An Illinois appellate court has determined that a nursing home’s use of hand scans for employee timekeeping falls under the purview of the state’s Biometric Information Privacy Act (BIPA). The court concluded that such data does not qualify for the healthcare exemption outlined in the statute.
The case centers on the Estates of Hyde Park, a Chicago-based nursing facility that implemented a biometric system requiring employees to scan their hands for payroll purposes. The facility argued that this practice was exempt from BIPA under the provision for information collected, used, or stored for healthcare treatment, payment, or operations as defined by the Health Insurance Portability and Accountability Act (HIPAA). However, the appellate court rejected this argument, stating that the exemption does not extend to employee biometric data used for timekeeping. ([news.bloomberglaw.com](https://news.bloomberglaw.com/litigation/illinois-nursing-homes-worker-handscans-covered-by-privacy-law?utm_source=openai))
This ruling aligns with previous decisions that have clarified the scope of BIPA’s healthcare exemption. In December 2023, the Illinois Supreme Court held in Mosby v. The Ingalls Memorial Hospital that certain biometric data collected from healthcare providers for operational purposes under HIPAA is exempt from BIPA protections. The court emphasized that the exemption applies to information collected for healthcare treatment, payment, or operations, regardless of whether the source is a patient or a healthcare provider. ([mcguirewoods.com](https://www.mcguirewoods.com/client-resources/alerts/2023/12/illinois-supreme-court-certain-collected-biometric-data-is-exempt-from-bipa-protections/?utm_source=openai))
However, the recent appellate decision underscores that this exemption does not provide a blanket exclusion for all biometric data collected within healthcare settings. Specifically, biometric data collected from employees for purposes unrelated to patient care, such as timekeeping, remains subject to BIPA’s requirements. This distinction highlights the importance for healthcare employers to carefully assess the applicability of BIPA to their biometric data collection practices.
Employers in the healthcare sector should take note of this ruling and ensure compliance with BIPA when implementing biometric systems for employee management. This includes providing proper notice, obtaining informed consent, and adhering to data retention and destruction policies as mandated by the statute. Failure to comply with BIPA can result in significant legal and financial repercussions, as evidenced by numerous class action lawsuits filed against employers for alleged violations of the act. ([stopspying.org](https://www.stopspying.org/bipa-litigation-tracker?utm_source=openai))
As courts continue to interpret the boundaries of BIPA’s exemptions, healthcare organizations must remain vigilant and proactive in their compliance efforts to mitigate potential liabilities associated with the use of biometric technologies in the workplace.