On November 30, 2023, the Illinois Supreme Court issued a much-anticipated decision in Mosby v. The Ingalls Memorial Hospital, answering a certified question about whether biometric information collected from health care workers is protected by the Illinois Biometric Information Privacy Act (BIPA) if that information is used for purposes related to health care treatment, payment, or operations under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The Court ruled that when health care worker data is collected for purposes of health care treatment, payment, or operations under HIPAA, the information is excluded from protection under BIPA.

            Mosby involved a putative class action claim brought by nurses whose biometric information allegedly was collected to identify them before dispensing medication to patients.  The trial court and Illinois Appellate Court had ruled that these collections were covered by BIPA because BIPA’s exclusions for “health care treatment, payment, or operations under HIPAA” were directed at protecting patient data, not health care worker data.

            Under BIPA, the relevant exception is: “Biometric identifiers do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996.” Applying various principles of statutory construction, the Court noted that the use of the word “information” at the beginning of both phrases, separated by the disjunctive “or,” indicated legislative intent to exclude two different categories of information, suggesting that the second phrase was not limited to patient data.

The Court further concluded that the phrase “under HIPAA” defined what was meant by “health care treatment, payment, or operations” and that each of those terms “relates to activities performed by the health care provider—not by the patient.” Thus, the exclusion for information collected for “health care treatment, payment, or operations under HIPAA” was not limited to biometric information collected from patients.

            Nonetheless, the Court went on to clarify that it was not creating “a broad, categorical exclusion of biometric identifiers taken from health care workers,” but was excluding that information from BIPA’s scope only when collected for health care treatment, payment, or operations under HIPAA. How far lower courts will extend the Mosby decision will be subject to future debate, including in what other contexts—outside of dispensing medication to patients—this exclusion will apply to health care-worker biometric data.