Increased Whistleblower Protections
Frequently Asked Questions and Resources for Nonprofits
Download copy of tip sheet


On March 29, 2016, Oregon Governor Kate Brown signed House Bill 4067 (“HB 4067”), which expands one of Oregon’s existing “whistleblower” protection statutes (ORS 659A.200 et seq.) to include nonprofit organizations that receive public funds from grants or contracts and their employees.1 This law, which goes into effect on January 1, 2017, provides additional protection to employees and board members of nonprofit organizations who, based on a “good faith and objectively reasonable belief” that the violation occurred, disclose “lawfully accessed information related to” a violation of law by the employer. HB 4067 also requires nonprofit employers to establish and implement a policy explaining an employee’s rights under the statute and report that disclosure to state authorities.

NAO is dedicated to keeping nonprofits up to date on how this law will affect them and their employees.


What additional protection does HB 4067 provide to employees?

If an employee of a nonprofit organization discloses documents that the individual accessed lawfully (even if the documents are exempt from disclosure under Oregon public records law or the employer’s policies) to (1) a state or federal regulatory agency; (2) a law enforcement agency; (3) a manager employed by the nonprofit; or (4) an Oregon-licensed attorney in furtherance of the employees seeking professional legal services connected to the alleged violation of law, HB 4067 provides an affirmative defense to the employee against any civil or criminal charge related to the employee’s disclosure so long as the employee had a “good faith and objectively reasonable belief” that the employer violated federal, state, or local law, rule, or regulation and meets the other requirements of the statute.2 The protections for whistleblowers extended under HB 4067 include all employees and board members.

Among other provisions, HB 4067 also states that a nonprofit organization may not discipline an employee for, threaten to take disciplinary action against an employee for, or prohibit an employee from disclosing information that the employee reasonably believes is “evidence of” a violation of state or federal law, rule, or regulation by the employer or “[m]ismanagement, gross waste of funds or abuse of authority or substantial and specific danger to public health and safety resulting from action of the” employer.

Does this law apply to all nonprofits?

HB 4067 applies to organizations that:

  1. Receive public funds by way of grant or contract; and
  2. Are exempt from income tax under Section 501(c)(3) of the Internal Revenue Code.

HB 4067 does not define what it means to “[r]eceive[ ] public funds by way of grant or contract,” but because of the breadth of that phrase, it is a best practice to assume that an organization falls within the statute if it is designated as a 501(c)(3) organization and it receives any manner of funds from public sources (federal, state and local).

What is an affirmative defense?

An affirmative defense is a legal tool that a defendant may use to defeat a legal claim that has been brought against them. It is generally the responsibility of the person asserting the affirmative defense to prove that they are entitled to the protection of the defense. For example, under HB 4067, if an employer alleges that an employee wrongfully disclosed confidential documents and brings a civil lawsuit on that basis, the employee could assert the affirmative defense that they should prevail against the employer’s claim because they disclosed the documents based on a good faith and reasonably objective belief that the employer violated the law. If they established that they had such a belief and met the other requirements of HB 4067, the employer’s claim would be barred by the defense.

When is an employee entitled to the affirmative defense?

To be entitled to the affirmative defense established by HB 4067, an employee must:

  1. Have a "good faith and objectively reasonable belief" that the employer violated state or federal law, rule, or regulation.
  2. Disclose documents only to:
    • a state or federal regulatory agency; or
    • a law enforcement agency; or
    • a manager employed by the nonprofit; or
    • an Oregon-licensed attorney in furtherance of the employees seeking professional legal services connected to the alleged violation of law.

An employee is not entitled to the affirmative defense established by HB 4067 if:

  1. The employee does not have a "good faith and objectively reasonable belief that a violation occurred;"
  2. The employee discloses or rediscloses, or directs someone to disclose or redisclose the documents to a party other than the parties listed above;
  3. The information disclosed is stated in a "commercial exclusive negotiating agreement" that is not related to the employee's employment;
  4. The information disclosed is stated in a "commercial nondisclosure agreement" that is not related to the employee's employment;
  5. The disclosure relates to some activity by the employee's coworker or supervisor that is not related to the course and scope of the coworker's or supervisor's employment;
  6. The employee is an attorney for the nonprofit or is employed, retained, supervised, or directed by an attorney and the disclosed information is related to the representation of the nonprofit.

What does “lawfully accessed information” mean?

The bill does not define "lawfully accessed information," so we expect that this will be the subject of interpretation by the courts in the future. It is probably safe to assume lawfully accessed information includes information that an employee is authorized by their employer to access in the course and scope of employment, but the precise parameters are not known.

What kind of policy does HB 4067 require?

HB 4067 requires that “nonprofit employers shall establish and implement a policy regarding employees who invoke their rights under [HB 4067] or ORS 659A.203. The policy shall delineate all rights and remedies provided to employees under this section and ORS 659A.203. The employer shall deliver a written or electronic copy of the policy to each employee.”

NAO encourages nonprofits to regularly provide employees and board members with information regarding all governmentally mandated and organizational policies, including but not limited to holding an annual briefing to update staff and board members on these policies. New staff should also be made aware of the same policies during onboarding and be given information on how they impact organizational culture, supervision, and behavior. Because this statute requires a written policy on reporting rights and protections as of January 1, 2017, nonprofit organizations should begin drafting the required policy or revising already-existing policies as soon as possible. Once the policy has been drafted, it is important to ensure that each of a nonprofit’s employees and board members receive a copy of the policy. A best practice is to require each employee or board member to acknowledge—in writing and with their signature—that they received and understand the policy and place a copy of the signed document in HR and board files.

What if HB 4067 doesn’t apply to me, do I still need a Whistleblower Policy?

Even if you believe that HB 4067 does not seem to apply to your organization, NAO strongly encourages every nonprofit to have a policy regarding nonretaliation for reporting violations of state or federal law, rules, or regulations, as well as nonretaliation policies for other protected activities. Such policies encourage staff, volunteers, and board members to voice their concerns without fear of retaliation. Additionally, there are a number of other laws that prohibit retaliation and having a robust nonretaliation policy could protect the organization from potential legal claims under those laws as well.

The IRS also recommends that charitable organizations have “whistleblower policies” in place, and asks 501(c)(3) organizations to report on their IRS Form 990s whether they have a written whistleblower policy.3

Where can an organization get more help?

Developed in Partnership with Miller Nash, Graham & Dunn Employment Attorneys.


  1. HB 4067 also governs the conduct of public employers and employees.
  2. Note: Because HB 4067 is a state law, it does not affect how documents protected by federal law, such as HIPAA, may be disclosed. The law specifically provides that “information protected from disclosure under federal law * * * may be disclosed only in accordance with federal law.”
  3. Internal Revenue Service, Governance and Related Topics — 501(c)3 Organizations

Information provided by NAO is for general purposes only and should not be construed as legal advice or a substitute for legal advice. If you wish to be certain about the proper course of action for your organization, please consult a licensed attorney.