Protected Disclosures (Whistleblowing)

A ‘protected disclosure’ is a disclosure of ‘relevant information’ made by a ‘worker’ in the manner specified in the Act. The relevant information must, in the ‘reasonable belief’ of the worker, tend to show one or more ‘relevant wrongdoings’ and have come to the attention of the worker in a ‘work-related context’.

‘Relevant information’ is information which in the reasonable belief of the worker tends to show one or more relevant wrongdoings and came to the attention of the worker in a work-related context.

‘Work-related context’ means current or past work activities in the public or private sector through which, irrespective of the nature of those activities, you acquire information concerning a relevant wrongdoing and within which you could suffer penalisation if you reported such information.

Under the 2014 Act, the following ‘workers’ are protected:

• Employees or former employees
• Trainees
• People working under a contract for services
• Independent contractors
• Agency workers
• People on work experience

From 1 January 2023, under the 2022 Act, the following workers are also protected:

• Unpaid trainees
• Board members
• Shareholders
• Volunteers
• Job applicants

The definition of relevant wrongdoing is defined in Act.

A worker may choose to report internally to their employer or externally to a prescribed person, in which case the worker must also reasonably believe that the information disclosed, and any allegation contained in it, are substantially true. The worker does not have to report to their employer before reporting externally to a prescribed person.

The information you wish to report must fulfil all the requirements set out in the Act as stated above, and concern a relevant wrongdoing that falls within the scope of the matters for which the Chief Executive of the HPRA has been prescribed under the Act.

The HPRA is the prescribed person for matters related to the regulation of medicines and devices. Please visit the ‘About Us’ section of the HPRA website for more information on the HPRA’s regulatory remit.

The HPRA is not the prescribed person for reports of wrongdoings relating to use or procurement of medicines or medical devices by hospitals or healthcare professionals, or disclosures relating to medical malpractice.

 If the matter you wish to report does not fall under the description of matters set out above, you can make a report to the Protected Disclosures Commissioner by visiting their website at www.opdc.ie. Workers can also make a protected disclosure via external channels to other parties including prescribed persons, or a Minister.

In accordance with the Act, the HPRA has established a formal channel for workers who wish to make a report.

For a report to qualify as a protected disclosure, and be made to the HPRA, the report must meet the criteria defined under the Act, where the reporting person (i.e. a worker) must reasonably believe that the information disclosed, and any allegations contained in it, having come to the attention of the worker in a work-related context, are substantially true, and that the relevant wrongdoing relates to matters falling within the remit of the HPRA as described above.

Reports that do not fulfil these criteria are not protected disclosures and will not be dealt with in the manner specified by the Act. If the report does not qualify as a protected disclosure, but matters within the report fall within the regulatory remit of the HPRA, follow-up may be carried out in accordance with other HPRA procedures and the reporting person will be advised as such.

It is recommended that, at a minimum, reports should include the following details:

1. that the report is a protected disclosure;
2. the reporting person’s name, position in the organisation, place of work and confidential contact details;
3. the date of the alleged wrongdoing (if known) or the date the alleged wrongdoing commenced or was identified;
4. whether or not the alleged wrongdoing is still ongoing;
5. whether the alleged wrongdoing has already been disclosed and if so, to whom, when, and what action was taken;
6. information in respect of the alleged wrongdoing (what is occurring / has occurred and how) and any supporting information;
7. the name of any person(s) allegedly involved in the alleged wrongdoing (if any name is known and the worker considers that naming an individual is necessary to report the wrongdoing disclosed); and
8. Any other relevant information

Preferably, you can make a protected disclosure to the HPRA by email to protecteddisclosures@hpra.ie.

You can also make a disclosure by post directed to:

Chief Executive
Health Products Regulatory Authority
Kevin O’Malley House,
Earlsfort Terrace
Dublin 2,
D02 XP77

You may also call the dedicated protected disclosure channel on +353 1 263 5443  

A report can also be made by way of a physical meeting upon request.

Note: Any reports made to us via channels other than that set out in this section that, in our opinion, may qualify as a protected disclosure, will be transmitted promptly and without modification to the Designated Person and the protected disclosures process will apply to those reports.

Reports can be made anonymously. If you choose to report anonymously and your report meets the requirements of the Act, you remain entitled to the protections of the Act if you are subsequently identified and penalised for making your report.

Anonymous reports will be followed-up to the greatest extent possible. However, it may not be possible to fully assess and follow-up on an anonymous report.

The HPRA will acknowledge the receipt of the information within seven calendar days.

A designated person within the HPRA will perform an initial assessment of the information provided to determine:

• If the report meets the criteria for a report under the Act;
• If the report concerns matters for which the HPRA is a prescribed person;
• If there is prima facie evidence that a relevant wrongdoing might have occurred.

The designated person will notify you in writing when the initial assessment is complete, the decisions made in relation to the appropriate next steps and reasons for doing so. For example:

• If the report concerns matters which are not within the scope of the HPRA, we will transmit your report to the prescribed person(s) we consider appropriate or to the Protected Disclosures Commissioner.
• If there is no prima facie evidence that a relevant wrongdoing may have occurred, we may close the process.
• If there is prima facie evidence that a relevant wrongdoing may have occurred but we deem the relevant wrongdoing to be minor, we may decide not to follow-up the report and close the process.
• If the report is a repetitive report that does not contain any meaningful new information compared to a previous report, we may close the process.
• If there is prima facie evidence that a relevant wrongdoing may have occurred, we may decide on what further follow-up action is required, depending on the nature of the wrongdoing and in line with the HPRA’s statutory powers and functions.

 The HPRA will endeavour to provide feedback to you on the status or outcome of the follow-up within a reasonable timeframe, and no later than three months after the date of the initial acknowledgement. In justified circumstances, this time period may be extended to six months.

Please note that, while feedback may be provided, the need to maintain confidentiality may prevent the HPRA from providing you with any specific details of the follow-up and/or any actions taken.

All reasonable steps will be taken to protect the identity of a reporting person and of persons concerned named or otherwise identifiable within a disclosure, and to ensure the disclosure is treated in confidence, in line with the provisions of the Act.

The HPRA will not disclose the identity of the reporting person, however if a decision or action is required which may directly or indirectly identify the discloser, they will be consulted in advance that this may occur, unless there are certain prescribed circumstances not to do so (as defined in the Act).

Records will be maintained in compliance with relevant confidentiality requirements. Any personal data collected will be processed in accordance with the provisions of the Data Protection Act 2018, Regulation (EU) 2016/679, Directive (EU) 2016/680 and Regulation (EU) 2018/1725. The discloser’s identity will be protected in line with the obligation in Section 16 of the Protected Disclosures Act.

The Freedom of Information Act 2014 (the “FOI Act”) has been amended by the Protected Disclosures (Amendment) Act 2022. As a result of this amendment, the FOI Act does not apply to a record relating to a report made under the protected disclosures process, whether the report was made before or after the date of the passing of the Protected Disclosures (Amendment) Act 2022.

The Act provides remedies for you should you be penalised by your employer for making a protected disclosure. The definition of penalisation is defined in the Act under Section 3(1).

Complaints of penalisation are treated separately to the actual report of wrongdoing. If you are penalised or threatened as a result of making a protected disclosure, you can make a complaint to the Workplace Relations Commission using the online complaint form available on workplacerelations.ie. You should make a complaint within six months.

It is up to your employer to prove that they did not penalise you for making a protected disclosure. The adjudicator's decision on your complaint may require your employer to take a specific course of action and may award you compensation.

Transparency International Ireland (www.transparency.ie) is an independent, non-governmental organisation. Transparency International Ireland operates a confidential helpline and provides access to free legal advice on making a protected disclosure through the Transparency Legal Advice Centre. The helpline can provide free referrals for professional counselling on request.

For workers who are members of a trade union, many unions offer free legal advice services on employment-related matters, including protected disclosures.

Further information and advice on protected disclosures can be found on the following websites:

The Office of the Protected Disclosures Commissioner (www.opdc.ie)

The Department of Public Expenditure (www.gov.ie)

Citizens Information Board (www.citizensinformationboard.ie)

Each public body is required under section 22 of the Act to provide an annual report to the Minister for Public Expenditure and Reform (provided by 1 March in each year). The information is provided in such a way that it does not enable the identification of reporting persons or persons concerned.

Protected Disclosures 2024 Annual Report

In accordance with Section 22(5) of the Protected Disclosure Act 2014, as amended, the Health Products Regulatory Authority as a public body confirms that channels and procedures for reporting internal and external protected disclosures are in place.

Between 1 January 2024 and 31 December 2024, sixteen external protected disclosures were received by the HPRA as a prescribed person, of which one was transmitted to the Protected Disclosures Commissioner.

Nine investigations were opened which involved a breach of legal obligation and three involved breaches of EU laws within the scope of Article 2 of Directive (EU) 2019/1937, product safety and compliance.

Eleven open investigations were carried over from the previous year. In 2024, eighteen investigations were closed. Fourteen investigations remained open at the end of the calendar year.

There were no internal protected disclosures received.