What the Patient Safety Act 2023 Does

The Act turns open disclosure from policy into legal duty. The Patient Safety (Notifiable Incidents and Open Disclosure) Act 2023 requires every health services provider in Ireland, public and private, to hold a formal disclosure meeting with the patient or their family when one of thirteen listed serious incidents occurs (irishstatutebook.ie). For anyone weighing a medical negligence or personal injury claim, the Act now governs how the facts of the most serious hospital incidents first reach the patient.

Three duties sit at its core. Section 5 obliges the provider to make open disclosure of a notifiable incident at a dedicated meeting, and the duty applies even where the full consequences or root cause are not yet known. Sections 27 to 29 require external notification of the same incident to the appropriate regulator, generally within seven days. Section 77 makes failure to comply with the open disclosure obligation, without reasonable excuse, a criminal offence carrying a Class A fine, currently up to €5,000, on summary conviction. Where a body corporate offends with the consent or connivance of a director or manager, that officer can also be prosecuted. Disclosure before the Act rested on the voluntary regime in Part 4 of the Civil Liability (Amendment) Act 2017 and on HSE policy dating from 2013; the 2023 Act replaces that discretion with compulsion for the incidents listed in Schedule 1.

The Act deliberately does not create a compensation scheme, a new cause of action, or any change to the test for negligence. It is a transparency statute, one that makes mandatory open disclosure Ireland's default response to the thirteen listed incidents. What it changes for a personal injury claim is timing and information: the patient learns of a qualifying incident quickly, in a structured meeting, with a written record to follow. Open disclosure is now mandatory in Ireland for the Schedule 1 incidents, and remains voluntary for everything else.

↑ Back to top

Why the Act Was Introduced: CervicalCheck, Scally and Morrissey

The Act is the Oireachtas response to the CervicalCheck disclosure failures. In 2018 it emerged that many women diagnosed with cervical cancer had not been told that retrospective audits of their earlier smear tests showed missed abnormalities, a controversy examined on our CervicalCheck Audit & Open-Disclosure Failures page. Dr Gabriel Scally's Scoping Inquiry that followed criticised the inconsistent, discretionary approach to open disclosure and recommended a mandatory statutory scheme.

The Supreme Court's decision in Morrissey v HSE [2020] IESC 6 then clarified the standard of care owed by screening services while the Patient Safety Bill was already before the Oireachtas. The result is a landmark piece of patient safety legislation Ireland has enacted in direct response to those failures. The Bill was initiated on 5 December 2019 as Bill 100 of 2019, amended substantially at Committee Stage in March 2022, passed by Dáil Éireann on 15 February 2023, and signed on 2 May 2023 (oireachtas.ie). The Oireachtas debates on the Bill reveal a sustained focus on the experience of the women affected and the 221+ patient group, which explains two of the Act's more distinctive features: the patient-requested cancer screening reviews in Part 5 and the statutory statement of what a disclosure meeting must cover. A separate statutory route for the women affected, the CervicalCheck Tribunal, is addressed on its own page.

↑ Back to top

What Is a Notifiable Incident? The Schedule 1 List

A notifiable incident is one of thirteen listed events, twelve of them deaths. Schedule 1 of the Patient Safety Act 2023 defines the incidents that trigger mandatory open disclosure in Ireland, and the list is deliberately narrow (irishstatutebook.ie). Part 1 lists twelve incidents built around a death that was unintended, unanticipated, and in most items not wholly attributable to the patient's underlying illness. Part 2 adds the single non-fatal incident: a baby who requires, is referred for, or was considered for therapeutic hypothermia.

Two drafting choices matter. First, the qualifiers do real work: an anticipated death, or one wholly attributable to the underlying illness, generally falls outside the Schedule. The short title puts the list first for a reason, and practitioners often shorten the statute to the notifiable incidents Act: the Schedule defines its entire mandatory scope. Second, the terms "prescribed birthweight" and "prescribed gestational age" in items 1.10 and 1.11 are defined by regulation, currently the Patient Safety (Notifiable Incidents and Open Disclosure) Regulations 2024, S.I. No. 501 of 2024. Section 8 lets the Minister for Health add further incidents by regulation, so the list can widen without fresh primary legislation. A nuance the official text does not capture: item 2.1 is the only incident where the trigger is a treatment decision rather than a death, which makes it the earliest statutory alert a family will receive after a suspected oxygen-deprivation event at birth. The HSE's Notifiable Incident Guideline 2026 now supports providers in identifying incidents against the Schedule 1 definitions (HSE).

↑ Back to top

Key Sections of the Act

The Act turns on a small number of operative sections. The provisions below carry most of the practical weight for patients, families, and the practitioners advising them under Irish law.

• Sections 2–3 · the definitions that set the Act's reach
• Section 5 · the obligation to make open disclosure
• Sections 16–18 · the designated person and the disclosure meeting
• Section 10 · why an apology is not an admission
• Sections 27–29 · notification to HIQA, the Chief Inspector or the Mental Health Commission
• Part 5 · patient-requested cancer screening reviews
• Part 6 · clinical audit protections
• Part 7 · HIQA standards for private hospitals; section 68 pending
• The statutory sequence at a glance

Sections 2 and 3: The Definitions That Set the Act's Reach

Sections 2 and 3 of the Patient Safety Act 2023 define the terms that fix who owes the duty and who receives disclosure in Ireland (irishstatutebook.ie). Open disclosure is, in the HSE's phrase, an "open, honest, compassionate and timely" communication with the patient after a patient safety incident. A notifiable incident is an incident listed in Schedule 1, or added by ministerial regulation under section 8. A health services provider is a person or body that employs, contracts with, or otherwise arranges with a health practitioner to provide a health service, so the duty reaches public and private settings alike. A health practitioner includes doctors, dentists, pharmacists, and nurses and midwives, among the regulated professions. A relevant person may be a decision-making representative under the 2015 capacity legislation, an attorney, a parent or guardian, or someone the patient nominates in writing. The designated person is the provider employee who acts as the patient's continuing point of contact through the process.

Section 5: The Obligation to Make Open Disclosure

Section 5 of the Patient Safety Act 2023 obliges a health services provider, once satisfied that a notifiable incident has occurred, to make open disclosure of it at a notifiable incident disclosure meeting (irishstatutebook.ie). Under section 6, a health practitioner who becomes aware of an incident must inform the provider. Section 7 identifies who receives the disclosure: the patient, a "relevant person" such as a decision-making representative under the Assisted Decision-Making (Capacity) Act 2015, an attorney, a parent or guardian, or a written nominee, or both. Sections 19 and 20 deal with the narrow situations where a patient declines disclosure or cannot be contacted despite documented efforts, and preserve a route back into the process afterwards.

Sections 16 to 18: The Designated Person and the Disclosure Meeting

Sections 16 to 18 structure the meeting itself. The provider appoints a designated person as the patient's continuing point of contact (s. 16), holds the meeting in person unless the patient asks otherwise (s. 17), and must cover the matters listed in section 18: the date and description of the incident, when it came to the provider's attention, the physical and psychological consequences known or expected, the treatment and care being provided in response, and an apology where appropriate. Section 24 then requires a written statement of the information given, including any apology, to be provided within five days of the meeting, together with a statement of the legal effect of the disclosure.

Section 10: Why an Apology Is Not an Admission

Section 10 of the Patient Safety Act 2023 is the provision a claimant will meet first in practice. Information provided, and any apology made, at the disclosure meeting "shall not constitute an express or implied admission of fault or liability", is not admissible "as evidence of fault or liability" in court in relation to the incident or a clinical negligence action arising from it, and does not invalidate the provider's or practitioner's indemnity insurance or medical defence organisation cover (s. 10, irishstatutebook.ie). Section 10(2) extends the shield to fitness-to-practise and professional misconduct processes under the regulated professions' statutes. The protection is procedure-bound: it attaches to what is said within the statutory disclosure process, including the section 24 statement and any clarification meetings. It does not reach the patient's medical records, independently established facts, or expert analysis of the care given. Those remain the ordinary evidential foundation of any claim.

Sections 27 to 29: Notifying HIQA, the Chief Inspector or the Mental Health Commission

Sections 27 to 29 require the provider to notify the notifiable incident externally, generally within seven days, to the body matching the setting: the Health Information and Quality Authority for most health services, the Chief Inspector of Social Services for designated centres, and the Mental Health Commission for approved mental health centres. HSE and Section 38 services report through the National Incident Management System operated with the State Claims Agency; private providers use a portal on the relevant regulator's website. Section 33 applies the same evidential protections to these notifications as section 10 applies to the disclosure meeting.

Part 5: Patient-Requested Cancer Screening Reviews

Part 5 gives a patient who develops cancer after taking part in BreastCheck, CervicalCheck or BowelScreen the right to request a review of their earlier screening, and obliges the screening service to tell patients of that right at or before screening. The completed review must itself be openly disclosed at a meeting, with a written follow-up, and section 41 applies the same protections to information and apologies given in that process. This is the Act's most direct answer to the CervicalCheck audit controversy: the review now happens because the patient asks, and its outcome must be communicated, not filed.

Part 6: Clinical Audit Protections

Part 6 defines clinical audit and, in section 61, protects information generated by an audit conducted for patient safety and quality improvement. Audit data cannot be used as an admission of fault, as evidence in civil proceedings, to void indemnity cover, or in fitness-to-practise processes, and sections 34 and 60 restrict Freedom of Information access to the protected notifications and audit material. The policy trade is explicit: candid internal review is encouraged by removing its litigation value, while the underlying clinical records stay discoverable.

Part 7: HIQA Standards Reach Private Hospitals; Section 68 Still Pending

Part 7 amends the Health Act 2007 so that HIQA may set standards for, monitor and inspect private hospitals and prescribed private health services, a significant widening of regulatory reach relevant to any private hospital negligence question. One element remains outstanding: section 68, which would give the Chief Inspector a power to review specified incidents, has not been commenced; the Department of Health has stated it requires a further technical amendment before a commencement order is made under section 1(2) (irishstatutebook.ie commencement record).

The Statutory Sequence at a Glance

Read together, the Act's operative sections produce a fixed order of events after a notifiable incident in an Irish health service:

1. A health practitioner who becomes aware of the incident informs the provider (s. 6).
2. Once the provider is satisfied a notifiable incident occurred, the section 5 duty to disclose arises.
3. The timing of the disclosure, and the matters to be addressed beforehand, are settled (ss. 14 and 15).
4. A designated person is appointed as the patient's continuing contact (s. 16).
5. The disclosure meeting is held, in person unless the patient asks otherwise, covering the section 18 matters and any apology (ss. 17–18).
6. A signed written statement of the information given, with a statement of its legal effect, follows within five days (s. 24).
7. The incident is notified to HIQA, the Chief Inspector or the Mental Health Commission, generally within seven days (ss. 27–29).

↑ Back to top

What Questions Does the Patient Safety Act 2023 Leave Unresolved?

The open questions cluster around scope, enforcement and the courts. Understanding the Act's limits matters as much as its duties for anyone assessing a personal injury claim in Ireland. The Schedule 1 list is narrow: serious harm falling short of death, apart from item 2.1, triggers no mandatory duty and stays within the voluntary 2017 regime. Section 68 is uncommenced, leaving the promised incident-review power for nursing home settings unrealised. And no reported Irish decision has yet interpreted section 10 or Schedule 1, so how judges will police the boundary between protected disclosure material and ordinary evidence remains untested. Section 80 also builds change into the statute itself, requiring a review of the Act's operation, so the current settlement is expressly provisional (irishstatutebook.ie). Those gaps frame the sections that follow: the commencement record, the surrounding case law, and the Act's interaction with the wider statute book.

↑ Back to top

How the Act Has Been Commenced and Amended

The Act commenced in one main tranche, with one section held back. The commencement and amendment history of the Patient Safety Act 2023 is short but precise, and the dates matter for identifying which regime governed an incident.

Status stated as of July 2026. What changed in the August 2024 amendment: the Oireachtas corrected the drafting of two subsections before the Act ever operated, a reminder to check the Revised Act rather than the enacted text for current wording.

↑ Back to top

Case Law Around the Act

No reported decision yet interprets the 2023 Act; two earlier cases define its setting. As of July 2026 the Irish courts have not been asked to construe section 10, Schedule 1, or the offence in section 77. The decisions below fix the legal background against which the Act operates.

↑ Back to top

How the Act Interacts with Other Legislation

The Act rewires several existing statutes rather than standing alone. Reading the Patient Safety Act 2023 alongside its neighbours in Irish law shows where the mandatory regime ends and older rules continue.

Interaction with the Civil Liability (Amendment) Act 2017: Part 4 of the 2017 Act created the voluntary open disclosure scheme, in operation since September 2018. Section 82 of and Schedule 2 to the 2023 Act amend that framework to bring it into step with the new mandatory procedure, and section 83 preserves disclosures already made under it. The voluntary route remains available for the far larger category of patient safety incidents that fall outside Schedule 1, with broadly similar protections.

Interaction with the Health Act 2007 and the Assisted Decision-Making (Capacity) Act 2015: Part 7 amends the 2007 Act to extend HIQA's standard-setting and inspection functions to private hospitals, while the Assisted Decision-Making (Capacity) Act 2015 supplies part of the definition of the "relevant person" who may receive disclosure where the patient has died or lacks capacity. The Act also amends the National Treasury Management Agency (Amendment) Act 2000, connecting the notification system to the State Claims Agency's incident infrastructure.

Interaction with the Statute of Limitations: Nothing in the 2023 Act alters the two-year limitation period or the date-of-knowledge rules under the Statute of Limitations (Amendment) Act 1991. In practice, a disclosure meeting and the section 24 written statement may be exactly the point at which a patient acquires knowledge that an injury is attributable to the care given, which is examined on our Date of Knowledge page. The Act accelerates information; it does not pause time.

↑ Back to top

The Patient Safety Act 2023 in Practice

In practice, the Act front-loads facts without deciding fault. Practitioners typically encounter the Patient Safety Act 2023 at the very start of a potential clinical negligence matter in Ireland: a family attends a disclosure meeting, receives the written statement days later, and wants to know what it all means. Two points recur. First, the statement and any apology are shielded by section 10, so the meeting is a source of orientation, not ammunition; proving breach of duty still runs through the medical records and independent experts applying the Dunne principles. Second, the notification duties generate a regulatory record with HIQA, the Chief Inspector or the Mental Health Commission that simply did not exist in this form before September 2024. In practice, section 10 disputes are likely to turn on the boundary of the protected process: what was said inside the statutory meeting as against what the records independently show. A monitoring layer now sits above the statute: providers report their compliance under the National Open Disclosure Framework, and the Department of Health is to publish aggregated annual reports on open disclosure from 2026 onwards (gov.ie).

"An Act to provide for the mandatory open disclosure, by health services providers of certain incidents occurring in the course of the provision, to a person, of a health service; to provide, in the interest of the common good, for certain restrictions on the use of the information provided in such disclosures…"

— Long title, Patient Safety (Notifiable Incidents and Open Disclosure) Act 2023 (irishstatutebook.ie)

The line between this page and a claim decision is deliberate. This page explains the legislative framework and its protections. For what an open disclosure meeting means in practice after an incident, and how it interacts with a possible claim, see our medical negligence guides.

↑ Back to top

Frequently Asked Questions