- 11.3.24.1 General
- 11.3.24.2 Authority
- 11.3.24.3 Contract Compliance Reviews
- 11.3.24.4 Contractual Agreements
-
This section provides instructions for assuring that Internal Revenue Service (IRS) contracts involving the inspection or disclosure of Federal tax returns and return information under IRC 6103(n), information covered by the Privacy Act of 1974 (Privacy Act), or documents classified as Official Use Only (OUO) comply with all applicable laws, regulations and procedures.
-
Initial contacts with contractors to engage their services and disclosures of tax information necessary in these circumstances are made pursuant to IRC 6103(k)(6) and are discussed in IRM 11.3.21, Investigative Disclosure.
-
IRC 6103(n) permits the Secretary of the Treasury, pursuant to regulations, to disclose returns and return information to any person, including persons described in IRC 7513(a), to the extent necessary in connection with contractual procurement of:
-
Equipment or other property; or
-
Services relating to the processing, storage, transmission, and reproduction of returns and return information; or
-
Services relating to the programming, maintenance, repair, testing of equipment or other property; or
-
The providing of other services for purposes of tax administration, as defined in IRC 6103(b)(4).
-
-
Treasury Regulation 301.6103(n)-1 provides that the IRS and the Office of Chief Counsel may disclose returns and return information to contractors pursuant to IRC 6103(n).
-
The regulation also places certain limitations on the disclosures; these are defined in Treasury Regulation 301.6103(n)-1(b).
-
-
Contractors and subcontractors receiving tax information from the IRS are required to inform their employees, in writing, of the criminal and civil penalty provisions of IRC 7213, IRC 7213A, and IRC 7431 in accordance with Treasury Regulation 301.6103(n)-1(c).
-
The fact that safeguard provisions are required to be included in certain contracts is referenced in Treasury Regulation 301.6103(n)-1(d).
-
Subcontractors are held to the same provisions and penalties.
-
These are to be included in their contracts, word for word, as shown in the contractual document.
-
-
IRS records covered by the Privacy Act can not be disclosed without the proper authority to do so.
-
5 U.S.C. 552a(b)(3), routine use, authorizes the disclosure of Privacy Act records provided the system of records notice includes appropriate language allowing contractors access to such information.
-
"Disclosure pursuant to IRC 6103" or similar language provides Privacy Act authorization to disclose.
-
-
IRC 7513 authorizes the Secretary of Treasury to have any Federal agency or any person process and reproduce film or other photo impressions of any return, document or other matter.
-
Treasury Regulation 301.7513-1 establishes safeguard requirements for contractors who process and reproduce films or photo impressions.
-
The Federal Acquisition Regulations (FAR), subpart 1.602-1(b), provide that no contract shall be entered into unless the contracting officer ensures that all requirements of law, executive orders, regulations, and all other applicable procedures, including clearances and approvals, have been met.
-
Part 24 of the FAR implements the provisions of the Privacy Act. Contractors and their employees who contract for the design, development, operation, or maintenance of a system of records on individuals, on behalf of the IRS to accomplish an IRS function, are subject to the civil and criminal provisions of the Privacy Act.
-
Pursuant to FAR, subpart 24.103(b)(1), the contracting officer will ensure that the contract work statement specifically identifies the system of records on individuals and the design, development, or operation work to be performed.
-
-
Internal Revenue Service Acquisition Procedures (IRSAP) Manual, Part 1 Administration, Chapter 1(14)00, Administrative Services (as developed by the IRS Agency-Wide Shared Services (AWSS), Office of Procurement Policy), provides instructions with respect to procedures to be followed where contractual procurement will be subject to the Privacy Act, the provisions of IRC 6103(n), or where access by a contractor to Official Use Only material is contemplated.
-
This section provides instructions to Disclosure personnel who are conducting reviews of IRS contracts and requisitions for equipment, supplies or services that involve the design, development or use of a system of records or the disclosure of sensitive but unclassified (SBU) data, which includes:
-
Federal tax returns or return information;
-
Solely protected Privacy Act records/information; and
-
OUO information.
-
-
The Office of Governmental Liaison and Disclosure, will be responsible for reviewing the following documents that meet the criteria of IRM 11.3.24.2:
-
Form 1334, Requisitions for Equipment, Supplies, or Services, electronic or paper;
-
Interagency Agreements;
-
Agreements for Reimbursable Purchase/Services; and
-
Purchase/Delivery/Task/Service Orders against existing contracts, Blanket Purchase Agreements and GSA schedules.
-
-
The Office of Governmental Liaison and Disclosure (Headquarters) provides support for requisitions issued by:
-
Headquarters functions;
-
Martinsburg Computing Center;
-
Detroit Computing Center; or
-
Where more than one Area is involved.
-
-
Field Disclosure Officers will establish procedures to review web-based-Forms 1334-Request Tracking System (webRTS) requisitions that involve requisitions issued only by local functions, or by the functions in their respective servicing geographical areas which meet the criteria in IRM 11.3.24.3(1).
-
The local Disclosure Officer will review contractual documents and requisitions that are for the Tennessee Computing Center.
-
The Disclosure Approving Official will be the official who has oversight responsibility for the geographical location where the requisition initiates.
-
-
MA&SS is responsible for approving requisitions that involve national contracts and is responsible for all safeguard reviews of contractors and contractor compliance with the filing of required safeguard reports.
-
Requisitions that do not meet the standards set out in IRM 11.3.24.3.2, will be returned to the requester with an explanation of the deficiencies.
-
Disclosure Officers are encouraged to contact requesters directly and provide guidance.
-
Corrected requisitions are returned to Disclosure functions for concurrence where required.
-
The same procedure is followed for pre-award contracts.
-
-
Area Managers monitor the review activities of subordinate Disclosure Offices and will coordinate compliance reviews with other areas or Headquarters, when necessary.
-
) Reviews of existing contracts may be included as a part of every functional quality review to ensure appropriate safeguard language and other necessary clauses relating to the disclosure of information are present where appropriate or to ensure the function is properly identifying those situations where tax information or Privacy Act information is being provided to contractors.
-
All requisitions for property or services which require or properly indicate disclosure to contractors of any Federal tax returns or return information, Privacy Act protected information, or OUO information, must contain the following as an attachment to the requisition:
-
Statement, signed by the requesting activity management official, that the contractor will have access to information subject to disclosure limitations or include the official in the approval path on webRTS;
-
Statement signed by the Personnel Security Officer (PSO) that the background investigations requirements have been met, pursuant to IRM 1.23.2.2, Contractor Investigations, and disclosures are not prohibited;
-
IRSAP contract clause 1052.204-9000, Screening Requirements, must also be in the contractual document, in order for disclosure to approve the acquisition;
-
Per IRM 1.23.2.2(2), contractors whose access is limited to less than 30 days total or access to protected information is infrequent do not require any background investigation.
-
In these situations, the information in item b) above, is not required.
Note:
Questions about whether or not the contractor is subject to a background investigation should be discussed with the function submitting the requisition.
-
-
A statement signed by the AWSS Security Officer and, in the case of computer processing of SBU data outside of IRS systems, the Associate Director, Safeguards, MA&SS, that reasonable assurance has been obtained from the contractor that the IRS information can be protected from unauthorized disclosure, inspection, or use;
-
Absent performing an on-site evaluation of the contractor’s facility, reasonable assurance can be obtained by receiving a signed report (Safeguard Procedures Report (SPR)) by a responsible contract official or similar document, outlining what security is in place to adequately protect IRS information.
-
Subsequent to submitting an SPR or similar document, contracts lasting more than one year should be recertified, i.e., a Safeguard Activity Report or similar document should be submitted indicating that safeguards and security have been maintained or enhanced.
-
MA&SS is responsible for securing the reports and making the determination that safeguard procedures as reflected in these reports is adequate.
-
Questions about safeguards should be coordinated with MA&SS.
-
In most situations encountered by local Disclosure offices, IRS data is not committed to a computer system that would require such documentation.
-
In most common situations, the statements or reports discussed above are necessary.
-
-
-
A statement that the contract will or will not involve the design, development or operation of a system of records (Privacy Act); usually found by the function checking the appropriate box on the requisition that IRC 6103 and the Privacy Act either apply or don’t apply, and
-
Documentation from the requesting management official that states why the disclosure of returns or return information is necessary if disclosures of tax information, OUO or Privacy Act information are required.
-
If the reviewing Disclosure office determines the boxes are properly checked and there are no disclosures of tax information, OUO or Privacy Act information involved, then no further action by the Disclosure office is required.
-
This documentation must demonstrate that the procurement cannot be reasonably, properly or economically carried out without such disclosure.
Note:
See Treasury Regulation 301.6103(n)-1(b).
-
-
-
If the requisition or contract involves the design, development or operation of a system of records on behalf of the IRS, the contractor's specific functions will be stated in the contract.
Note:
See the note at IRM 11.3.24.2(9).
-
Contracts or purchase/delivery/task/service orders involving the design, development or operation of a system of records as defined by the Privacy Act will contain the Privacy Act Notification and a clause entitled "PRIVACY ACT," both of which are at FAR 52.224-1 and FAR 52.224-2, respectively.
-
Contracts or purchase/delivery/task/service orders involving the disclosure of Federal tax returns or return information will contain a clause entitled "SAFEGUARDS" which will contain the terms outlined in Treasury Regulation 301.6103(n)-1(d).
-
Disclosure personnel reviewing the requisitions should recommend to the initiating function that where required, the appropriate IRSAP clauses discussed above should be inserted into the contract.
-
Subsequent quality reviews of issued contracts can reveal whether or not the function followed the advice provided.
Note:
Supplementary instructions and the appropriate "SAFEGUARDS," "CRIMINAL/CIVIL SANCTIONS," and "INSPECTION" texts are in part 1052 of the IRSAP.
-
Additional safeguards may be recommended by the requesting official of the IRS, or the Security Officer, as allowed by provisions of specific IRSAP contract clauses, as described in part 1052.
-
-
The use of the Proprietary Data Rights Agreement (PDRA) is discontinued.
-
All contractor employees determined to require staff-like access, e.g. unescorted or unsupervised physical access or electronic access to limited or controlled areas, systems, programs and data, such as IRS facilities, information systems, security items and products, and SBU information, are required to sign the Non-Disclosure Agreement (NDA).
-
The language of the agreement has been prescribed in TD P 71-10, the Department of the Treasury Security Manual, Chapter II, Section 2, pages 7-9. TD P 71-10 has been superseded by TD 85-01, which can be accessed at: http://www.treas.gov/regs/td85-01.htm
-
Procurement is at liberty to alter the wording of the basic agreement, except where not authorized, or to create its own NDA without prior approval from legal counsel and the Office of Security.
-
Also, the functional Contracting Officer’s Technical Representative (COTR) is responsible for ensuring the contractor’s employees have signed the necessary agreement.
-
-
If an IRS function believes that safeguards may have been compromised, the functional COTR should request that MA&SS personnel inspect the contractor’s facility.
-
The IRS function responsible for the contract should brief AWSS and the MA&SS Officers of specific concerns that need to be addressed.
-
-
Based upon a review of the written findings of MA&SS and any discussions with them as well as other management officials involved in the contract activity, the contracting officer and the COTR will determine whether to continue disclosures to the contractor.
-
Recommendations will be made to discontinue the contract when evidence is developed that the contractor has failed to satisfy the safeguard or privacy provisions of the contract and immediate remedial action cannot be taken by the contractor.
-
-
Disclosure personnel at all levels should maintain close coordination with Operating Divisions and functions that plan, design and use the services of contractors and provide guidance to them concerning disclosure, Privacy Act, and other issues that may arise related to dealing with contractors.
-
To assure that the contractors are adhering to contractual safeguards, MA&SS will be responsible for periodic safeguard reviews of contractors.
-
All contracts involving disclosures of SBU data, should undergo pre-award site surveys and contract re-certifications as required at IRM 1.16.3.3, Pre-Award Site Surveys, and IRM 1.16.3.6, Contract Re-certification.
-
-
If a contractor is unable to meet IRS standards, the contracting officer, together with the COTR, will decide whether to terminate the contract and recover all returns, return information, and IRS records, inclusive of OUO.
-
Similarly, after meeting with Security and Contracting representatives to discuss findings of a security review, if the contractor is unwilling to meet IRS standards, the contracting officer, together with the COTR, will decide whether to terminate the contract and recover the records.
-
-
IRS functions that initiated requests for contracts or orders for purchases, deliveries, tasks, or services that involve the disclosure of Federal tax returns, return information, employee personnel information, and any OUO data/records that have been provided to a contractor, should be notified in writing if the IRS terminates the contract for failure to meet contract provisions.
-
Disclosure personnel will monitor recovery operations and, upon request, assist the contracting officer and the COTR to ensure unauthorized disclosures are avoided.
-
Full recovery of Federal tax returns, return information, employee personnel information, and OUO data/records must include any duplications or transcribing onto magnetic or computer media and spoilage.
-
-
The initiating functional Procurement personnel will ensure all SBU contractual documents include the requirement for background investigations of contractor personnel:
-
With staff-like access to Treasury owned or controlled facilities;
-
Who work on contracts that involve the design, operation, repair or maintenance of information systems or projects; or
-
Who have access to SBU information.
Note:
See IRM 1.23.2.2.1, Contractor Employees Transferring from one IRS Contract to Another.
Note:
It is the responsibility of the COTR to request background investigations from NBIC.
-
-
The initiating functional Procurement personnel will ensure all contractual documents that involve disclosures of SBU data, include the requirements for the COTR to have the pre-award site surveys and subsequent contract re-certifications conducted, as required by IRM 1.16.3.3 and IRM 1.16.3.6, as may be necessary.
-
Contracts with option years will not be approved without the contract re-certification stipulation.
Note:
As of this writing, IRM 1.16.3.2, Review of Request for Services, has not been changed to reflect the requirement that MA&SS conduct all pre-award site surveys. All questions about the requirements related to contract awarding and re-certifications related to actual on-site reviews of a contractors facilities should be forwarded to MA&SS.
-
The services required and the individuals involved in providing the services will determine the type of contractual agreement negotiated and the terms of disclosure.
-
To enable bidders to fully evaluate the parameters of the work involved when invited to submit a bid for a specific contract, it may become necessary to provide them access to Federal tax returns, return information, or other SBU data at the solicitation stage.
-
In such cases, the written solicitation must conform to the requirements of the IRSAP. It must incorporate the Safeguard provisions, the Privacy Act clauses, if applicable, and conform generally with the provisions of IRM 11.3.24.3.2. AWSS and MA&SS functions must determine whether a pre-award on-site security inspection needs to be performed.
-
IRS COTRs will ensure full recovery of all SBU data immediately upon completion of its necessitated use during the solicitation stage. Care should be exercised to place a limited time-frame on the length of time it takes for the bidder(s) to use the SBU data.
-
The IRS occasionally hires trainees through participation in certain work programs. Some of the students/trainees are of the " direct-hire" while others are of the "hosting" type.
-
"Direct-hire" trainees are employed and paid by the IRS and their right of access to returns or return information, when required as part of their duties, is the same as for other IRS employees. See IRC 6103(h)(1).
-
"Hosting" trainees are hired and paid by non-Treasury Department organizations and assigned by these organizations to the IRS for training. They may not be given access to tax returns or return information or information governed by the Privacy Act.
Note:
If these trainees qualify as "students" under IRM 11.3.24.4.2(4), those rules will govern.
-
Uncompensated student volunteers have been deemed by statute (5 U.S.C. 3111) to be Treasury and/or IRS employees for purposes of both the Privacy Act and IRC 6103. As such, disclosures are permissible. However, the student must meet the following criteria.
-
Qualify as a Student - A student is defined as "an individual who is enrolled, not less than half-time, in a high school, trade school, technical or vocational institute, junior college, college, university, or comparable recognized educational institution." Individuals from high schools or above who participate in a formal program with the IRS as part of their curriculum are considered student volunteers. To qualify, they must obtain the permission of the institution where they are enrolled as part of a program to provide educational experiences for students. They must be "uncompensated" and may not be used to displace any employee. Counsel has clarified the definition of uncompensated. Student volunteers compensated by other than Federal funds are considered uncompensated for 5 U.S.C. Section 3111 purposes.
Note:
Volunteers from other organizations such as AARP or welfare to work programs do not qualify for access to IRC 6103 or Privacy Act data.
-
-
The IRS hires a considerable number of handicapped employees. To effectively use the skills of these individuals it is often necessary that they be assisted by non-IRS personnel. Several Federal, state and local agencies provide assisters at no cost to the IRS.
-
Under 5 U.S.C. 3102(b), these assisters can be "hired" by IRS and are permitted to have access to returns or return information, under IRC 6103(h)(1), subject to its requirements, even if they are uncompensated by IRS.
-
The IRS procures the vast majority of title searches by use of contracts or purchase orders pursuant to IRC 6103(n), which must be routed through IRS Disclosure Approving Officials.
-
When low volume, rare, exigent circumstances exist, purchase cards may be used, rather than contracts or purchase orders, to procure title searches. The disclosures will be pursuant to IRC 6103(k)(6), investigative disclosures, and the IRS business office/unit must:
-
Incur very few needs for title searches on a monthly basis;
-
Demonstrate that vigorous, real effort has been made to procure a contract for title searches; and
-
Thoroughly document that no company contacted is willing (obtain written refusal where possible) to enter such a contract.
Note:
Every effort should be made to locate a vendor (or vendors) who will enter into a contractual agreement (purchase order) to provide title searches upon request, for a specified geographical area.
-
-
"Official Use Only" documents may be disclosed to contractors when it is determined that such access is necessary to properly perform assigned tasks.
-
This type of material is not protected by either the Privacy Act or the statutes governing release of returns and return information.
-
"Official Use Only" documents are the property of the IRS, and are construed to be "a thing of value" protected by statute (18 U.S.C. 641, as modified by 18 U.S.C. 3571).
-
Access to "Official Use Only" documents should not be routinely granted to contractors. Each case must be decided on its own merit, with the needs of the IRS being the foremost consideration.
-
When access to this material is necessary, the following paragraphs, modified as deemed appropriate to meet case needs, should be included in the contractual agreement:
-
"SAFEGUARDS"
-
Any Treasury Department information made available, which is marked "Official Use Only," shall be used only for the purpose of carrying out the provisions of this contract, and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the contract.
-
-
"CRIMINAL/CIVIL SANCTIONS "
-
Each officer or employee of the contractor or subcontractor at any tier to whom "Official Use Only" information may be made available or disclosed shall be notified in writing by the contractor that " Official Use Only" information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such "Official Use Only" information, by any means, for a purpose or to an extent unauthorized herein, may subject the offender to criminal sanctions imposed by 18 U.S.C. Sections 641 and 3571. 18 U.S.C. Section 641 provides, in pertinent part, that whoever knowingly converts to his use or the use of another, or without authority, sells, conveys, or disposes of any record of the United States or whoever receives the same with the intent to convert it to his use or gain, knowing it to have been converted, shall be guilty of a crime punishable by fine or imprisoned up to ten years or both.
-
-
-
Contracts for the destruction of tax information falls within the scope of IRC 6103(n).
-
A contractual agreement, in compliance with IRC 6103(n), is required if tax information to be destroyed does not remain in sealed containers or is otherwise protected from view by the contractor during the destruction process.
-
-
Disclosure offices should be involved in the request to enter into a contract for such services and must request that the appropriate IRSAP clauses be entered into the contract.







