A state appeals panel has determined Illinois hospitals and other health care companies can’t use a federal health care law to shield themselves from the rising tide of class action lawsuits brought by employees under Illinois' biometrics privacy law.
The First District Appellate Court issued an opinion Feb. 25 to address appeals presenting nearly identical certified questions in two class action lawsuits involving several medical organizations: Ingalls Memorial Hospital; UCM Community Health & Hospital Division; Becton Dickinson and Co.; Northwestern Lake Forest Hospital; and Northwestern Memorial Healthcare.
Justice Sharon Oden Johnson wrote the panel’s opinion, issued Feb. 25; Justices Sheldon Harris and Mary Mikva concurred.
According to the panel, the questions center on whether the Illinois Biometric Information Privacy Act’s exclusion for “information collected, used or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996” applies to the personal data of health care workers when such data is used for providing health care treatment.
The plaintiffs in both actions had to scan their fingerprints to verify their identities to access medication dispensing systems at work. They accused their employers of violating BIPA in various ways. They asserted the companies failed to give employees written notification of their data collection policies; failed to collect written consent from employees; and failed to provide data retention and destruction guidelines, before requiring the workers to scan their fingerprints when accessing the medicine lockers.
The hospitals and health care companies were among thousands of Illinois employers targeted by class action lawsuits under the Illinois BIPA law. To date, employers have found few defenses against the law, which plaintiffs' lawyers have wielded to extract a mounting number of multi-million dollar settlements.
The hospitals are seeking some measure of protection, faced with the prospect of payouts of $1,000-$5,000 per violation. As courts have interpreted the law to define individual violations as each time a worker scans their fingerprint, hospitals, who employ thousands of workers who regularly scan their fingerprints multiple times per day, could be faced with potentially massive liability, should such class actions go to trial.
The defendants argued HIPAA should be read to allow health care providers to collect biometric information from workers, when they are scanning their fingerprints to provide treatment to patients.
Northwestern, along with organizations that supplied amicus briefs — the Illinois Health and Hospital Association and Amita Health — noted the “medication dispensing system also acts to provide an audit trail," to help detect fraud, diversion of medications, and potential drug abuse. The hospitals also said the biometric security system “aids in patient safety, quality of care and accurate billing.”
Northwestern further argued Cook County Circuit Court Judge Alison Conlon was wrong to rule BIPA carveouts for health information apply only to data taken from patients, saying the law’s plain language doesn’t include those limits. The plaintiffs countered by saying HIPAA already protects patient data, and that taking the employers’ framing “would in effect leave thousands of hospital workers unprotected from the risks” lawmakers enacted BIPA to protect, Johnson wrote.
The panel said BIPA’s language is clear, and that the only exclusions are patient data and information already protected under HIPAA.
“At oral argument, Northwestern argued that this court should not consider the terminology ‘under HIPAA’ and instead we should consider this as ‘defined by HIPAA.’ However, ‘under HIPAA’ is what (BIPA) expressly states, and that cannot be ignored," Johnson wrote. "We are simply unable to rewrite the statute.”
Lawmakers, the panel continued, could’ve drafted exemptions for hospitals the same way it did for financial institutions, which it did by expressly providing BIPA doesn’t apply to any business subject to Title V of 1999’s federal Gramm-Leach Bliely Act. BIPA also includes an exemption for employees, contractors and subcontractors of state and local government bodies.
“No rule of construction permits this court to declare that the legislature did not mean what the plain language of the statute imports,” Johnson wrote. “There is simply no provision or reference to the protection of employee biometric data in (BIPA) or in HIPAA. Thus, we will not add employee biometric data as information to be excluded by (BIPA) because it would be contrary to the plain language of (BIPA).”
With the certified questions answered, the panel sent the case back to Cook County Circuit Court for further proceedings.
Ingalls Memorial Hospital, UCM Community Health and Becton, Dickinson & Co. are represented by attorneys Joseph A. Strubbe, Frederic T. Knape, and Zachary J. Watters, of Vedder Price; and Gary M. Miller, Matthew C. Wolfe, and Elisabeth A. Hutchinson, of Shook, Hardy & Bacon, both of Chicago.
Joel Griswold and Bonnie Keane DelGobbo, of the firm of Baker & Hostetler, of Chicago, are representing the Northwestern defendants.
Representing the workers are attorneys James B. Zouras, Ryan F. Stephan, Andrew C. Ficzko, Catherine T. Mitchell, and Paige L. Smith, from the Chicago firm of Stephan Zouras.
Attorneys who represented the Illinois Health and Hospital Association and Amita Health in the amicus brief includes Michael Woods, of Naperville; Richard H. Tilghman, of Nixon Peabody; and DelGobbo and Griswold, of Baker & Hostetler, all of Chicago.