Protected Disclosures in Irish Healthcare: Employer Duties and Training

This guide covers Ireland. For the UK equivalent, see our guide: Whistleblower Protections and Speak-Up Culture in Healthcare.

Healthcare workers are often the first to see when something is going wrong, whether in a hospital, nursing home, disability service or practice. Protected disclosures healthcare employers in Ireland need to handle are governed by the Protected Disclosures Act 2014 as amended by the Protected Disclosures (Amendment) Act 2022. This guide summarises what official pages say about who is protected, what employers must have in place, how HSE-funded organisations are treated, and what training makes sense. It is not legal advice, and our own suggestions are labelled as such.

A protected disclosure is not the same as a personal complaint. For those, see our guide to the grievance and disciplinary code of practice, which explains the separate route for individual workplace grievances.

What is a protected disclosure?

According to Citizens Information (page last edited 19 January 2023), a protected disclosure is a report of possible wrongdoing made by a worker in a specified way. The information must have come to the worker's attention in a work-related context, and the worker must reasonably believe it tends to show wrongdoing. The page says the worker is still protected if the information turns out to be incorrect, provided the belief was reasonable.

The page describes wrongdoing as widely defined. The examples it lists include criminal offences, failure to comply with legal obligations, misuse of public funds, damage to the environment, a miscarriage of justice, and "endangering the health and safety of individuals". Purely personal workplace grievances and contract disputes generally do not count. The HSE's own staff guidance makes the same point, saying personal employment grievances are not protected disclosures and pointing to grievance, disciplinary and dignity at work policies for those matters.

The Citizens Information page does not discuss healthcare as a subject. The healthcare relevance is therefore a matter of applying the general definition to the setting: for example, a concern that people's health and safety is being endangered is within the listed examples. Whether a particular concern qualifies depends on the facts, so employers should take advice in unclear cases.

Who is covered

Citizens Information lists employees and former employees, trainees, contractors, agency workers, people on work experience, board members, shareholders, volunteers and job applicants. The HSE guidance lists a similar range, including Section 38 and 39 employees, contractors and agency workers, trainees, volunteers, board members and job applicants. For a healthcare employer, that means locums, agency nurses, students on placement and volunteers may all be within the protections, not just permanent staff.

What employers must have in place

The Workplace Relations Commission explains the employer obligations under the 2022 amendments (the page shows no last-updated date, and says the legislation has effect from 1 January 2023). According to the WRC page:

• organisations with 250 or more employees were already required to have internal reporting channels, and from 17 December 2023 the requirement applies to organisations with 50 or more employees;
• all public sector organisations must establish internal channels regardless of size;
• each report must be acknowledged in writing within 7 days, with feedback on actions taken or planned within 3 months, and further feedback at 3-month intervals on request;
• a person or function must operate the channel, communicate with the reporting person, follow up on reports and give feedback, and should have sufficient independence and authority;
• persons operating the internal channel should be adequately trained in the handling of reports;
• the organisation must promote the channel and make the procedures accessible, procedures must explain how to report externally, and the organisation should state the conditions, if any, under which it will follow up anonymous reports; and
• failure to establish, maintain and operate internal reporting channels is an offence, which the WRC can prosecute summarily, and officers may be liable where an offence involved their consent, connivance or neglect.

A gov.ie page on the Act confirms that public sector employers, and private employers with 50 or more staff, must establish internal channels, and that statutory guidance for public bodies was published in November 2023. Whether a Dublin healthcare employer is a public body, an HSE-funded organisation or a private provider with 50 or more workers, check your own position against these official pages. Smaller private providers may not be required to have a formal channel under the headcount rule on the WRC page, though they can still receive reports and their workers can still use external routes.

Penalisation and its consequences

Citizens Information says workers are protected from being penalised directly or indirectly, and that penalisation includes dismissal, unfair treatment and threats of reprisal. It adds that since 1 January 2023 the list also covers loss of promotion, negative reviews or references, and withholding training. For a healthcare employer, the last point is relevant to rostering and development: withholding a course or CPD opportunity because someone raised a concern could be treated as penalisation.

The page says a disclosure is assumed to be protected until it is proved that it is not, and that the employer must prove it did not penalise the worker. It states that dismissal for making a protected disclosure is treated as unfair, with compensation that can reach up to five years' pay, compared with a general maximum of two years. Complaints about other penalisation go to the WRC. These are summaries on a page dated January 2023, so check the current figures and time limits before relying on them.

How the HSE treats protected disclosures

The HSE guidance for staff says reports go to its National Office for Protected Disclosures, that anonymous reports are accepted, and that workers can instead go directly to the Office of the Protected Disclosures Commissioner. Section 38 or 39 workers should normally report within their own organisation unless the issue mainly concerns the HSE. The page says the office confirms receipt within 7 calendar days and gives formal feedback within 3 months, then every 3 months while work continues. It states that HSE procedures were published in October 2025 and that the guidance will be updated again in 2026. It also notes that the Health Act 2004 may apply instead in some cases. The page does not mention training for staff or managers or designated persons.

A practical approach to training and readiness

Our suggestion, which is not presented as a legal requirement (the WRC page says persons operating the internal channel should be adequately trained), is to build readiness in four steps.

• Make the policy findable. Put the channel, the designated person and the external routes in the staff handbook and on induction, including for agency and locum staff.
• Train the people who receive reports. Designated persons and managers should understand acknowledgement and feedback timelines, confidentiality and how to keep a record.
• Brief managers on penalisation. Rosters, references, training offers and performance reviews after a report are all areas where a manager can create risk without intending to.
• Separate the routes. Staff should know the difference between a protected disclosure, a grievance and a dignity at work complaint. Our guide to dignity at work training for healthcare staff covers the latter.

It is also worth explaining how a report relates to inspections. Our guide to HIQA inspections and staff training shows how inspectors look for evidence of an open culture, and a working reporting channel is part of that picture. We did not find a HIQA page that sets out a specific protected disclosures training requirement, so we make no claim about one.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Does a private nursing home need an internal reporting channel?

According to the WRC page, organisations with 50 or more employees must have one from 17 December 2023, and public sector organisations must regardless of size. Count your own workforce and check the official pages, or take advice, if you are near the threshold.

Can an agency nurse or locum make a protected disclosure?

Citizens Information lists agency workers, contractors, trainees and volunteers among the people covered.

Is a complaint about my own rota a protected disclosure?

Generally not. Citizens Information says purely personal workplace grievances do not count, and the HSE guidance points to grievance and dignity at work policies for those matters.

How quickly must we respond to a report?

The WRC page says to acknowledge in writing within 7 days and give feedback within 3 months, with further feedback at 3-month intervals on request.

Does the law require training on protected disclosures?

The WRC page says persons operating the internal channel should be adequately trained. The pages we read do not set out a wider training requirement for all staff, so wider training is our suggestion.

A clear channel, trained recipients and careful management after a report together make it easier for staff to raise concerns early.