On November 30, 2023, the Illinois Supreme Court in Mosby v. Ingalls Memorial Hospital, held that BIPA’s “health care exemption” is not limited to patients’ biometric information (such as fingerprint scans), but also extends to biometric information collected, used, or stored for health care treatment, payment, or operations — regardless of its source.
Section 10 of BIPA includes a list of exclusions to the definition of biometric information, which are exempt from BIPA’s requirements. Among other things, Section 10 excludes “information captured from a patient in a health care setting [OR] information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996.”
The Mosby decision arose from two separate BIPA complaints filed by registered nurses against health care providers and a distributor of a medication-dispensing system. The nurses alleged that they were required to scan their fingerprints to authenticate their identity in order to gain access to a medication-dispensing system that was used to provide medication to patients. The nurses further alleged that the defendants did not obtain the requisite consent under BIPA. Ingalls Memorial Hospital argued under Section 10 of BIPA, biometric information of health care employees used to access medication-dispensing systems fell under the definitions of “treatment” and “operations” under HIPAA, and therefore the collection of the plaintiffs’ fingerprints for this purpose was exempt under the health care exemption. The Illinois Supreme Court agreed.
The Illinois Supreme Court held that the plain language of the statute demonstrates that a patient’s biometric data is not the only category of information within the exemption. The health care workers’ biometric information, when used to access medication-dispensing stations for patient care, falls under the health care exemption and is not subject to BIPA’s requirements.
Importantly, the Illinois Supreme Court noted that it was not construing the health care exemption as broadly excluding all biometric information taken from health care workers. Although the Mosby decision represents a rare victory for BIPA defendants, companies should understand that it does not necessarily mean that all biometric information from health care workers is exempt from BIPA. Courts applying Mosby will likely focus on the particular purposes for which biometric information is collected and possessed.
Please consult with an attorney as to whether your business is required to comply with BIPA or falls within this limited exception.
