In short and in plain language
This article is about a place for reports. There, staff can report wrongdoing at work.
The duty to have such a place can affect larger care services. The article explains who is meant.
A notice in the office often does not reach nurses on their rounds. Your website can show the way to report.
This means its own page, a private form and a clear contact person. Reports should reach just the people in charge, not a shared inbox.
We build this page and the form into your website.
A care service with, as a rule, at least 50 employees (Section 12(2) HinSchG) must run an internal reporting office that staff can contact with information about violations. For private employers with 50 to 249 employees this has applied since 17 December 2023 (Section 42 HinSchG). If your reporting office so far only appears on a notice in the office, it hardly reaches nurses on their rounds, part-time staff on the late shift or agency workers. Your own website can carry this route: a dedicated page on the reporting procedure, a confidential form, a clearly named contact and matching privacy notes. This article shows who has to set up a reporting office, how the threshold is counted, which deadlines apply and why the reporting form must not end up in the shared inbox.
Key takeaways
- Care services with, as a rule, at least 50 employees (Section 12(2) HinSchG) need an internal reporting office. For private employers with 50 to 249 employees this has applied since 17 December 2023 (Section 42 HinSchG).
- Only 28.3 percent (Federal Statistical Office) of staff in home care services worked full time at the end of 2023. The HinSchG has no rule for counting part-time staff pro rata. Counting full-time posts easily understates how close a service is to the threshold.
- The reporting office confirms receipt no later than after seven days and gives feedback within three months (Section 17 HinSchG). The website states both deadlines and asks for an optional way to get in touch.
- Only the responsible persons may see incoming reports (Section 16(2) HinSchG). The reporting form therefore writes to a separate address of the reporting office, not to the shared inbox and without a copy in the website backend.
- The Federal external reporting office received 1,802 reports in 2024 (Federal Office of Justice). Section 7(3) HinSchG provides for incentives to use the internal route; an easy-to-find page, linked from the careers page and the footer, can be one of them.
- Without a reporting office, fines of up to EUR 20,000 apply (Section 40(6) HinSchG). Breaching confidentiality intentionally or recklessly risks up to EUR 50,000, and up to ten times that for the company.
Who needs a reporting office: the threshold of 50
The German Whistleblower Protection Act (HinSchG) obliges employers to set up and run at least one office for internal reports (Section 12(1) HinSchG). The duty applies to employers with, as a rule, at least 50 employees each (Section 12(2) HinSchG). Private employers with 50 to 249 employees (Section 42 HinSchG) only had to set up their reporting office from 17 December 2023. Since then the duty also covers medium-sized home care services, day care centres of larger providers and care homes. What counts is the individual employer, so in a group of providers each company is assessed on its own (Section 3(9) HinSchG). Employees within the meaning of the Act include employees, persons employed for vocational training and persons similar to employees (Section 3(8) HinSchG). Nursing trainees therefore count too.
The care statistics give an indication of how many services are affected. On the reference date in December 2023 there were 15,549 home care and support services (Federal Statistical Office) with a total of 446,425 staff (Federal Statistical Office). That is an average of just under 29 people per service (Federal Statistical Office). The average is therefore below the threshold, while services with clearly more staff than average are above it. In care homes the average was just under 50 staff per facility (Federal Statistical Office). There the mean sits almost exactly on the line.
A second figure matters for the count. Only 28.3 percent (Federal Statistical Office) of staff in home care services worked full time, the larger share part time or in other forms of employment. The HinSchG contains no rule under which part-time staff count only pro rata. The Protection Against Dismissal Act, by contrast, counts part-time staff with up to 20 hours a week as 0.5 and with up to 30 hours as 0.75 (Section 23(1) KSchG). Anyone used to this calculation from employment law who applies it to the reporting office can easily count themselves below the line even though clearly more than 50 people work for the service. The cautious reading therefore counts people, not posts.
What also matters is the number of people employed "as a rule". The explanatory memorandum to the Act calls for a look back at previous staffing levels and an assessment of future development, and expressly not a view based on a single reference date (Bundestag, printed paper 20/3442). A service that briefly exceeds 50 in summer because of temporary helpers is therefore not automatically obliged. A service that grows steadily, on the other hand, should not wait until the day of its fiftieth hire to check the threshold.
Do not count part-time staff out
An employer that is obliged but does not set up and run an internal reporting office commits an administrative offence (Section 40(2) HinSchG). The fine can reach EUR 20,000 (Section 40(6) HinSchG). There is also a practical drawback: whistleblowers may choose anyway whether to contact an internal or an external reporting office (Section 7(1) HinSchG). If the internal route is missing, only the external one remains, and the first clarification then lies with an authority instead of in-house.
What the internal reporting office has to deliver
The Act leaves open who the reporting office is. It can be one employee, a unit of several employees or a commissioned third party such as an external ombudsperson (Section 14(1) HinSchG). Several private employers with, as a rule, 50 to 249 employees may run a joint office (Section 14(2) HinSchG). The duty to remedy violations and to respond to the whistleblower, however, stays with the individual service. Whoever takes on the role works independently, may have other tasks alongside it and needs the necessary expertise (Section 15 HinSchG). The service has to ensure that these other tasks do not lead to conflicts of interest. A head of nursing who is personally responsible for rosters and rounds is therefore a difficult choice for reports on exactly these topics.
Section 16 HinSchG sets the framework for the reporting channels. Reports must be possible orally or in text form, orally by telephone or another form of voice transmission. At the whistleblower's request, an in-person meeting must be offered within a reasonable time, and with their consent also by video (Section 16(3) HinSchG). The reporting office should process anonymous reports. There is, however, no obligation to design the channels so that they allow anonymous reports (Section 16(1) HinSchG). A form on the website is the obvious route for text form; the telephone number and the offer of a meeting sit next to it on the same page.
Once a report arrives, the procedure under Section 17 HinSchG follows, together with the follow-up action under Section 18 and the documentation under Section 11 HinSchG. This gives the reporting office six tasks that the website can present as a sequence:
- Confirm receipt: no later than after seven days (Section 17(1) HinSchG).
- Check responsibility: does the reported violation fall within the material scope under Section 2 HinSchG?
- Stay in contact and ask the whistleblower for further information where needed.
- Check substance and take appropriate follow-up action, such as an internal investigation or referral to a competent authority (Section 18 HinSchG).
- Give feedback: within three months of confirming receipt, covering planned and completed follow-up action and the reasons for it (Section 17(2) HinSchG).
- Document: record every report in a permanently retrievable and confidential way. The documentation is deleted three years after the procedure has been closed (Section 11(5) HinSchG).
Section 2 HinSchG sets out what can be reported. For care services three groups matter most: violations subject to criminal penalties, violations subject to fines where the rule protects life, limb or health or the rights of employees, and violations of the General Data Protection Regulation (Section 2(1) HinSchG). These can include suspected billing for services not provided, abuse of clients, breaches of working time and occupational safety rules or unlawful handling of health data. Whether a report is covered in an individual case is for the reporting office to check. The website does not pre-empt that check but gives examples and encourages people to report.
Why the reporting route belongs on the website
The duty to inform is written into the Act. Obliged employers provide employees with clear and easily accessible information on using the internal reporting procedure (Section 7(3) HinSchG). The reporting office also keeps information on external reporting procedures available (Section 13(2) HinSchG). The Act does not say where this information has to be. A notice in the office, a page on the intranet or a chapter in the staff handbook are all possible.
In home care there is a lot to be said for the website. During their shifts nurses are mostly out visiting clients, not every service has an intranet, and everyone carries a smartphone. Then there are groups an intranet usually does not reach: agency workers, who may also contact the internal reporting office (Section 16(1) HinSchG), and, if the service chooses, people who deal with it professionally, such as medical practices, therapists or partner organisations. A publicly accessible page reaches all of them, without login details and without going through management.
The figures of the Federal external reporting office show that people report online. It received 1,802 reports in 2024 (Federal Office of Justice), after 410 in the second half of 2023 (Federal Office of Justice). In the first half of 2025 the number had already passed 1,400 (Federal Office of Justice). More than 90 percent (Federal Office of Justice) of reports there now come in through the electronic reporting channel, which also offers an anonymous return channel. For a care service this means: if there is no easily reachable internal route, the first clarification is left to an authority. The Act intends the opposite. Obliged employers are to create incentives for whistleblowers to turn to the internal reporting office first, without making external reporting harder (Section 7(3) HinSchG).
These employers provide employees with clear and easily accessible information on using the internal reporting procedure.
The reporting route page: six building blocks
The page itself is short. It answers six questions in plain language and leads to the form. The reporting office decides what it says. The website makes sure it can be found, understood and used on any device.
Who can report
Employees, trainees and agency workers. If the service chooses, also people who deal with it professionally, such as medical practices or therapists.
What can be reported
Examples from everyday care on criminal offences, occupational safety and data protection, with a note that the reporting office checks responsibility case by case.
Routes to the office
A form for text reports, the telephone number of the reporting office and the offer of an in-person meeting, with consent also by video.
Confidentiality and protection
Who sees the report and who does not. Plus the note that reprisals against whistleblowers are prohibited (Section 36 HinSchG).
Process and deadlines
Confirmation of receipt no later than after seven days, feedback within three months, documentation of every report and its later deletion.
External reporting offices
A note on external reporting procedures, such as the Federal external reporting office at the Federal Office of Justice, as Section 13(2) HinSchG provides for the internal reporting office.
On protection against disadvantage, one clear sentence on the page pays off. Reprisals against whistleblowers are prohibited, as are threats and attempts. If a whistleblower claims to have suffered a professional disadvantage after a report, it is presumed to be a reprisal. Whoever caused the disadvantage must then prove that it was justified or not based on the report (Section 36 HinSchG). This information addresses an obvious worry about reporting, without the page promising more than the Act provides.
Link the page where staff look anyway: in the footer next to the imprint and privacy policy, on the careers page and in the staff area if there is one. A short, meaningful address such as "/whistleblowing/" can also be printed on a notice or a card in the induction folder. Where the page fits in the website structure is covered in the article on website structure for care services.
If people in your team have a different first language, the page belongs on the website in plain language and, where needed, in other languages. How to prepare content for international colleagues is shown in the article on international care workers and the careers page. The page and form must also be accessible, with labelled fields, understandable error messages and sufficient contrast. The basics are on our page on the accessible care website.
Not the same as complaints
The confidential form: not into the shared inbox
The form decides whether confidentiality holds. Reporting offices protect the identity of the whistleblower, of the persons who are the subject of the report and of other persons named in it (Section 8(1) HinSchG). The identity may only become known to those responsible for receiving reports or for follow-up action, and to the people supporting them. The reporting channels must be designed so that only these persons have access to incoming reports (Section 16(2) HinSchG).
A typical contact form sends every message to an address such as info@, which administration, the head of nursing and, depending on staffing, trainees at reception read. For a report that is the wrong place. Anyone looking in there sees names, allegations and, depending on the case, health data of clients. Anyone who intentionally or recklessly fails to maintain confidentiality commits an administrative offence; the fine can reach EUR 50,000 (Section 40(6) HinSchG), and EUR 10,000 for negligence (Section 40(6) HinSchG). For the company itself the maximum can rise tenfold, because the HinSchG refers to the Administrative Offences Act for these cases (Section 30(2) OWiG).
| Point | Contact form with shared inbox | Dedicated reporting form |
|---|---|---|
| Recipient | info@ or a general office address | separate address of the reporting office |
| Who reads along | administration, management, deputies | only the responsible persons and their support (Section 16(2) HinSchG) |
| Copies | forwarding, copy to management | no copy, no forwarding rule |
| Storage | depending on the system also in the website backend | delivery to the reporting office, no storage in the website backend |
| Scripts on the page | analytics and embedded services possible | no tracking or third-party scripts |
| Deletion | according to the inbox rules | three years after the procedure is closed (Section 11(5) HinSchG) |
This results in a short technical checklist for the reporting form. It applies whether the reporting office is in-house or a commissioned third party:
- A separate recipient address of the reporting office that only the responsible persons and their deputy can access.
- No forwarding to shared addresses and no copy to management or administration.
- No storage of the report in the website backend or in a form archive that editors or service providers can access.
- Transfer exclusively encrypted over HTTPS and processing on servers in Germany.
- No analytics, map or video services on the page and no fonts from third-party servers.
- Optional contact field, with a note that without a contact route neither confirmation nor follow-up questions are possible.
- File attachments only if the reporting office needs them, with a note on metadata in photos and documents.
- A confirmation page that does not repeat the content, so nothing stays visible on a shared device.
Care adds a special feature. Reports may concern clients and therefore contain health data. The reporting office may process such special categories of personal data where this is necessary to perform its tasks, but must then provide specific and appropriate safeguards (Section 10 HinSchG). The reporting form is therefore subject to the same standards as any form with health data, as described in the article on data protection in care forms. How quickly a convenient side route undermines confidentiality is shown in the article on WhatsApp in care services: it depends not only on the technology of the form but also on the content not ending up in a group chat along the way.
Receipt, confirmation, feedback: the deadlines
The procedure has two fixed deadlines. The reporting office confirms receipt no later than after seven days (Section 17(1) HinSchG). Within three months of this confirmation it gives feedback; if receipt was not confirmed, the period ends three months and seven days after the report arrived (Section 17(2) HinSchG). The feedback covers planned and completed follow-up action and the reasons for it, as far as internal enquiries and the rights of the persons concerned allow.
The website can support both but does not replace the reporting office. Right after submission it shows that the report has arrived and names the next steps. The confirmation of receipt within the meaning of the Act comes from the reporting office, and for that it needs a way to reach the whistleblower. If the form asks for an optional contact, such as a private email address instead of the work one or a telephone number, the reporting office can confirm, ask questions and give feedback. If the field stays empty, the report is anonymous and the exchange ends with submission. Anyone wanting to allow anonymous reports with a return channel needs a dedicated system of the reporting office; the page then links to it.
- Day 0, receipt: the report reaches the reporting office only.
- Day 7 at the latest, confirmation: the reporting office confirms receipt via the contact route provided (Section 17(1) HinSchG).
- Review: scope, substance and questions to the whistleblower.
- Follow-up action: internal investigation, referral to other competent bodies, handover to an authority or closure of the procedure (Section 18 HinSchG).
- No later than three months after confirmation, feedback: planned and completed action with its reasons (Section 17(2) HinSchG).
- Three years after closure, deletion: the documentation is deleted unless longer retention is necessary (Section 11(5) HinSchG).
Plan for holidays and sickness
Privacy notes for the reporting channel
Anyone offering a reporting form informs people about how the data is processed. A separate section linked from the form makes sense, rather than a paragraph deep in the general privacy policy that hardly anyone finds. It contains these points:
- Controller and contact of the reporting office, and for a commissioned ombudsperson also their role.
- Purpose: receiving and handling reports under the Whistleblower Protection Act; the reporting office's power to process data follows from Section 10 HinSchG.
- Which data arises: content of the report, optional contact details, attachments where relevant and technically necessary connection data.
- Who has access: exclusively the reporting office and the people supporting it in its tasks.
- When the identity may be passed on, for example in criminal proceedings at the request of the prosecuting authorities or, where necessary for follow-up action, with consent in text form (Section 9 HinSchG).
- Storage period: deletion of the documentation three years after the procedure is closed (Section 11(5) HinSchG).
The technology behind the form belongs in the picture too. Servers usually store connection data when a page is called up. For the reporting page this storage should be limited to what is necessary and kept short. Whether the website sits with a service provider, who has access there and who manages the logins is covered in the article on domain, hosting and access. For retention periods on the website there is often a model in-house already: how the careers page handles deadlines for application documents is shown in the article on deleting applicant data.
Introducing it in a care service in five steps
- Count employees: everyone who regularly works for the service, including part time, mini-jobs and training, looking at the past year and planned development.
- Appoint the reporting office: a suitable person, a small team or a commissioned third party, with a deputy and without a conflict of interest.
- Define channels: form, telephone number of the reporting office, offer of an in-person meeting and a decision on anonymous reports.
- Build page and form: six building blocks, a separate mailbox for the reporting office, privacy notes, links from the footer and careers page.
- Inform and test with the team: team meeting, induction folder, notice with a short address. A test report shows whether it really arrives only at the reporting office.
After launch the page needs looking after. If the responsible person changes, name, telephone number and mailbox rights change on the same day. If the legislator changes the procedure, the page is updated. Both belong in the ongoing maintenance of the care website. How to switch content over in an orderly way when the law changes is also shown in the article on the care reform draft.
We build the reporting route page and the reporting form as part of your care website: with a separate recipient address for the reporting office instead of the shared inbox, delivery without storage in the website backend, transfer over HTTPS, hosting in Germany and no third-party scripts on the page. The building blocks available for this are described on our page on data protection for care websites. We agree the content on responsibility, procedure and data protection with your reporting office and your data protection adviser. This does not replace a legal review of the individual case. If you would like to know how the page fits into your existing website, write to us via the contact form.
Sources and legal texts
Related Articles
ePA in care: what relatives want to know about access
The ePA in care: what the care service sees, who adds entries, how relatives object or act as representatives, and how a guide page answers these questions.
Deleting applicant data: retention rules for care teams
Two months, three months, a buffer: which periods apply after a rejection, what the careers page has to state and how deletion becomes a routine step.
Presenting Round-the-Clock Care Without Legal Risk
Round-the-clock care on a nursing website: describe shift times, on-call duty and costs so that the promise holds up to scrutiny and matches what you deliver.