Background
Debra Townsend, a nurse and former employee of Estates of Hyde Park, filed a putative class action alleging violations of Illinois’s Biometric Information Privacy Act (BIPA). She alleged that the Cook County rehabilitation and long-term-care facility required employees to submit hand scans to clock in and out, did not provide required retention and destruction information, and disclosed hand-scan data to a third-party vendor.
The facility sought judgment on the pleadings, arguing that the hand scans fell outside BIPA because its payroll-based records were submitted to state and federal regulators and therefore constituted HIPAA “health care operations.” The circuit court denied that motion but certified the legal question for interlocutory review under Illinois Supreme Court Rule 308.
The Court’s Holding
The appellate court answered the certified question no. Employee hand scans collected through a timekeeping system are not information collected, used, or stored for HIPAA health care treatment, payment, or operations, and thus are not excluded from BIPA’s definition of a biometric identifier.
HIPAA health care operations must relate to covered functions—functions that make an entity a health care provider, plan, or clearinghouse. Payroll and timekeeping are support functions, not covered functions, even if they help a provider comply with reporting requirements. The court distinguished Mosby v. Ingalls Memorial Hospital, where nurses’ fingerprints were used to access patient medications, and emphasized that Mosby rejected a blanket exemption for health-care workers’ biometrics. The court remanded for further proceedings and did not decide the underlying motion for judgment on the pleadings.
Key Takeaways
- Biometric hand scans used solely for employee clock-in and clock-out remain subject to BIPA.
- Healthcare employers cannot invoke HIPAA’s operations exception merely because payroll data may be reported to regulators.
- The BIPA exception is narrow and does not create an industry-wide exemption for healthcare employees.
Why It Matters
The decision limits healthcare employers’ ability to treat ordinary workforce-management biometrics as HIPAA-regulated operations. It preserves BIPA protections for employee timekeeping systems unless the biometric collection is actually tied to HIPAA-defined treatment, payment, or operations.