BIPA's Health Care Exemption After Mosby v. Ingalls Memorial

What Section 10 Excludes

The Illinois Biometric Information Privacy Act defines a biometric identifier as a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. Most of the definition in 740 ILCS 14/10 is spent taking things back out of it.

The section states that biometric identifiers do not include writing samples, written signatures, photographs, human biological samples used for valid scientific testing or screening, demographic data, tattoo descriptions, or physical descriptions such as height, weight, hair color or eye color. Four further exclusions follow, each in its own sentence: donated organs, tissues or parts as defined in the Illinois Anatomical Gift Act, together with blood or serum stored on behalf of transplant recipients and obtained or stored by a federally designated organ procurement agency; biological materials regulated under the Genetic Information Privacy Act; the health care language discussed below; and an X-ray, roentgen process, computed tomography, MRI, PET scan, mammography or other image or film of the human anatomy used to diagnose, prognose or treat an illness or other medical condition, or to further validate scientific testing or screening.

The exclusions carry through to the Act's second defined term. “Biometric information” means information based on an individual's biometric identifier and used to identify an individual, and the definition adds that it does not include information derived from items or procedures excluded under the definition of biometric identifiers. Separately, section 25(b) provides that nothing in the Act shall be construed to conflict with HIPAA and the rules promulgated under it.

The Text of the Health Care Exemption

The sentence at issue reads: biometric identifiers do not include “information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under [HIPAA].”

Three textual features carried the litigation. The clauses are joined by a disjunctive or. The word “information” appears at the start of each. And the two clauses use different prepositions: the first describes information captured from a patient, the second information collected, used or stored for a set of purposes.

Neither clause was amended in 2024. Public Act 103-0769, the legislature's response to per-scan accrual, reopened section 10 to add a definition of “electronic signature” and left the health care language as written.

Mosby v. Ingalls Memorial

Lucille Mosby, a registered nurse at Ingalls Memorial Hospital, brought a class action alleging that she scanned her finger on a medication dispensing system distributed by Becton, Dickinson and Company in order to authenticate her identity and access controlled and restricted material for patient care. She alleged violations of section 15(a), (b) and (d). Yana Mazya, a registered nurse at Northwestern Lake Forest Hospital, brought a parallel action alleging that Northwestern required fingerprint scans to access medication dispensing systems and stored materials.

Both circuit court judges held that the section 10 exclusion reaches only patient information, and both certified the question for interlocutory appeal under Supreme Court Rule 308. The appellate court consolidated the appeals and answered in the negative, holding that employee biometric information is “neither (1) patients nor (2) protected under HIPAA” and so is not excluded. Presiding Justice Mikva dissented, arguing that the first clause excludes information from a particular source and the second excludes information used for particular purposes regardless of source.

In Mosby v. Ingalls Memorial Hospital, 2023 IL 129081, decided November 30, 2023, the Illinois Supreme Court answered the certified questions in the affirmative, reversed and remanded. Justice Overstreet delivered the opinion; the remaining six justices concurred.

Information Collected From Health Care Workers

The court's reasoning ran through the sentence's grammar. Because “or” is disjunctive, the clause before it and the clause after it “connote[] two different alternatives,” and information is exempt if it satisfies either criterion. The repetition of “information” pointed the same way: by using the word twice, the legislature indicated that each clause exempts a different category, and the second clause does not contain the word “patient.”

That left the appellate court's explanation for why both clauses could nonetheless mean patient data. The appellate court had distinguished information “captured” from information “collected, used or stored.” The supreme court rejected the distinction on dictionary grounds, treating “capture” and “collect” as synonymous and concluding that the distinction therefore did not cure the redundancy problem it was offered to solve.

The parties also disputed the preposition “under.” The appellate court had read it as “covered” or “protected” by HIPAA, which yields patient data because employee biometrics are not protected health information. The supreme court adopted the competing sense, “subject to the authority, control, guidance, or instruction of,” observing that HIPAA is not a physical location or attribute and that the reading which treats it as one makes little sense in context.

Both sides pressed canons of construction. The series-qualifier canon, drawn from Facebook, Inc. v. Duguid, would apply “under [HIPAA]” to all three nouns in “health care treatment, payment, or operations.” The nearest-reasonable-referent canon, also called the last antecedent rule, would attach the qualifier to the phrase immediately preceding it rather than to the more remote “information collected, used, or stored.” The court noted that both canons are limited by context and resolved the question on a different footing: “treatment, payment, and operations” is a phrase the legislature borrowed from HIPAA's regulations, which use it repeatedly, and the decision to follow it immediately with “under [HIPAA]” directs readers to HIPAA to discern what those terms mean. The opinion adds that the General Assembly has borrowed the same definitions elsewhere using the same phrase, citing the Illinois Clinical Laboratory and Blood Bank Act.

The holding follows from that: the Act excludes the biometric information of health care workers where that information is collected, used or stored for health care treatment, payment or operations as those functions are defined by HIPAA. On the allegations before it, a nurse's finger-scan data used to permit access to medication dispensing stations for patient care fell within the second clause.

What the Exemption Does Not Reach

The opinion draws its own boundary. “We are not construing the language at issue as a broad, categorical exclusion of biometric identifiers taken from health care workers,” the court wrote before stating its holding on the facts alleged. The exclusion turns on the purpose the information serves, and that purpose is fixed by regulatory definitions rather than by the Act.

Those definitions are narrower than the industry. Under 45 C.F.R. § 160.103, “health care” means care, services or supplies related to the health of an individual, including the sale or dispensing of a drug, device, equipment or other item in accordance with a prescription. Under 45 C.F.R. § 164.501, “treatment” means the provision, coordination or management of health care and related services by one or more health care providers; “payment” covers activities undertaken to obtain or provide reimbursement for the provision of health care; and “health care operations” is a defined list that includes quality assessment and improvement activities, reviewing the competence or qualifications of health care professionals, and conducting or arranging for medical review and auditing functions.

The structural argument the plaintiffs made was that a sector exemption would have been placed in section 25, where the Act's categorical exclusions live: financial institutions subject to Title V of the Gramm-Leach-Bliley Act, and contractors, subcontractors and agents of a State agency or local unit of government. The court did not create one. The health care language stays inside the definition of “biometric identifier,” which is where a purpose-based limit rather than an entity-based one belongs.

Open Questions After Mosby

Mosby answered two certified questions and remanded. Certified-question answers are bounded by the record that produced them, and the record here was medication dispensing cabinets used to access drugs and supplies for patient treatment. The opinion does not catalogue which other workforce systems in a hospital serve a purpose that the HIPAA definitions reach.

The three defined terms are not equally broad. “Treatment” and “payment” are tied closely to the provision of and reimbursement for care. “Health care operations” sweeps considerably wider, extending to quality assessment, credentialing, training programs, and fraud and abuse detection, each of which is capable of describing a system that has nothing to do with a medication cabinet.

The first clause is untouched by all of this. Information captured from a patient in a health care setting remains excluded on the basis of its source, and the second clause supplies an independent route to exclusion rather than a limit on the first.

Because the exclusion sits in a definition rather than in section 25, it operates claim by claim on the purpose for which particular data is collected, used or stored, not entity by entity. A single defendant may therefore stand in different positions as to different systems.

Frequently Asked Questions