians are stationed at the state hospitals at various times. For this reason, any disclosure of taxpayer information to these hospitals will be managed by an agency coordinator. To improve recordkeeping, the coordinator will provide a listing of the disclosures, and this list, along with the agency acknowledgment forms, will be maintained in the standardized records. The General Services Mail and Distribution Manager will ensure that the records are received. Agency’s response was acceptable. Table VII.1 summarizes some of the other deficiencies found during IRS’ on-site safeguard reviews of federal, state, and local agencies. Specific deficiency noted No system exists for ensuring that all keys to secure areas are accounted for or that access to keys is restricted. No records exist of when taxpayer information was received and destroyed, or of how the information was destroyed. Taxpayer information locked in the supervisor’s office, but not in locked containers or file cabinets, which would properly protect the information from inadvertent or unauthorized disclosure. Agency mailroom not secure during nonduty hours, and employees are leaving taxpayer information unsecured, in unlocked containers. No reconciliation of transmittal documents to actual receipts and shipments of federal return information. There was not adequate protection for tax information. There was no agency requirement that containers be locked, and some containers cannot be locked. There was not a specific individual responsible for physical security. Ground floor entrances were not locked during office hours, and there was a need for “Employee Only” signs. IRS tapes and income and eligibility verification system documents were transported via unsecured courier service. Tax information was combined with nontax information and accessible by other employees not directly involved in program. Several federal tax documents were found that were not labeled as such. Agency was sharing taxpayer information with other state agencies and contractors that are not authorized to receive information. Agency was using an unauthorized method of destroying taxpayer information. Existing procedures for repairs to equipment do not appear to address removal of federal return information before repairs are made. Agency was not utilizing proper destruction procedures for taxpayer information that is no longer being used. Computer systems containing tax information do not display warning banners reminding employees of safeguarding requirements and associated penalties. Agency was not promptly removing from the system employees that no longer needed access to taxpayer information. Taxpayer data was not transmitted through secure communication lines to prevent unauthorized use or access. Unsecured dial-in modems were being used for taxpayer information on agency systems, and information on the mainframe was not adequately restricted. Employees were not properly trained on all aspects of safeguarding tax information. Some were not aware of the civil and criminal penalties associated with unauthorized disclosure or of the Taxpayer Browsing Act. Internal security inspections were not conducted, or the results were not documented. There was no documentation of corrective actions, if any were taken. The agency needs to post signs and send memos to remind employees of their responsibility to safeguard federal tax information. Listed below are the staffing levels, as of June 1999, for IRS’ national and district offices that are responsible for IRS’ safeguarding program. In addition to overseeing the safeguarding program, the district offices have responsibilities for a variety of other disclosure activities. These activities include, among other things, conducting disclosure awareness seminars for state and local agency personnel, processing Freedom of Information Act and Privacy Act requests, processing ex parte orders for grand jury or federal criminal investigations, testifying in federal court to certify that certain documents are true copies of tax return information, and reviewing subpoenas served to IRS personnel to advise them of what they can and cannot disclose in court. In addition to those named above, Michelle Bowsky, John Gates, Tim Outlaw, Anne Rhodes-Kline, Kirsten Thomas, and Carrie Watkins made key contributions to this report. The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touch-tone phone. A recorded menu will provide information on how to obtain these lists.

Summary: Pursuant to a congressional request, GAO assessed the disclosure practices and safeguards employed by the Internal Revenue Service (IRS) and other federal, state, and local agencies to protect taxpayer information, focusing on: (1) which federal, state, and local agencies receive taxpayer information from IRS; (2) what type of information they receive; (3) how the taxpayer information is being used; (4) what policies and procedures the agencies are required to follow to safeguard taxpayer information; (5) how frequently IRS is to monitor agencies' adherence to the safeguarding requirements; and (6) the results of IRS' most recent monitoring efforts. GAO noted that: (1) there were 37 federal and 215 state and local agencies that received, or maintained records containing, taxpayer information under provisions of section 6103 during 1997 or 1998; (2) the information that agencies received included, among other things, the taxpayers' names, Social Security numbers, addresses, and wages; (3) the information came in a variety of formats; (4) some agencies received the information on a regular schedule; (5) others received the information on an as-needed basis, such as while conducting criminal investigations; (6) federal, state, and local agencies said they used taxpayer information for one of several purposes, such as administering state tax programs, assisting in the enforcement of child support programs, verifying eligibility and benefits for welfare and public assistance programs, and conducting criminal investigations; (7) before receiving taxpayer information from IRS, agencies are required to advise IRS how they intend to use the information and to provide IRS with a detailed safeguard plan that describes the procedures established and used by the agency for ensuring the confidentiality of the information they want to receive; (8) these safeguard plans are supposed to be updated every 6 years or if significant changes are made to the agencies' procedures; (9) agencies are also required to submit annual reports to IRS summarizing their efforts to safeguard taxpayer information and any minor changes to their safeguarding procedures; (10) in addition to providing IRS with safeguarding plans and annual reports, agencies' Offices of Inspector General may also review internal agency programs for safeguarding restricted or classified information; (11) IRS conducts on-site reviews to ensure that agencies' safeguard procedures fulfill IRS requirements for protecting taxpayer information; (12) IRS' National Office of Governmental Liaison and Disclosure, Office of Safeguards, has overall responsibility for safeguard reviews to assess whether taxpayer information is properly protected from unauthorized use or access as required by the Internal Revenue Code and to assist in reporting to Congress; (13) IRS' safeguard reviews have identified discrepancies in agency safeguard procedures and made recommendations for corrections; and (14) the reviews have uncovered problems with agency safeguarding procedures, ranging from inappropriate access to taxpayer information by contractor staff to administrative matters, such as the failure to properly document the disposal of information.