Healthcare workers’ alleged biometric information “collected, used, and stored to access medications and medical supplies for patient health care treatment” is excluded from coverage under section 10 of Illinois’ Biometric Information Privacy Act (BIPA), a unanimous Illinois Supreme Court has ruled in a highly anticipated decision. Mosby v. The Ingalls Memorial Hospital, 2023 IL 129081 (Nov. 30, 2023).

The opinion was in response to two nearly identical certified questions from the Illinois Appellate Court on the use of “or” in section 10 of the BIPA. The section states, in relevant part: “[b]iometric identifiers do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under [HIPAA].” (Emphasis added.)

The Illinois Supreme Court was asked to determine whether the language following “or” in section 10 refers exclusively to a patient’s biometric information or includes a healthcare worker’s biometric information when allegedly used to access patient medication dispensing systems in connection with patient care.

Background

Lucille Mosby, a registered nurse employed by Ingalls Memorial Hospital, brought claims on behalf of a putative class of individuals who allegedly scanned their fingers to access a medication dispensing system in connection with patient treatment. Mosby alleged that her purported biometric information was unlawfully collected, used, or stored without complying with BIPA’s notice and consent provisions and disclosed to third parties in violation of BIPA.

Mosby was later consolidated with Mazya v. Northwestern Lake Forest Hospital, which involved similar claims brought by Yana Mazya, a registered nurse, on behalf of herself and a putative class.

The defendants in both actions filed motions to dismiss, arguing the alleged biometric information at issue was excluded under the healthcare exemption under section 10 of the BIPA. In both cases, the circuit courts denied the motions and ruled the exemption applies only to patient information.

On appeal, the Illinois Appellate Court agreed. It found that only patients’ biometric information was excluded under the healthcare exemption in section 10 of the BIPA and that section 10 did not extend to biometric information collected by a healthcare provider from workers when they accessed medicine dispensing systems. Presiding Justice Mary L. Mikva dissented, asserting the exclusion under section 10 extends to biometric information collected from healthcare workers by their employers when that information is collected, used, or stored for healthcare treatment, payment, or operations.

Exemption Applies

In an opinion drafted by Justice David K. Overstreet, the Illinois Supreme Court agreed with the defendants and Presiding Justice Mikva’s dissent that the second portion of the healthcare exemption in section 10 excludes biometric information used for the particular purposes of “health care treatment, payment, or operations[,]” regardless of the information’s source.

Focusing on the construction of section 10 of BIPA, the Illinois Supreme Court concluded that, because the plaintiffs’ alleged biometric information was “collected, used, and stored to access medication and medical supplies for patient health care treatment,” it is excluded from coverage under BIPA. Accordingly, the decision of the Illinois Appellate Court was reversed, and the certified questions were answered in the affirmative.