On November 30, 2023, in a unanimous decision, the Illinois Supreme Court issued its decision in the consolidated cases Mosby v. Ingalls Memorial Hospital, et al., and Mazya v. Northwestern Memorial Health Care, No 2023 IL 129081 holding that “[BIPA] excludes from its protections the biometric information of health care workers where that information is collected, used, or stored for health care treatment, payment, or operations, as those functions are defined by HIPAA.” Here are some key takeaways:

• The plaintiffs were health care workers using finger scans to access medical supply stations to administer prescription medication to patients and provide patient care.
• At issue was whether Section 10 of BIPA, which excludes “information collected, used, or stored for health care treatment, payment, or operations under [HIPAA],” applied only to information collected from a patient or whether it also included health care worker information.
• This week’s Illinois Supreme Court opinion held that health care workers’ use of the medstation is within the information collected, used, or stored for health care treatment, payment, or operations under HIPAA and is exempt from BIPA.
• “Pursuant to its plain language, [BIPA] excludes from its protections the biometric information of health care workers where that information is collected, used, or stored for health care treatment, payment, or operations, as those functions are defined by HIPAA.”
• While stating that the decision did not include every individual working in a health care setting, left open is whether the use by health care workers of purported “biometric timeclocks” also falls under this exclusion as part of the “payment and operations” provisions of the exclusion.
• The decision will have a meaningful impact on alleged BIPA liability for hospitals using medical supply stations and their technology providers. In addition, we anticipate ongoing challenges by employers whose health care workers used timeclocks.

BIPA SETTLEMENTS

Technology provider settlements now average over $110. Class size continues to be determinative of dollar amount, with “smaller” classes (between 20,000 and 50,000 class members) inching into the $200-$300 range. Employer case settlements now average slightly over $1,000. BIPA employer group settlements (which we have gotten) have obtained the better current pricing with comparable class sizes and using a claims-made structure.

ILLINOIS GENETIC INFORMATION PRIVACY ACT (GIPA) LITIGATION SURGE

Last month, we launched a new sub-practice to address a recent surge in claims under GIPA. Since January 2023, almost 50 GIPA class actions have been filed. Employers who give pre-employment and ongoing physicals to employees in Illinois should be aware of this litigation. Here is some information about the claims:

• Most GIPA class actions are template claims that employers requested an employee/applicant’s family genetic history as part of a pre-employment physical.
• Employers who are conducting legitimate post-offer, pre-employment, and ongoing employee physicals are getting sued under GIPA, often based on a third-party provider request for background medical history.
• Like BIPA lawsuits, there is no actual harm, and Plaintiffs claim to be aggrieved and entitled to statutory damages simply because they were asked questions about family medical history. Whether that is actually the case remains to be seen, as most cases are only in the initial stages.
• We have been retained in several GIPA class actions and are well-prepared to defend additional clients in these matters.