Rush University Hospital is one of the latest big employers in Chicago targeted by a class action lawsuit for allegedly violating Illinois' biometrics law.
The hospital allegedly required employees scan their fingerprint to access patient medications dispensed through lockers using the Pyxis system, says the suit, filed in Cook County Circuit Court.
"Within Rush Hospital there are multiple Pyxis devices," the suit states. "Once a worker has registered his or her fingerprint with the system, they have access to multiple Pyxis devices throughout the hospital."
However, the system exposes the workers to the risk of data breaches or identity theft, the lawsuit says.
"Unlike ID badges or key fobs - which can be changed or replaced if stolen or compromised - fingerprints are unique, permanent biometric identifiers associated with each worker," says the suit. "This exposes workers who are required to use Pyxis as a condition of their employment to
serious and irreversible privacy risks. information, namely their fingerprint, in order to access medications."
If the system is hacked, "workers have no means by which to prevent identity theft, unauthorized tracking or other unlawful
or improper use of this highly personal and private information," the lawsuit states.
The plaintiffs are represented by attorneys Ryan F. Stephan, James B. Zouras, Catherine Mitchell and Lauren A. Warwick, of the firm of Stephan Zouras LLP, of Chicago.
Corey Heard, the lead plaintiff in the case against Rush, has teamed up with the Stephan Zouras lawyers since 2019 on other BIPA-related class actions against hospitals and the Becton Dickinson company, the maker of the Pyxis medication dispensing system.