There is actually more than one law covering whistleblowers, so the other answer is only partially correct. According to the NYT, the case in question here is also covered by the Inspector General Act of 1978
Do whistle-blowers have a right to remain anonymous?
Only in a limited way. Another part of the Inspector General Act says that agency watchdogs “shall not, after receipt of a complaint or information from an employee, disclose the identity of the employee without the consent of the employee, unless the inspector general determines such disclosure is unavoidable.”
In line with that law, the inspector general for the intelligence community, Michael Atkinson, did not include the whistle-blower’s name in his report to the acting director of national intelligence, Joseph Maguire. Mr. Maguire testified last week that he did not know the name of the person [...]
But the legal prohibition on disclosing the official’s name applies only to Mr. Atkinson. It does not bar Mr. Trump and his allies from trying to identify him or disclosing his name if they figure it out. (It would be illegal under the Intelligence Identities Protection Act for any official to disclose his name if he is a covert agent, but no one has suggested that he is.)
The same information can be found in an OIG FAQ
Q: Will OIG reveal employee identities or the fact that they cooperated?
A: OIG investigators will respect the confidentiality of Department employees as provided by law. Section 7 of the Inspector General Act states that “[t]he Inspector General shall not, after receipt of a complaint or information from an employee, disclose the identity of the employee without the consent of the employee, unless the Inspector General determines such disclosure is unavoidable during the course of the investigation.” During the course of some investigations, it may be unavoidable that the identities of individuals involved will become known. However, OIG strives to protect the confidentiality of Department employees who provide OIG with information. In addition, employees should be aware that reprisal against any employee for cooperating with OIG is forbidden by the Inspector General Act and DAO 207-10, Section 4. Further, OIG takes whistleblower protection very seriously and, along with the U.S. Office of Special Counsel, investigates alleged reprisals against employees for making protected disclosures to OIG.
So Paul's spokesperson seems to be correct.