{"id":986,"date":"2023-12-05T16:17:14","date_gmt":"2023-12-05T20:17:14","guid":{"rendered":"https:\/\/blogs.duanemorris.com\/classactiondefense\/?p=986"},"modified":"2023-12-05T16:17:14","modified_gmt":"2023-12-05T20:17:14","slug":"illinois-supreme-court-endorses-broad-interpretation-of-the-bipas-health-care-exception","status":"publish","type":"post","link":"https:\/\/blogs.duanemorris.com\/classactiondefense\/2023\/12\/05\/illinois-supreme-court-endorses-broad-interpretation-of-the-bipas-health-care-exception\/","title":{"rendered":"Illinois Supreme Court Endorses Broad Interpretation Of The BIPA\u2019s \u201cHealth Care Exception\u201d"},"content":{"rendered":"

\"\"<\/a>By Gerald L. Maatman, Jr. and Tyler Zmick<\/p>\n

Duane Morris Takeaways:\u00a0\u00a0<\/em><\/strong>In the latest ruling in the biometric privacy class action space, the Illinois Supreme Court embraced a broad reading<\/a><\/em>\u00a0of the \u201chealth care exception\u201d\u00a0in the Illinois Biometric Information Privacy Act (\u201cBIPA\u201d) in\u00a0Mosby v. Ingalls Memorial Hospital, 2023 IL 129081 (Ill. Nov. 30, 2023).\u00a0 The Illinois Supreme Court held that the statute excludes from its scope data collected in two separate and distinct scenarios: (1) \u201cinformation captured from a patient in a health care setting\u201d; and (2) information collected \u201cfor health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA).\u201d\u00a0 Unlike clause (1), the Supreme Court held that the exception in clause (2) is not limited to data obtained from patients<\/strong> and serves to exclude information that originates from any source.<\/em><\/p>\n

The Mosby ruling is welcome news to BIPA defendants and companies operating in the health care space.\u00a0 In the wake of the decision, courts likely will be asked to define the exact contours of the BIPA\u2019s broadened \u201chealth care exception\u201d in cases presenting facts that are less obviously tied to health care treatment, payment, or operations compared to the facts at issue in Mosby.<\/em><\/p>\n

Case Background <\/strong><\/p>\n

The Plaintiffs in Mosby<\/em> were nurses who claimed that their hospital-employers required them to use a fingerprint-based medication-dispensing system to verify their identities.\u00a0 Plaintiffs sued their employers and the company that distributed the medication-dispensing system, alleging that Defendants violated \u00a7\u00a7 15(a), 15(b), and 15(d) of the BIPA by using the medical-station scanning device to collect, use, and\/or store their \u201cfinger-scan data\u201d without complying with the BIPA\u2019s notice-and-consent requirements and by disclosing their purported biometric data to third parties without first obtaining their consent.<\/p>\n

Defendants moved to dismiss in the trial court, arguing that the claims failed because Plaintiffs\u2019 data was specifically excluded from the BIPA\u2019s scope under \u00a7 10 of the statute, which states that \u201c[b]iometric identifiers do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under [the HIPAA].\u201d\u00a0 740 ILCS 14\/10.\u00a0 Defendants argued that the latter clause applied in that Plaintiffs\u2019 fingerprints had been used in connection with Plaintiffs providing medicine to patients, meaning their fingerprints were \u201ccollected, used, or stored for health care treatment, payment, or operations under [the HIPAA].\u201d\u00a0 Id.<\/em><\/p>\n

The trial court denied Defendants\u2019 motions. It ruled that \u00a7 10\u2019s \u201chealth care exception\u201d was limited to patient information<\/em><\/strong> protected under the HIPAA and that the exclusion does not extend to information collected from health care workers.<\/p>\n

On appeal, the First District of the Illinois Appellate Court affirmed the denial of Defendants\u2019 motions to dismiss.\u00a0 Echoing the trial court, the Appellate Court determined that the biometric data of health care workers is not excluded from the BIPA\u2019s scope and that the relevant provision of \u00a7 10 excluded from the BIPA\u2019s protections \u201conly patient biometric information.\u201d\u00a0 Mosby<\/em>, 2023 IL 129081, \u00b6 16; see id. <\/em>\u00b6 17 (\u201c[T]he appellate court held that \u2018the plain language of the statute does not exclude employee information from the [BIPA\u2019s] protections because they are neither (1) patients nor (2) protected under HIPAA.\u2019\u201d) (citation omitted).<\/p>\n

Appellate Court Judge Mikva dissented from the majority\u2019s opinion.\u00a0 Judge Mikva opined that the legislature meant to exclude from the BIPA\u2019s scope the biometric data of health care workers \u201cwhere that information is collected, used, or stored for health care treatment, payment, or operations, as those functions are defined by the HIPAA.\u201d\u00a0 Id.<\/em> \u00b6 19 (citation omitted).\u00a0 Judge Mikva expressed the view that the first part of \u00a7 10\u2019s \u201chealth care exception\u201d excludes from the BIPA\u2019s coverage information from a particular source (i.e.<\/em>, patients in a health care setting) and that the second part excludes information used for particular purposes (i.e.<\/em>, health care treatment, payment, or operations), regardless of the source of that information.<\/p>\n

The Illinois Supreme Court\u2019s Decision <\/strong><\/p>\n

On further appeal, the Illinois Supreme Court agreed with Appellate Court Judge Mikva\u2019s dissent, unanimously holding that the BIPA\u2019s exclusion for \u201cinformation collected, used, or stored for health care treatment, payment, or operations under [the HIPAA]\u201d can apply to the biometric data of health care workers (not only patients).<\/p>\n

The Supreme Court determined that the relevant sentence of \u00a7 10 excludes from the definition of \u201cbiometric identifier\u201d data that may be collected in two distinct (rather than overlapping) scenarios \u2013 namely, biometric identifiers do not include (i) information captured from a patient in a health care setting or (ii) information collected, used, or stored for health care treatment, payment, or operations under HIPAA.\u00a0 Id.<\/em> \u00b6 37 (\u201c[T]he phrase prior to the \u2018or\u2019 and the phrase following the \u2018or\u2019 connotes two different alternatives.\u00a0 The Illinois legislature used the disjunctive \u2018or\u2019 to separate the [BIPA\u2019s] reference to \u2018information captured from a patient in a health care setting\u2019 from \u2018information collected, used, or stored for health care treatment, payment, or operations under [the HIPAA].\u2019\u00a0 Pursuant to its plain language, information is exempt from the [BIPA] if it satisfies either statutory criterion.\u201d) (internal citations omitted).<\/p>\n

The Supreme Court agreed with Defendants that the two categories of information are different because information excluded under the first clause originates from the patient, whereas information excluded under the second clause may originate from any source.\u00a0 Regarding the second clause, the Supreme Court observed that the Illinois legislature borrowed the phrase \u201chealth care treatment, payment, and operations\u201d from the federal HIPAA regulations.\u00a0 Accordingly, the Supreme Court determined that \u201cthe legislature was directing readers to the HIPAA to discern the meaning of those terms,\u201d which meanings \u201crelate to activities performed by the health care provider \u2013 not by the patient.\u201d\u00a0 Id.<\/em> \u00b6 52.<\/p>\n

Thus, the Supreme Court held that a health care worker\u2019s data used to permit access to medication-dispensing stations for patient care qualifies as \u201cinformation collected, used, or stored for health care treatment, payment, or operations under [the HIPAA]\u201d and is exempt from the statute\u2019s scope.<\/p>\n

Implications Of The Decision<\/strong><\/p>\n

After the recent slew of plaintiff-friendly BIPA decisions issued by both state and federal courts, the Illinois Supreme Court\u2019s decision in Mosby<\/em> comes as welcome news for companies facing privacy-related class actions \u2013 particularly those operating in the health care space.<\/p>\n

Relying on Mosby<\/em>, defendants will likely add the BIPA\u2019s \u201chealth care exception\u201d to their arsenal of defenses in a wider array of cases moving forward.\u00a0 Importantly, for purposes of the second \u201cHIPAA prong\u201d of the statute\u2019s \u201chealth care exception,\u201d federal HIPAA regulations govern the definitions of the terms \u201chealth care treatment,\u201d \u201cpayment,\u201d and \u201coperations.\u201d\u00a0 Given that the regulatory definitions of those terms are broad, see<\/em> 45 C.F.R. \u00a7 160.103; id.<\/em> \u00a7 164.501, defendants will likely test the breadth of the exception in future cases presenting facts that may be less obviously tied to health care treatment, health care payment, and\/or health care operations compared to the facts at issue in Mosby<\/em>.<\/p>\n","protected":false},"excerpt":{"rendered":"

By Gerald L. Maatman, Jr. and Tyler Zmick Duane Morris Takeaways:\u00a0\u00a0In the latest ruling in the biometric privacy class action space, the Illinois Supreme Court embraced a broad reading\u00a0of the \u201chealth care exception\u201d\u00a0in the Illinois Biometric Information Privacy Act (\u201cBIPA\u201d) in\u00a0Mosby v. Ingalls Memorial Hospital, 2023 IL 129081 (Ill. Nov. 30, 2023).\u00a0 The Illinois Supreme … <\/p>\n

Continue reading “Illinois Supreme Court Endorses Broad Interpretation Of The BIPA\u2019s \u201cHealth Care Exception\u201d”<\/span><\/a><\/p>\n","protected":false},"author":575,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[59],"tags":[],"ppma_author":[7,12],"class_list":["post-986","post","type-post","status-publish","format-standard","hentry","category-privacy-class-actions"],"authors":[{"term_id":7,"user_id":575,"is_guest":0,"slug":"gmaatman","display_name":"Gerald L. Maatman, Jr.","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2022\/09\/maatmangerald-100x100.jpg","author_category":"","last_name":"Maatman Jr.","first_name":"Gerald L.","job_title":"","user_url":"https:\/\/www.duanemorris.com\/attorneys\/geraldmaatman.html","description":"Read Gerald's bio.<\/a>"},{"term_id":12,"user_id":578,"is_guest":0,"slug":"tzzmick","display_name":"Tyler Z. Zmick","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2022\/09\/zmicktyler-100x100.jpg","author_category":"","last_name":"Zmick","first_name":"Tyler Z.","job_title":"","user_url":"","description":"Read Tyler's bio.<\/a>"}],"_links":{"self":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/986","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/users\/575"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/comments?post=986"}],"version-history":[{"count":0,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/986\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/media?parent=986"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/categories?post=986"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/tags?post=986"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/ppma_author?post=986"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}