Protected disclosure FAQs

A “protected disclosure” means a disclosure of “relevant information” made by a “worker” (defined in section 2.1 and 1.1 respectively of the HSE Procedures for the Handling of protected Disclosures) in the manner specified in the Act. The relevant information must, in the reasonable belief of the worker, tend to show one or more relevant wrongdoings and have come to the attention of the worker in a work-related context.

A protected disclosure is a report disclosing information by a worker that they believe shows some unlawful or improper behaviour that the HSE, as an organisation, has done, is doing, or is likely to do.

The information in the report must have come to reporting person’s attention at work.

The reporting person should, in general, be a witness bringing the wrongdoing to the attention of the HSE.

The ‘protected’ part of the protected disclosure is that the reporting person should not be treated unfairly because they have spoken up and there are legal protections in place for workers to prevent penalisation.

To qualify as a protected disclosure, the matter reported must be a “relevant wrongdoing”. The following are relevant wrongdoings, per section 5(3) of the Act:

a) that an offence has been, is being or is likely to be committed;

b) that a person has failed, is failing or is likely to fail to comply with any legal obligation, other than one arising under the worker’s contract of employment or other contract whereby the worker undertakes to do or perform personally any work or services;

c) that a miscarriage of justice has occurred, is occurring or is likely to occur;

d) that the health or safety of any individual has been, is being or is likely to be endangered;

e) that the environment has been, is being or is likely to be damaged;

f) that an unlawful or otherwise improper use of funds or resources of a public body, or of other public money, has occurred, is occurring or is likely to occur;

g) that an act or omission by or on behalf of a public body is oppressive, discriminatory or grossly negligent or constitutes gross mismanagement;

h) that a breach of EU law as set out in the Act, has occurred, is occurring or is likely to occur; or

i) that information tending to show any matter falling within any of the preceding paragraphs has been, is being or is likely to be concealed or destroyed or an attempt has been, is being or is likely to be made to conceal or destroy such information.

The Act is intended to deal with disclosures of relevant wrongdoings. A matter concerning interpersonal grievances exclusively affecting a worker, such as grievances about interpersonal conflicts involving the reporting person and another worker, or a complaint to the employer (e.g. related to contract issues) or about the employer which concerns the worker exclusively, is not a relevant wrongdoing under the Act, and will not be dealt with under these Procedures. Such matters are dealt with under the “Grievance and Disciplinary Procedure for the Health Service” or the “Dignity at Work Policy for the Public Health Service”.

Disclosure reports should be about alleged wrongdoings concerning the HSE or for which the HSE has some legal responsibility. The Act states that a disclosure can be made by a ‘worker’.

A “worker” is an individual in a work-related relationship with the HSE who acquires information on relevant wrongdoings in a work-related context and who is or was:

• an employee (all directly employed staff of the HSE, under any contract);
• an independent contractor to the HSE, whether or not the work/services were provided personally by the individual to the HSE, or otherwise;
• an agency worker on HSE sites (agency nursing, patient care and medical staff, catering, cleaners, consultancy, security, etc.);
• an employee working for Section 38 and 39 agencies [1];
• a trainee (a person provided with work experience under a training course or programme or with training for employment (or with both) otherwise than under an employment contract);
• a shareholder of an undertaking (this is unlikely to be relevant for workers making disclosures internally to the HSE);
• a member of the administrative, management or supervisory body of an undertaking including non-executive members (HSE Board members and members of HSE oversight committees);
• a volunteer;
• an individual who acquired information on a relevant wrongdoing during a recruitment process; or an individual who acquired information on a relevant wrongdoing during pre-contractual negotiations (other than a recruitment process).

[1] Employees of Section 38 and 39 agencies are encouraged in the first instance to report disclosures internally, within their own organisation. A worker employed or engaged by a Section 38/39 organisation may make a disclosure to the HSE under the Protected Disclosures Act, 2014, where that individual reasonably believes that the wrongdoing relates solely or mainly to, the conduct of the HSE or something for which the HSE has legal responsibility, as per S6.(1) ‘Disclosure to Employer or Other Responsible Person’ of the Protected Disclosures Act, 2014.

Ideally, a disclosure should be made to your employer if the disclosure concerns alleged wrongdoing within your organisation. All employers with more than 50 employees must have a dedicated protected disclosures reporting channel.

However, if you are a worker (as defined by the Act) of a section 38 or section 39 body and you have a reasonable belief that the alleged wrongdoing relates solely or mainly to the conduct of the HSE or to something for which the HSE has legal responsibility, you can make a disclosure to the HSE.

Reports should be made to the NOPD who are the Designated Person(s) in the HSE to receive disclosure reports under the HSE Procedures for the Handling of Protected Disclosures.

Reports can be made as follows:

• By email: protected.disclosures@hse.ie
• By post: National Office for Protected Disclosures, Dr Steevens’ Hospital, Dublin, D08 W2A8
• By phone: +353 (0)16352202

Reporting persons are encouraged to use the Form to make a Protected Disclosure - Protected Disclosures Act 2014 as amended available here when making a protected disclosure.

If a disclosure report is presented by a worker directly to a HSE service area/HSE centre function, the disclosure should be clearly marked as a protected disclosure. The relevant area will transmit the disclosure report to the NOPD for initial assessment.

When a disclosure is made verbally, it will be documented by the NOPD by way of minutes. Where practicable, the reporting person will be asked to check and confirm in writing the accuracy of the information provided.

Reports should contain at least the following information:

• that the report is a protected disclosure and is being made under the process set out in these procedures;
• the reporting person’s status as a “worker” under the Act;
• the reporting person’s name, position in the organisation, place of work and confidential contact details;
• the date of the alleged wrongdoing (if known) or the date the alleged wrongdoing commenced or was identified;
• whether or not the alleged wrongdoing is still ongoing;
• whether the alleged wrongdoing has already been disclosed and if so, to whom, when, and what action was taken;
• detailed factual relevant information in respect of the alleged wrongdoing (what is occurring/has occurred and how);
• the name of any person(s) allegedly involved in the alleged wrongdoing (care should be taken to only include name(s) of individual(s) directly relevant to the report); and
• any other relevant information.

Reporting persons should provide sufficient prima facie evidence [1] as part of their report to enable the NOPD to carry out the initial assessment.

[1] Prima facie evidence: derived from Latin meaning "at first sight" or "on the face of it," means that there is sufficient evidence to support a claim, but it is not conclusive.

Yes, reports can be made anonymously, although we ask that you confirm your status as a worker and provide sufficient relevant information relating to the wrongdoing in order for the NOPD to carry out an initial assessment. Persons who choose to report anonymously and whose report meets the requirements of the Act remain entitled to all the protections of the Act. The NOPD would encourage individuals (reporting persons) to provide contact details so that the HSE can address the disclosures with them to the fullest extent possible.

Anonymous reports will be followed up to the greatest extent possible. However, it may not be possible to fully assess and follow up on an anonymous report, in the absence of the knowledge of the identity of the reporting person.

In addition, implementing certain elements of the HSE Procedures for the Handling of Protected Disclosures – such as seeking further information, providing feedback/outcomes, maintaining communication and protecting the reporting person’s identity or protecting them from penalisation – may not be possible.

The making of a protected disclosure can be facilitated and supported by a friend, colleague or union representative. A facilitator is defined in the Act as an individual who assists, in a confidential manner, a reporting person in the reporting process in a work-related context.

The disclosure would ultimately have to come from the reporting person as it may not be possible to confirm that the disclosure report meets the requirements to be considered a protected disclosure without engagement with the reporting person. Confirmation that the disclosure is coming from a worker will be required.

In this case, the reporting person is the one with the protection under the Act from penalisation and limited civil matters. However, it is an offence under the Act to penalise a facilitator.

If a disclosure is received from a group of “workers”, the NOPD will inform the contact person(s) in writing and state that there is no provision in the legislation for making a “group” protected disclosure, or for one reporting person to act as a contact person or representative for others.

The NOPD will inform the contact person(s) that the HSE has a legal obligation to protect the identity of the individuals making the disclosure and an obligation to protect them from penalisation (see Section 3.4 – Protection from Penalisation). In order to meet these obligations, the HSE must correspond directly with each of the persons making the disclosure.

The NOPD requests that each of the individuals (reporting persons) contact the HSE protected disclosures email address to confirm that they have made a disclosure and to provide their contact details, so that the HSE can address the disclosures with them to the fullest extent possible (such as seeking further information for the purpose of initial assessment, providing feedback and protecting the identity of each individual and protecting them from penalisation).

The NOPD will assign each worker with their own unique NOPD reference number; thereby providing each reporting person with the same procedural treatment individually. On receipt of these details, the disclosure report, if assessed as suitable for follow-up under the Act, will be treated as one disclosure report for the purpose of referral to a Senior Accountable Officer, submitted by several workers. This will result in a single examination/investigation.

Where a reporting person makes a disclosure concerning the HSE to a Minister, that Minister is obligated to refer the matter to the Office of the Protected Disclosures Commissioner (OPDC).

The OPDC will decide the best placed Prescribed Person or Suitable Person to assess the content of the disclosure and address any wrongdoing.

As protected disclosures are generally a disclosure of information to a person’s employer, the OPDC will often transmit the disclosure to the NOPD as the best placed suitable person to assess the disclosure within the HSE.

The conditions applying to reporting to the OPDC are set out in section 7 of the Protected Disclosures Act.

If you do not wish to make a disclosure to your employer, you can make a disclosure directly to the OPDC.

If a worker wishes to make a report to the Commissioner, in addition to having a reasonable belief that the information they report tends to show a relevant wrongdoing, they must also reasonably believe the information they report, and any allegation contained in it is substantially true.

The OPDC does not ordinarily assess reports or investigate matters but will identify the best placed suitable person or organisation to assess the disclosure report.

The Commissioner has established formal channels for workers to make reports under the Act. Information on how to report to the Commissioner has established formal channels for workers to make reports under the Act.

Information on how to report to the Commissioner is available at: www.opdc.ie

The HSE has nominated the NOPD as the designated office for the management of protected disclosures for the HSE. If a matter is addressed directly to the HSE CEO it will be referred to the NOPD for initial assessment and appropriate referral.

The provision of information within the disclosure may be the end of the involvement depending on the circumstances.

A protected disclosure is a disclosure of information to your employer in most cases, and it is for your employer to establish if the wrongdoing is occurring/has occurred and then to address the wrongdoing. The HSE will endeavour to do so without further involvement of the reporting person if possible in order to assist in the protection of their identity.

All reports shall be acknowledged within 7 calendar days of receipt (where the identity of the reporting person is known) and given a unique NOPD reference number. The acknowledgement shall include:

• Confirmation that the NOPD will carry out an initial assessment of the report under the Act.
• Confirmation that the NOPD will formally communicate to the reporting person, in writing, the outcome of this initial assessment and update them on next steps.

Feedback will be provided by the NOPD to the reporting person (where the identity of the reporting person is known) within a reasonable time period and no later than 3 months after the initial acknowledgement of the report. A reporting person can request the NOPD, in writing, to provide further feedback at 3-month intervals thereafter if referred for further examination/investigation, until the process of follow-up is completed.

The senior accountable officer (or the appointed examiner/investigator) for the relevant service may in some exceptional circumstances seek to contact the reporting person for further information. In this scenario, NOPD will make contact with the reporting person to seek their consent to pass on their contact details to the relevant examiner. However, this is not always the case. The reporting person supplies the information they believe tends to show the wrongdoing and it is then for the HSE to examine the matter to establish if the wrongdoing is or has occurred.

As part of the NOPD’s initial assessment of a received disclosure, the designated persons may request additional information to assist with the completion of the initial assessment process. Once, the initial assessment process has been completed and a decision has been made as to whether a report is deemed to be a protected disclosure or not, NOPD does not then require any additional information.

You may submit additional information if you wish, however if this new information concerns additional wrongdoings it may be considered a new disclosure.  The NOPD will advise you if this is the case.

The Act does not make any provision in relation to the withdrawal of a disclosure. If the information provided tends to show a relevant wrongdoing, then the HSE may decide to continue to examine/investigate this in so far as is possible should a reporting person choose to withdraw from the process.

The HSE is committed to protecting the confidentiality of the identity of the worker in these instances.

As the range of possible wrongdoings that can be alleged is so wide, there are no time limits placed upon any investigative actions (and timelines are not for prescribed for within the Act). The HSE will endeavour to examine the matters raised as quickly as practicable while maintaining high standards of approach to examining the concerns.

Reports of wrongdoing that do not fulfil these criteria will be dealt with under other relevant policies. In such cases, information disclosed, where appropriate, may be referred to the Senior Accountable Officer (SAO) for their consideration and appropriate attention outside of the Protected Disclosures framework.

The HSE is committed to:

• Protecting the confidentiality of the identity of both workers who raise a concern under the HSE Procedures for the Handling of Protected Disclosures and any third party mentioned in a report and to treating the information disclosed in confidence.
• Protecting workers from penalisation or a threat of penalisation because the worker made a protected disclosure. Acts of penalisation will not be tolerated.
  Penalisation is any direct or indirect act or omission that occurs in a work-related context, which is prompted by the making of a protected disclosure and causes or may cause unjustified detriment to a worker.
  If a worker is penalised or threatened with penalisation as a result of making a protected disclosure this can be reported to their Line Manager or relevant HR Senior Manager and the report will be followed up in accordance with the “Dignity at Work Policy for the Public Health Service”.
• Protection from legal liability, with the exception of defamation, actions cannot be taken against a worker who makes a protected disclosure. Workers can be sued for defamation but are entitled to the defence of “qualified privilege”. This means that it should be very difficult for a defamation case against a worker to succeed if the worker can show they have made a protected disclosure. There is no other basis under which a worker can be sued if they have made a protected disclosure.

For more information regarding protections under the Act, please refer to Section 3.3 of the HSE Procedures for the Handling of Protected Disclosures.

The HSE is committed to protecting the confidentiality of the identity of both workers who raise a concern under these Procedures and any third party mentioned in a report and to treating the information disclosed in confidence.

The HSE has put in place secure measures to protect the identity of reporting persons, including;

• Secure systems of disclosure receipt via email, post and dedicated phone line with access limited to the NOPD;
• Where appropriate, redacting of identifiable information prior to any action or investigation e.g. name, email address, telephone numbers, place of work etc.;
• Password protection of documentation containing identifying information shared with Senior Accountable Officers and their nominated Protected Disclosures Leads where appropriate;
• Storage and retention of disclosures within the protected disclosures secure file share in NOPD (local user access controls appropriately managed).

For more information regarding protection of identity under the Act please refer to Section 3.3 of the HSE Procedures for the Handling of Protected Disclosures.

Unless you request otherwise, the legislation used to assess a disclosure is the Protected Disclosures Act 2014, as amended. This legislation was updated on 01 January 2023 and provides the most expansive definition of workers, clearest protections and disregards the motivations of the reporting person.

The Health Act 2004, as amended includes protection disclosure provisions that may be considered instead. These provisions require that the disclosure is made in good faith, and the list of defined wrongdoings is shorter than the Protected Disclosures Act.

The HSE Procedures for the Handling of Protected Disclosures is a document to help guide employees, leaders and managers around the protected disclosures process in the HSE. These procedures are aligned with the Statutory Guidance on the Protected Disclosures Act issued by the now Department of Public Expenditure, Infrastructure, Public Service Reform and Digitalisation issued to all public bodies in November 2023 and supersede the 2023 (Interim) Procedures for the receipt and Management of Protected Disclosures in the HSE.

The updated Procedures reflects what we have learned and ensures the HSE remains a leader for the legal protections provided to those who raise their heads above the parapet to speak up about wrongdoings they witness in the workplace. 

The Procedures will be subject to a further update in 2026 following one year of operation. This update will be subject to engagement with representatives across the HSE and will be provided to Unions prior to publication.

The making of a protected disclosure is protected from being a criminal offence should you disclose information you are prohibited from disclosing when making a protected disclosure.

A report made in the absence of a reasonable belief is not a protected disclosure and may result in disciplinary action. It is a criminal offence to make a report that contains any information the reporting person knows to be false. A person who suffers damage resulting from the making of a known to be false report has a right to take legal action against the reporting person.

Information provided to the NOPD is securely stored electronically, with access limited to staff of the NOPD. In addition, access to the Protected Disclosures email inbox is limited to staff of the NOPD.

Where information is referred to the Senior Accountable Officer (SAO) for the relevant service for examination/investigation, the identifying details of the reporting person are redacted out and password protection of documentation is used. The SAO are required to securely store the information and may share the content of the disclosure with whomever they deem necessary in order to examine the content and establish if the wrongdoing is occurring.

In certain circumstances, it may be required to provide the SAO for the relevant service with the identity and contact details of the reporting person. These may also be shared with persons tasked with establishing the facts for the sole purpose of progressing the examination/investigation.

No person who is subject to any allegations or is requested to provide an account as a result of a protected disclosure will be provided with the identity of the reporting person.

Information regarding a protected disclosure may be accessed by:

• Staff at the NOPD for initial assessment, feedback, outcomes and other updates;
• The relevant senior accountable officer for the relevant service to whom the matter is referred;
• A person designated to examine/investigate any matters arising;
• A person providing an account/interview/data concerning a matter under examination/investigation.

The above list is not exhaustive.

All records of disclosures will be maintained securely so as to comply with the requirements of confidentiality under the Act and with relevant obligations under the GDPR, 2016 and the Data Protection Acts 1988-2018 (as amended from time to time). Records will be retained for no longer than is necessary and proportionate to comply with the provisions of the Data Protection Act, 2018 and the HSE National Records Retention Policy, 2024.

While each Freedom of Information  (FOI) request will be assessed by the relevant FOI decision maker, The Freedom of Information Act 2014 does not apply to any records relating to disclosures made in accordance with the Act, irrespective of when it was made.