What is a whistleblower policy?

A whistleblower policy is an organizational policy that encourages workers to report suspected illegal or improper activity within the organization while protecting workers from retaliation for making such reports.

Is our nonprofit required to have a whistleblower policy?

New York nonprofits that have at least twenty employees and annual revenues of $1 million or more are required to have a whistleblower policy under Section 715-b of the New York Not-for-Profit Corporation Law.

Keep in mind that whistleblowers have significant protections under other federal, state, and local laws, even if those laws do not explicitly require adoption of a whistleblower policy. For example, Section 1107 of the American Competitiveness and Corporate Accountability Act of 2002 (more commonly known as the Sarbanes-Oxley Act) makes it a crime to intentionally retaliate against any individual, “including interference with the[ir] lawful employment or livelihood,”  for providing law enforcement with truthful information relating to the commission or possible commission of any federal offense. Many states and municipalities have other laws that protect whistleblowers from retaliation.

A whistleblower policy helps to educate management and workers about these legal protections. It is a helpful tool in promoting a culture of lawfulness and integrity. By explicitly stating management’s commitment to protect whistleblowers from retaliation and laying out a process for reporting illegal or improper activity, a whistleblower policy encourages workers to communicate their concerns to the employer in good faith without fear of reprisal. Adopting a whistleblower policy is a recommended best practice for nonprofit employers.

What are the key changes to New York’s whistleblower protections?

Effective January 26, 2022, New York amended Section 740 of the New York Labor Law, which protects workers who engage in whistleblowing activity from retaliation by their employers.¹ The amendments expanded the classes of protected workers, the types of protected whistleblower actions, the types of employment-related actions that are considered illegal retaliation, the time frame for individuals to file a retaliation claim, and the potential penalties for employers who do retaliate against whistleblowers. Below is a summary of some of the key changes.

1. Protected Individuals. The prior law appeared to protect current employees only. The amended law protects current employees, former employees, and independent contractors from retaliation for whistleblowing activity.

2. Protected Actions. Under the prior law, whistleblower protections only applied to disclosures or threats of disclosure that involved an actual violation of a law, rule, or regulation and presented a substantial danger to the public health or safety or constituted health care fraud. There were many types of illegal activities that did not fit within this standard, leaving employees who reported such activities at risk of retaliation. The prior law also stipulated that whistleblower protections did not apply if an employee disclosed an illegal activity, policy, or practice to a public body without first notifying the employer and giving the employer a reasonable opportunity to correct the problem.

The amended law changes these standards. An employer may not retaliate against a protected individual for doing any of the following:

• Disclosing or threatening to disclose to a supervisor or public body an activity, policy, or practice of the employer that the individual “reasonably believes” violates a law, rule, or regulation or poses a substantial and specific danger to the public health or safety;
• Providing information to, or testifying before, any public body conducting an investigation into any such activity, policy, or practice by the employer; or
• Objecting to, or refusing to participate in any such activity, policy, or practice.
• Protected individuals also need only make a “good faith effort” to report the activity, policy, or practice to the employer prior to notifying a public body. No employer notification is required at all when:
  • There is an imminent and serious danger to the public health or safety;
  • The whistleblower reasonably believes that reporting to the supervisor would result in a destruction of evidence or other concealment of the activity, policy, or practice;
  • The activity, policy, or practice could reasonably be expected to lead to endangering the welfare of a minor;
  • The whistleblower reasonably believes that reporting to the supervisor would result in physical harm to the whistleblower or any other person; or
  • The whistleblower reasonably believes that the supervisor is already aware of the activity, policy, or practice and will not correct it. 

3. Prohibited Retaliation. The amended law expands the definition of unlawful retaliation to mean any adverse action taken by an employer or the employer’s agent “to discharge, threaten, penalize, or in any other manner discriminate against” a protected individual who engages in protected whistleblowing activity. This includes:

• Actual or threatened adverse employment actions against a protected individual in the terms and conditions of employment, including but not limited to discharge, suspension, or demotion;
• Actions or threats to take actions that would adversely impact a former employee’s current or future employment; or
• Contacting or threatening to contact United States immigration authorities or otherwise reporting or threatening to report a protected individual’s suspected citizenship or immigration status or the suspected citizenship or immigration status of a protected individual’s family or household member. 

4. Increased Filing Time, Right to Jury Trial, and Penalties for Retaliation Claims. The statute of limitations for filing a retaliation claim under Section 740 is increased from one year to two years. Parties are entitled to a jury trial. A successful retaliation claim against an employer may result in any of the following penalties:

• An injunction against the employer;
• Reinstatement of the whistleblower to their same position or an equivalent position, or front pay in lieu of reinstatement;
• Reinstatement of full fringe benefits and seniority rights;
• Compensation for lost wages, benefits, and other remuneration;
• Payment by the employer of reasonable costs, disbursements, and attorneys’ fees;
• A civil penalty for the employer of up to $10,000; and/or
• Payment of punitive damages by the employer, if the violation was willful, malicious, or wanton. 

5. Employer Notice Requirement. Employers are required to inform protected individuals of their protections, rights, and obligations under the law by posting a notice “conspicuously in easily accessible and well-lighted places customarily frequented by employees and applicants for employment.” The New York State Department of Labor has issued a model notice that employers can post. Employers must also provide an electronic copy of the whistleblower notice to protected individuals via email and/or posting on their website.

1 In 2022, New York also amended Section 741 of the Labor Law, which applies to whistleblower complaints against health care employers.

The post Updated Whistleblower Protections in New York – Is Your Nonprofit Compliant? appeared first on Perlman & Perlman.

A whistleblower policy provides procedures for individuals to report suspected improper conduct without fear of retaliation or adverse employment consequences for doing so. The NPRA requires New York not-for-profit corporations and charitable trusts with 20 or more employees and annual revenue in excess of $1,000,000 in the prior fiscal year to adopt a whistleblower policy. The Guidance Document suggests that smaller nonprofits should also consider adopting such policies, especially given that the IRS Form 990 requires all organizations filing the Form 990 to disclose whether or not the organization has a written whistleblower policy.

An NPRA-compliant Whistleblower Policy must: (1) provide that no director, officer, employee or volunteer of the organization who in good faith reports any action or suspected action taken by or within the organization that is illegal, fraudulent, or in violation of any adopted policy of the organization, will suffer intimidation, harassment, discrimination, or other retaliation or, in the case of employees, adverse employment consequence; (2) provide procedures for reporting violations or suspected violations and preserving confidentiality; (3) designate a person to administer and report on the policy to the board or appropriate committee; and (4) be distributed to directors, officers, employees and volunteers.

If the organization already has a whistleblower policy that “is substantially consistent” with the NPRA requirements, the organization will be considered in compliance with this policy requirement.

Here are a few key points for organizations to consider as they review their whistleblower policies for NPRA compliance:

1. Include reporting procedures that are appropriate to the organization’s structure. Organizations should take time to ensure that the procedure for reporting suspected violations takes into account the organization’s size, structure, and other unique considerations.  For example, should the individual report to a supervisor before going to Human Resources? To whom should the person seeking to report a suspected violation report an issue if the potential violator is the reporting person’s supervisor?
2. Clearly disclose which “adopted policies” are covered (or not covered) by the policy. The Guidance states that the “adopted policies” that must be covered by the organization’s whistleblower policy include those policies that are designed to “prevent financial wrongdoing, such as internal and external financial controls, accounting policies, and policies prohibiting fraud, theft, embezzlement, bribery, kickbacks, and abuse or misuse of corporate assets; conflict of interest policies; policies addressing unethical conduct; and harassment and discrimination policies.”  The Guidance also states that certain policy violations may not be entitled to whistleblower protection, such as a complaint that a fellow employee is violating the organization’s dress code contained in the Board-adopted employment manual.  The organization’s board should decide whether certain organizational policies that are not required to be included in the policy will be covered by, or excluded from, the policy, and make that clear within the policy.
3. Include procedures for preserving confidentiality. Some whistleblower policies do not sufficiently address how confidentiality will be preserved for those reporting violations or suspected violations.  The NPRA requires more than a simple statement that confidentiality of the person reporting the violation or suspected violation will be maintained – it must include specific procedures that outline how the confidentiality of reported information will be preserved. The person responsible for receiving reported information pursuant to the whistleblower policy should, at a minimum: (1) refrain from disclosing the identity of the whistleblower without the individual’s explicit consent; (2) store any information related to whistleblowers, allegations, and investigations in a secure location; and (3) limit the number of people with access to confidential information to the minimum number possible under the circumstances.
4. Ensure that volunteers are appropriately covered by the policy.  Many whistleblower policies cover employees, directors, and officers, but may not include volunteers.  The NPRA requires the policy to be given to all officers, employees, trustees, directors, and volunteers.  For not-for-profit corporations, the policy only needs to be given to volunteers who provide “substantial services.” For charitable trusts, the policy must be given to all volunteers.
5. Determine the best process for distributing the policy. The NPRA requires nonprofits subject to the whistleblower policy requirement to distribute the policy to all directors, officers, employees and volunteers, but does not specify the method of distribution. The Guidance suggests that a best practice is to distribute the policy to each person covered by the policy, and require each recipient to acknowledge receipt and review of the policy.  The Guidance further notes that this requirement may be satisfied by making the policy available on the organization’s publicly available website, but recommends providing a hard copy to anyone covered by the policy upon his or her request. The Guidance also encourages ongoing awareness of the policy through the organization’s normal compliance training and communication.

The post Tips for Whistleblower Policy Compliance in New York appeared first on Perlman & Perlman.