Shred alert: How preparers dispose of sensitive documents
A news story from a back alley in New Mexico highlighted an issue that’s playing out across the country: Old tax records containing information ranging from Social Security numbers and checkbooks to bank account papers to phone numbers getting left out in public dumpsters.
In the New Mexico case, according to reports, many of the documents were prepared by the nearby office of a national prep chain, but whatever the size of the tax practice, proper disposal of old client documents is a matter of workflow, awareness and the correct tools for both storage and actual destruction.
“We retain a scanned copy of clients’ returns and data for a couple years, more than the IRS requirements,” said Scott Kadrlik, a CPA and managing partner at Meuwissen, Flygare, Kadrlik & Associates in Eden Prairie, Minnesota. “They’re deleted and removed from our systems at that time. We have a systematic approach to replacing computer hard drives and destroying them in a manner that prevents them from being accessed. We do the same with copiers and printers that have hard drives.”
“Everything we have is digital, so no old paper records to destroy,” said Bruce Primeau, a CPA and president of Summit Wealth Advocates, in Prior Lake, Minnesota. “We have an IT consultant who handles all of our transitions from an old computer to a new one. They take care of wiping clean and the destruction of any old computer drives.”
Debra James, an Enrolled Agent at Genesis Accounting & Management Services, in Lorain, Ohio, returns original documents to clients. “If we keep copies of anything,” she said, “we keep them with tax returns for four years, after which we purge the files and have them picked up and professionally shredded.”
A big truck
One method seems most popular with preparers looking to destroy old client papers. “I shred everything,” said Larry Pon, a CPA and EA at Pon & Associates, in Redwood City, California. “A big truck shows up to my office and eats all my files.”
“We have a bonded shredding service on our floor that we use to shred all taxpayer information not returned to our clients once we PDF it,” said Brian Stoner, a CPA in Burbank, California. “Old computer drives are crushed and demagnetized, then sent to an electronic-waste disposal service.”
“We shred paper [but] we don’t keep a lot of it around and store client records on hard drives or cloud back-up,” said Morris Armstrong, an EA at Armstrong Financial Strategies in Cheshire, Connecticut.
According to docuVault, there are two types of shredding services: on- and offsite. Among other points concerning shredding services:
- Companies should be AAA-certified by the National Association of Information Destruction, which means that the company is trained to properly shred confidential documents. Double-check companies concerning their certification.
- What insurance is offered by the company? Different shredding services offer different levels of insurance. Make sure that the company you are considering is insured should something go wrong, such as identity theft.
- Some companies offer more than just shredding services, such as document storage. Some also offer discounts for yearly purges.
You can also inquire about a Certificate of Destruction, which has detailed information about the destruction of your papers that ensures the shredding process complied with all relevant security laws.
Paperless paying off?
The industry’s years-long striving for the paperless firm seems to be paying some small dividends, at least in terms of document storage. “My intent is to purge closed tax returns from our files after five to six years. For storage of client tax returns and records, we moved to paperless several years ago,” said Twila Midwood of Advanced Tax Centre in Rockledge, Florida. “Therefore purging of old records doesn’t occur as frequently as it should.”
The Lafayette, California, office of CPA and attorney G. Scott Haislet also shreds. “We’re trying to be as paperless as possible as far as prior-year records, work papers, returns and so on,” he added.
“Our copies of client returns and supporting documents are held on our network. We retain these documents for seven years, then delete them,” said Mike Crabtree, JD, a CPA and partner at Boulay in Eden Prairie, Minnesota. “We don’t keep physical copies of any client documents. When documents come in, we scan them into folders on our network and return the documents to the client or shred them, depending on the client’s wishes.”
“We scan all documents immediately and return originals to the client,” said Chris Hardy, an EA and managing director with Paramount Tax in Georgia. “When we dispose of old hard drives, we start by deleting all the files and then having the drive physically destroyed.”
More than half (53 percent) of businesses don’t use a professional service to destroy old hard drives, USBs or other hardware that contain confidential information, according to a recent report from vendor Shred-it. Special equipment sometimes comes into play.
Pon takes the hard drives out of his computers and puts the drives in storage. “Make sure you purchase a hard drive enclosure so you can pull up any files on those hard drives, just in case,” he added.
“The few old drives that have been disposed of were given to an IT person who erased and then physically destroyed the drives: degaussers, heat, hammers and drills,” Armstrong said.
A disk enclosure refers to a specially designed cover box or casing to hold hard-disk drives; it often allows these drives to communicate in case old data needs to be read. Degaussing is the process of decreasing or eliminating a remnant magnetic field, and is also used to destroy data on magnetic storage.
As for her practice’s old hard drives, James said, “Our IT professional removes them from the computers and destroys them with a sledge hammer.”