(a) Except by permission of the client or the authorized representatives of the client, a person or any partner, member, officer, shareholder, or employee of a person shall not voluntarily disclose information communicated to him by the client relating to, and in connection with, professional accounting services or professional accounting work rendered to the client by the person. Such information shall be deemed confidential. The following includes, but is not limited to, examples of authorized representatives:
  (1) the authorized representative of a successor entity becomes the authorized representative of the predecessor entity when the predecessor entity ceases to exist and no one exists to give permission on behalf of the predecessor entity; and
  (2) an executor/administrator of the estate of a deceased client possessing an order signed by a judge is an authorized representative of the estate.
(b) The provisions contained in subsection (a) of this section do not prohibit the disclosure of information required to be disclosed:
  (1) by the professional standards for reporting on the examination of a financial statement and identified in Chapter 501, Subchapter B of this title (relating to Professional Standards);
  (2) by applicable federal laws, federal government regulations, including requirements of the PCAOB;
  (3) under a summons or subpoena under the provisions of the Internal Revenue Code of 1986 and its subsequent amendments, a summons under the provisions of the Securities Act of 1933 (15 U.S.C. Section 77a et seq.) and its subsequent amendments, or a summons under the provisions of the Securities Exchange Act of 1934 (15 U.S.C. Section 78a et seq.) and its subsequent amendments, the Securities Act (Article 581-1 et seq., Vernon's Texas Civil Statutes), Texas Revised Civil Statutes Annotated;
  (4) under a court order signed by a judge if the court order:
    (A) is addressed to the license holder;
    (B) mentions the client by name; and
    (C) requests specific information concerning the client.
  (5) by the public accounting profession in reporting on the examination of financial statements;
  (6) by a congressional or grand jury subpoena;
  (7) in investigations or proceedings conducted by the board;
  (8) in ethical investigations conducted by a private professional organization of certified public accountants;
  (9) in a peer review; or
  (10) in the course of a practice review by another CPA or CPA firm for a potential acquisition in conjunction with a prospective purchase, sale, or merger of all or part of a member's practice if both firms enter into a written nondisclosure agreement with regard to all client information shared between the firms.
(c) The provisions contained in subsection (a) of this section do not prohibit the disclosure of information already made public, including information disclosed to others not having a confidential communications relationship with the client or authorized representative of the client.
(d) A person in the client practice of public accountancy shall take all reasonable measures to maintain the confidentiality of the client records and shall immediately upon becoming aware of the loss of, or loss of control over, the confidentiality of those records notify the client affected in writing of the date and time of the loss if known. Loss includes a cybersecurity breach or other incident exposing the records to a third party or parties without the client's consent or the loss of the client records or the loss of control over the client records. Persons have a responsibility to maintain a back-up system in order to be able to immediately identify and notify clients of a loss.
(e) Interpretive comment. The definition of a successor entity as referenced in subsection (a)(1) of this section does not include the purchaser of all assets of an entity.

Source Note: The provisions of this §501.75 adopted to be effective June 11, 2000, 25 TexReg 5338; amended to be effective February 4, 2004, 29 TexReg 963; amended to be effective February 17, 2008, 33 TexReg 1094; amended to be effective June 11, 2008, 33 TexReg 4503; amended to be effective January 28, 2009, 34 TexReg 428; amended to be effective October 7, 2009, 34 TexReg 6853; amended to be effective February 9, 2011, 36 TexReg 545; amended to be effective June 13, 2013, 38 TexReg 3606; amended to be effective August 4, 2016, 41 TexReg 5549; amended to be effective June 7, 2017, 42 TexReg 2932; amended to be effective June 3,2020, 45 TexReg 3632