Illinois Supreme Court rules health care employee fingerprint data exempt from BIPA

This is the first victory for a defendant facing an Illinois Biometric Information Privacy Act (BIPA) lawsuit before the Illinois Supreme Court. Mosby v. Ingalls Memorial Hospital It is argued that BIPA excludes from its scope the biometric information of health care workers that is collected, used or stored for health care treatment, payment or operations.

Key components of BIPA

BIPA is a law that applies to all industry sectors. It requires private entities that obtain biometric information or identifiers to first inform the subject in writing that their information is being collected and stored, inform the subject of the specific purpose and period of collection and storage, and obtain A written statement of the subject. BIPA also prohibits the disclosure of biometric information without the subject’s consent.

Private entities also cannot sell, lease, trade or profit from an individual’s biometric information. Additionally, BIPA requires private entities that possess biometric identifiers and information to develop publicly available written policies, establish retention schedules, and provide guidelines for the permanent destruction of the information.

Anyone harmed by a BIPA violation may sue for statutory damages of $1,000 for each negligent violation or $5,000 for each intentional or reckless violation, plus reasonable Attorney’s fees and other costs. To establish standing, actual harm is not required, mere procedural breaches are sufficient.

health care exemption

BIPA makes some provisions for what is not considered a “biometric identifier” in the regulations. Among other things, “[b]Biometric identifiers do not include information captured from patients in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996 [HIPAA]”. 740 ILCS 14/10.

Case background

exist mosbyThe plaintiff, a registered nurse at Ingalls Memorial Hospital, claimed that the dispensing cabinet she used was equipped with a fingerprint scanner. The use of these cabinets has increased in recent years to curb the theft or diversion of medications and ensure medications are dispensed to the correct patient.

The complaint alleges that the hospital violated BIPA by using a medicine cabinet scanning device to collect, use and/or store the plaintiff’s fingerprint scan data without first obtaining the plaintiff’s identity without complying with BIPA’s notice and consent provisions. Disclosure of its so-called biometric data to third parties. her written consent.

The pharmacy cabinet manufacturer filed a motion to dismiss, arguing that the complaint should be dismissed because (1) the biometric data collected, used and/or stored limited access to protected health information and medications, and (2) the data was used to comply with HIPAA Healthcare Treatments and Procedures.

Illinois Circuit Court Holds BIPA Health Care Exception Only Applies to patient HIPAA Protected Information. Furthermore, the lower court held that “if the Legislature had intended to exempt health care employees entirely, it would have expressly done so.” Accordingly, the court denied the motion to dismiss.

Likewise, a registered nurse at Lake Forest Hospital sued her employer and the manufacturer of the pharmacy cabinet, making similar claims related to the pharmacy cabinet. The circuit court in that case also held that the exclusion only applied to patient information. The appeal was consolidated with plaintiff Mosby’s case in the Illinois Court of Appeals.

The Illinois Court of Appeals also held that the health care exclusion applies only to patient information. The court granted the defendants’ request to appeal to the Illinois Supreme Court.

Supreme Court opinion

The Illinois Supreme Court sought to answer whether the exception “referred only to the patient’s biometric information, or did it include the biometric information used to obtain the patient’s medication and provide the patient’s care.”

In overturning the Court of Appeal’s decision, the Supreme Court held: “[p]Under its plain and simple language, the bill excludes from protection biometric information of health care workers because the information is collected, used or stored for health care treatment, payment or operations, functions as defined by HIPAA. “

However, the court did warn that “[it was] The language at issue was not interpreted as a broad, explicit exclusion of biometric identifiers obtained from health care workers. ” This exception only applies “if the complaint alleges that the nurse’s biometric information was collected, used and stored to obtain medications and medical supplies needed for the patient’s health care treatment.” “

How we can help

If you have questions about the application of BIPA and the health care exception to information collected by your organization, please contact the author of this article or your usual Morgan Lewis contact. The Morgan Lewis team has an extensive background not only advising clients on BIPA compliance across all industries, including healthcare, but also litigating and trying cases in state and federal courts.

#Illinois #Supreme #Court #rules #health #care #employee #fingerprint #data #exempt #BIPA
Image Source :

Leave a Comment