1. Home
  2. |Insights
  3. |Whistleblowing – A Guide to Compliance: Part 4

Whistleblowing – A Guide to Compliance: Part 4

Client Alert | 2 min read | 07.14.21

Crowell & Moring LLP’s 2021 series of client alerts: Whistleblowing – A Guide to Compliance is intended to provide companies with a practical guide to help them comply with their obligations under the EU Whistleblower Directive. Via a monthly alert, Crowell & Moring LLP will explain the different steps that companies need to take for compliance and emphasize various points for consideration. Step #4: Check the steps you should already be taking to ensure your company’s compliance with the EU Whistleblower Directive and the national laws that implement it.

1. Summary of the different steps and action points that can already be undertaken for compliance with the EU Whistleblower Directive

In our previous Alerts in this series, we have drawn attention to some of the steps and action points that companies can already undertake with a view to compliance:

2. Current status of the implementation of the EU Whistleblower Directive in the various EU member states

Click to view this chart.

Conclusion:

From the overview set out above, it can be seen that although some major EU member states are already well advanced in the transposition of the EU Whistleblower Directive (the Netherlands, Sweden), most countries are lagging behind. As a result, there is a definite risk that these countries will not meet the deadline for transposition of the Directive of December 17, 2021. The coming months will be crucial in determining whether the deadline of December 17, 2021 is realistic and whether the European Commission might agree to an extension of this deadline.

  • Action point #4: Monitor the different EU member states’ national implementation of the EU Whistleblower Directive to identify specific national requirements.

Insights

Client Alert | 7 min read | 08.17.26

Delayed Notification of Cyberattacks May Trigger HIPAA Breach Notification Rule

After identifying a ransomware attack in 2021, OSF Healthcare System waited until its forensic investigation had concluded before notifying the U.S. Department of Health and Human Services (HHS) — and the affected individuals — of the breach. The 110-day delay (nearly double the 60-calendar-day notification deadline mandated by the HIPAA Breach Notification Rule) triggered an investigation from HHS’s Office for Civil Rights (OCR). The health system’s investigation determined that protected health information (PHI) had been stolen....