Mosby v. Ingalls Memorial Hospital

2022 IL App (1st) 200822SIXTH DIVISION
Filing Date February 25, 2022
Nos. 1-20-0822 and 1-21-0895, cons.
______________________________________________________________________________
IN THE
APPELLATE COURT OF ILLINOIS
FIRST JUDICIAL DISTRICT
______________________________________________________________________________
LUCILLE MOSBY, Individually, and on Behalf of All ) Appeal from the
Others Similarly Situated, ) Circuit Court of
) Cook County.
Plaintiff-Appellee, )
) No. 18 CH 05031
v. )
THE INGALLS MEMORIAL HOSPITAL, UCM ) The Honorable
COMMUNITY HEALTH & HOSPITAL DIVISION, ) Pamela McLean Meyerson,
INC., and BECTON, DICKINSON AND COMPANY, ) Judge, Presiding.
)
Defendants-Appellants).
YANA MAZYA, Individually, and on Behalf of All ) Appeal from the
Others Similarly Situated, ) Circuit Court of
) Cook County.
Plaintiff-Appellee, )
) No. 18 CH 71601
v. )
NORTHWESTERN LAKE FOREST HOSPITAL, ) The Honorable
NORTHWESTERN MEMORIAL HEALTHCARE, ) Alison C. Conlon,
OMNICELL, INC., and BECTON, DICKINSON AND ) Judge, Presiding.
COMPANY, )
Defendants
(Northwestern Lake Forest Hospital and Northwestern
Memorial Healthcare, Defendants-Appellants).
Nos. 1-20-0822 and 1-21-0895, cons.
JUSTICE ODEN JOHNSON delivered the judgment of the court, with opinion.
Justices Harris and Mikva concurred in the judgment and opinion.
OPINION
¶1 Plaintiff Lucille Mosby filed a class-action suit individually and on behalf of others
similarly situated against defendants Ingalls Memorial Hospital and UCM Community Health
& Hospital Division, Inc. (collectively Ingalls), and Becton, Dickinson and Company (BD)
(collectively group defendants one). Similarly, plaintiff Yana Mazya filed a class-action suit
individually and on behalf of others similarly situated against Northwestern Lake Forest
Hospital and Northwestern Memorial Healthcare (collectively group defendants two). During
the course of the litigation, group defendants one filed an interlocutory appeal pursuant to
Illinois Supreme Court Rule 308 (eff. Oct. 1, 2019) to have this court answer this certified
question:
“Whether the exclusion in Section 10 of BIPA for “information collected, used, or
stored for health care treatment, payment, or operations under the federal Health Insurance
Portability and Accountability Act of 1996” applies to biometric information of health care
workers (as opposed to patients) collected, used or stored for health care treatment,
payment or operations under HIPAA?”
¶2 Subsequently, group defendants two also filed an interlocutory appeal pursuant to Rule 308
concerning the same issue:
“Does finger-scan information collected by a health care provider from its employees
fall within the Biometric Information Privacy Act’s exclusion for ‘information collected,
used, or stored for health care treatment, payment or operations under the federal Health
Insurance Portability and Accountability Act of 1996,’ 740 ILCS 14/10, when the
-2-
Nos. 1-20-0822 and 1-21-0895, cons.
employee’s finger-scan information is used for purposes related to ‘healthcare,’
‘treatment,’ ‘payment,’ and/or ‘operations’ as those terms are defined by the HIPAA statute
and regulations?”
Both group defendants’ petitions for leave to appeal were permitted, as discussed in detail below.
However, at this time, the only question submitted for this court’s review is the question submitted
by group defendants two, and we answer the question in the negative.
¶3 I. BACKGROUND
¶4 A. Mosby
¶5 On April 18, 2018, Mosby filed a class-action complaint against Ingalls and BD seeking
redress for each defendant’s violations pursuant to section 15(a)-(d) of the Biometric
Information Privacy Act (Act) (740 ILCS 14/15(a)-(d) (West 2018)). Mosby worked as a
registered pediatrics nurse at Ingalls Memorial Hospital. As a condition of Mosby’s
employment, she was required to scan her fingerprint to authenticate her identity and gain
access to a medication dispensing system. Mosby alleged that defendants’ behavior exposed
employees like herself to serious irreversible privacy risks. Mosby alleged that defendants
violated the Act by (1) not informing her in writing of the specific purpose and the length of
time for which her fingerprints were being collected, stored, and used; (2) failing to provide a
publicly available retention schedule and guidelines for permanently destroying Mosby’s
fingerprints; (3) failing to obtain a written release from Mosby to collect, store, disseminate,
or otherwise use her fingerprint; and (4) failing to obtain consent before disclosing Mosby’s
fingerprints to third-party vendors that host the data.
¶6 On May 14, 2019, plaintiff filed an amended class-action complaint that was substantially
similar to the original.
-3-
Nos. 1-20-0822 and 1-21-0895, cons.
¶7 On June 5, 2019, defendants filed a motion to dismiss pursuant to section 2-619.1 (735
ILCS 5/2-619.1 (West 2018)) of the Code of Civil Procedure (Code) or to strike the amended
complaint. The motion argued that the complaint should be dismissed pursuant to section 2-
619(a)(9) (id. § 2-619(a)(9)) because (1) the biometric data that was collected, used, and/or
stored restricted access to protected health information and medication and (2) the data was
used for healthcare treatment and operations pursuant to the Health Insurance Portability and
Accountability Act of 1996 (HIPAA) (45 C.F.R. § 164.501 (2018)) and was thereby
specifically excluded from the scope of the Act. Defendants argued that, pursuant to section 2-
615 (735 ILCS 5/2-615 (West 2018)), Mosby failed to allege any well-pleaded facts regarding
any disclosures of her fingerprints.
¶8 On January 13, 2020, the circuit court ruled that the exception was limited as to the
information protected under HIPAA. To hold otherwise, the court noted, would result in a
broad exception for all employees involved in operations that impact patients protected by
HIPAA. The circuit court opined that, if the legislature intended to exempt employees entirely,
they would have expressly done so. The court denied defendants’ motion to dismiss based on
this issue. The circuit court dismissed BD from the complaint in its entirety, without prejudice,
and found that Mosby failed to state a claim as to how defendants disseminated her biometric
information. With authorization of the circuit court, Mosby amended her pleadings on
February 24, 2020, which realleged all of the claims contained in the previously dismissed
claim.
¶9 On March 16, 2020, defendants filed a joint motion to certify a question for interlocutory
appeal under Illinois Supreme Court Rule 308 (eff. Oct. 1, 2019) and stay proceedings.
Defendants argued that the question of whether employee information was also exempt under
-4-
Nos. 1-20-0822 and 1-21-0895, cons.
the Act was a question of first impression and has never been heard before this court.
Defendants argued that the question was one of statutory construction and there existed a
substantial ground for a difference of opinion, which made it appropriate to bring under Rule
308. Defendants maintained that raising the question would be beneficial in a variety of ways,
such as: (1) it would advance the outcome of the case with prejudice if the Act was interpreted
in their favor, (2) judicial economy would be served, and (3) the need for a uniform
construction and application of the law would be served. Defendants also requested a stay in
the circuit court proceedings because the determination could lead to a dismissal and Mosby
would not be prejudiced.
¶ 10 On April 20, 2020, Mosby filed a motion in opposition to defendants’ joint motion to
certify the question for interlocutory appeal, arguing that substantial grounds for difference of
opinion did not exist. Mosby maintained that to hold otherwise would mean that the General
Assembly intended to place anyone employed in the healthcare industry into an “unregulated
biometric abyss,” by having no biometric protections. Mosby argued that defendants did not
demonstrate that they faced any hardship or inequity to justify a stay that would outweigh the
prejudice she would suffer. Mosby maintained that the prejudice she would suffer if a stay was
granted was the denial of pursuing her claim in an expedient manner and, if successful, the
collection of damages. Mosby argued that defendants’ conduct was ongoing and continuous
and every day that passed would compound the injuries that they were inflicting.
¶ 11 On May 4, 2020, defendants filed a joint reply arguing that the proposed certified question
was tailored and limited to those circumstances where the biometric data collected from
healthcare workers were used for healthcare treatment, payment, or operations under HIPAA.
Defendants further argued that the circuit court did not entirely reject its argument and found
-5-
Nos. 1-20-0822 and 1-21-0895, cons.
it plausible but ultimately concluded that the General Assembly would have been more explicit
if the legislative intent was to exclude healthcare employees’ biometric data.
¶ 12 On June 18, 2020, the circuit court granted defendants’ motion to certify and stay the
proceedings. The circuit court ruled that the issue posed by defendants presented a question of
law where there was substantial ground for difference of opinion and could ultimately
determine whether or not the case should be dismissed.
¶ 13 On July 17, 2020, defendants filed an application for leave to appeal pursuant to Rule 308,
which we denied on August 24, 2020. Defendants filed a petition for leave to appeal with the
Illinois Supreme Court, on October 30, 2020. On March 3, 2021, the Illinois Supreme Court
issued a mandate vacating this court’s decision and ordered this court to hear the certified
question on appeal. On June 11, 2021, Ingalls filed an unopposed motion for extension of time
to file an opening brief, where they informed the circuit court that the parties reached a
settlement in principle. 1
¶ 14 B. Mazya
¶ 15 On April 10, 2019, Yana Mazya and Tiki Taylor filed an amended class-action complaint2
against Northwestern Lake Forest Hospital, Northwestern Memorial Healthcare, Northwestern
Memorial Hospital (collectively Northwestern), Omnicell Inc., and BD seeking redress for
each defendant’s violations pursuant to section 15(a)-(d) of the Act (740 ILCS 14/15(a)-(d)
(West 2018)). Mazya was employed as a registered nurse at Northwestern Memorial Lake
Forest Hospital, while Taylor worked as a patient care technician at Northwestern Memorial
1
This agreement was between Ingalls and Mosby, not BD.
2
The initial complaint that was filed is not provided in the record, which was of no consequence
here, because Northwestern Memorial Hospital Taylor and Northwestern Memorial Hospital were not
originally parties.
-6-
Nos. 1-20-0822 and 1-21-0895, cons.
Hospital; both were required to scan their fingerprints to gain access to the medication
dispensing system as a condition of their employment. Mazya and Taylor alleged Northwestern
disregarded their statutorily protected privacy rights when they unlawfully collected, stored,
used, and disseminated their biometric data in violation of the Act. Mazya and Taylor
specifically alleged that defendants were in violation of the Act because it failed to (1) inform
them in writing of the specific purpose and length of time for which their fingerprints were
being collected, stored, and used; (2) receive a written release to collect, store, or otherwise
use their fingerprints; (3) provide a publicly available retention schedule and guidelines for
permanently destroying their fingerprints; and (4) obtain consent from them to disclose,
redisclose, or otherwise disseminate their fingerprints to a third party.
¶ 16 On July 2, 2019, Taylor was dismissed without prejudice from the complaint as her claims
were preempted because she was a party to a collective bargaining agreement. 3
¶ 17 On January 17, 2020, Northwestern 4 filed a motion to dismiss pursuant to section 2-619.1
(735 ILCS 5/2-619.1 (West 2018)) of the Code. Northwestern argued that the complaint should
be dismissed pursuant to section 2-619(a)(9) (id. § 2-619(a)(9)) because the General Assembly
specifically excluded information collected from healthcare treatment, payment, or operations
in the Act. Northwestern further argued that the complaint should be dismissed pursuant to
section 2-615 (id. § 2-615) for failure to state a claim because Northwestern did not store or
possess her biometric information in violation of the Act when it was used for healthcare
treatment, payment, or operations. Northwestern maintained that nothing in the Act was
3
The dismissal occurred after Northwestern removed this case to the Northern District of Illinois
under case number 19 C 3191 (Mazya v. Northwestern Lake Forest Hospital, No. 19-CV-3191 (N.D. Ill.
June 19, 2019)); the case was subsequently returned to the circuit court.
4
Defendants Omnicell Inc. and BD were dismissed from this complaint; however, the record does
not reflect exactly when that occurred. We will address these defendants collectively as Northwestern for
the remainder of this opinion.
-7-
Nos. 1-20-0822 and 1-21-0895, cons.
intended to interfere with HIPAA and that applying it to their medication dispensing systems
would conflict with guidance previously given by the Department of Health and Human
Services (HHS), which encouraged the use of biometrics in health. Northwestern argued that
Mazya knew her information was being collected and had the power to withhold consent, citing
Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, ¶ 34, as support. Northwestern
further argued that Mazya failed to provide factual allegations supporting her conclusory
assertions that Northwestern’s conduct was intentional or reckless. Lastly, Northwestern
requested that Northwestern Memorial Hospital be dismissed from the proceedings, since
Taylor was dismissed. 5
¶ 18 On March 13, 2020, Mazya filed a response to Northwestern’s motion to dismiss, arguing
that her claims were actionable because they did not fall under any exemption under the Act
and the failure to comply with distinct requirements of the Act was all that she needed to
demonstrate. Mazya maintained that the Act’s explicit reference to biometric data taken from
a patient shows the intent of the General Assembly to exclude patient biometrics from the Act’s
protection because they were already protected by HIPAA. Mazya further maintained that if
the General Assembly wanted to provide a sweeping categorical exemption for hospitals it
would have done so as evidenced by the exclusion of financial institutions reflected in section
25(c) of the Act (740 ILCS 14/25(c) (West 2018)).
¶ 19 Northwestern filed a reply on April 3, 2020, arguing that Mazya’s interpretation of the Act
ignored the disjunctive “or” provided in section 10 of the Act, which connotes two different
alternatives, and thus the exemption included employee information. Northwestern maintained
5
The record reflects that on March 10, 2020, Mazya moved to voluntarily dismiss Northwestern
Memorial Hospital from this action; however, the record does not reflect when the motion was granted.
-8-
Nos. 1-20-0822 and 1-21-0895, cons.
that Mazya failed to rebut their argument that she failed to state a claim because her claims
were not supported by the language of the statute and were solely policy-based. Northwestern
further maintained that it would be good policy to interpret the statute their way given that the
usage of biometric information has been encouraged by the government.
¶ 20 On November 2, 2020, the circuit court denied Northwestern’s section 2-619.1 motion.
The circuit court found Northwestern’s section 2-619 argument unpersuasive because the
burden for compliance with the Act falls on the collector of the data, not the provider. Put
another way, Mazya did not waive her consent by continuing to offer her biometric data to
Northwestern as a condition of her duties as a nurse. The circuit court found that accepting
Northwestern’s interpretation of the Act would amount to medical professionals having no
protections for their biometric information. In regard to Northwestern’s section 2-615
arguments, the circuit court found that, to have a viable claim, (1) the claimant need not lack
knowledge of the violation, as the violation itself was enough to support the statutory cause of
action, and (2) the claimant was not required to plead an intentional or reckless violation of the
Act, at that stage of the proceedings.
¶ 21 On November 30, 2020, Northwestern filed a corrected motion for Rule 308 certification
and to stay the proceedings. Northwestern argued that there were substantial grounds for
difference of opinion given the disjunctive “or” in section 10. Northwestern further argued that
the proceedings should be stayed pending this court’s decision because our answer to the
question could expedite the resolution of the underlying case.
¶ 22 On December 11, 2020, Mazya filed a motion to strike Northwestern’s motion for
certification and stay. Mazya argued that Northwestern was trying to certify the same question
that this court denied in Mosby v. Ingalls Memorial Hospital, No. 1-20-0822, which led to the
-9-
Nos. 1-20-0822 and 1-21-0895, cons.
circuit court’s denial of the defendant’s section 2-619.1 motion; therefore, the motion to certify
was frivolous and did not warrant interlocutory review.
¶ 23 Later, on January 13, 2021, Mazya filed a response in opposition to Northwestern’s motion
for Rule 308 certification and stay, reiterating her previous arguments and noting that
Northwestern had not lodged any new arguments or law on the matter.
¶ 24 On February 9, 2021, Northwestern filed a reply in further support of their Rule 308
motion, informing the circuit court that the Illinois Supreme Court directed this court to vacate
its August 24, 2020, order and accept the Rule 308 appeal (Mosby v. Ingalls Memorial
Hospital, No. 126590 (Ill. Jan. 27, 2021) (supervisory order)).
¶ 25 On February 9, 2021, the circuit court denied Northwestern’s Rule 308 motion but stayed
the proceedings pending the decision in Mosby.
¶ 26 On June 15, 2021, Northwestern filed a motion to reconsider the denial of their Rule 308
certification, arguing that the parties in Mosby reached a settlement in principle and that no
one would be presenting any arguments on appeal on behalf of a hospital that uses medication
dispensing systems secured by finger-scan technology. Mazya responded on June 22, 2021,
that plaintiffs were not opposed to the appellate court hearing a certified question.
¶ 27 On July 23, 2021, the circuit court granted the motion to reconsider and stayed the
proceedings, noting that the issue involves a question of law as to which there were substantial
grounds for difference of opinion and that an immediate appeal could materially advance the
ultimate termination of the litigation. Accordingly, the circuit court certified its question to this
court.
-10-
Nos. 1-20-0822 and 1-21-0895, cons.
¶ 28 On July 27, 2021, Northwestern filed an application for leave to appeal pursuant to Rule
308 reiterating the arguments they made at the circuit court and requesting that the case be
consolidated with Mosby. We granted the motion on August 13, 2021.
¶ 29 On August 5, 2021, an amicus curiae brief was filed on behalf of the Illinois Health and
Hospital Association, Northwestern Memorial Healthcare, and Amita Health (collectively the
amici), in support of defendants’ position. They reiterated defendants’ arguments and also
argued that interpreting section 10 in favor of plaintiffs regarding the medical supply
dispensing systems at issue could result in undesirable consequences for healthcare providers.
The amici argued that plaintiffs’ interpretation could be financially burdensome and result in
a lower quality of care for patients.
¶ 30 II. ANALYSIS
¶ 31 On appeal, Northwestern contends that this court should answer the certified question in
the affirmative because the plain language of section 10 demonstrates that employee biometric
information used in medication dispensing systems is excluded from protections of the Act.
¶ 32 A. Jurisdiction
¶ 33 We have jurisdiction to review the certified question pursuant to Illinois Supreme Court
Rule 308 (eff. Oct. 1, 2019). In general, courts of appeal have jurisdiction to review only final
judgments entered in the circuit court unless there is a specific statutory exception or rule of
the supreme court. In re Estate of Luccio, 2012 IL App (1st) 121153, ¶ 17. Rule 308 is one
such exception that allows for the permissive appeal of an interlocutory order certified by the
circuit court, as involving a question of law, as to which there is substantial ground for
difference of opinion and where an immediate appeal may materially advance the ultimate
-11-
Nos. 1-20-0822 and 1-21-0895, cons.
termination of the litigation. Id. Therefore, we are limited to answering the specific question
certified by the circuit court. Moore v. Chicago Park District, 2012 IL 112788, ¶ 9.
¶ 34 B. Standard of Review
¶ 35 When reviewing a certified question of law pursuant to Illinois Supreme Court Rule 308
(eff. Oct. 1, 2019), we apply a de novo standard of review. O’Halloran v. Luce, 2013 IL App
(1st) 113735, ¶ 31. De novo review is also appropriate because this resolution turns on a
question of statutory construction. Eighner v. Tiernan, 2020 IL App (1st) 191369, ¶ 8. “The
primary rule of statutory construction is to give effect to the intent of the legislature.” Ultsch
v. Illinois Municipal Retirement Fund, 226 Ill. 2d 169, 181 (2007). The statutory language
itself is the best evidence of legislative intent, which must be given its plain and ordinary
meaning. Id. The statute should be read as a whole. Id. “Where the meaning of a statute is
unclear from a reading of its language, courts may look beyond the statutory language and
consider the purpose of the law, the evils it was intended to remedy, and the legislative history
of the statute.” Id.¶ 36 1. Plain Language
¶ 37 The Act on which the certified question is based defines “biometric information” as “any
information, regardless of how it is captured, converted, stored, or shared, based on an
individual’s biometric identifier used to identify an individual.” 740 ILCS 14/10 (West 2018).
The Act defines “biometric identifiers” as “a retina or iris scan, fingerprint, voiceprint, or scan
of hand or face geometry.” Id. The parties do not dispute that the fingerprint scan of plaintiff
and other similarly situated hospital employees is a biometric identifier and, when stored, this
fingerprint constitutes biometric information as outlined in the Act.
-12-
Nos. 1-20-0822 and 1-21-0895, cons.
¶ 38 Section 10 of the Act provides exclusions to the protections of the Act; specifically at issue
is the following language:
“Biometric identifiers do not include information captured from a patient in a health care
setting or information collected, used, or stored for health care treatment, payment, or
operations under the federal Health Insurance Portability and Accountability Act of 1996.”
Id.While section 25(c) and (e) expressly provides that the Act will not apply to certain entities and
persons:
“(c) Nothing in this Act shall be deemed to apply in any manner to a financial
institution or an affiliate of a financial institution that is subject to Title V of the federal
Gramm-Leach-Bliley Act of 1999 [(15 U.S.C. § 6803 (2018))] and the rules promulgated
thereunder.
***
(e) Nothing in this Act shall be construed to apply to a contractor, subcontractor,
or agent of a State agency or local unit of government when working for that State
agency or local unit of government.” Id. § 25(c), (e).
¶ 39 Northwestern and the amici contend that the hospital workers’ use of medication
dispensing systems falls within the Act’s definitional carveouts for health-related information.
Northwestern and the amici maintain that the medication dispensing system that is at issue in
this case is permitted to collect information for “healthcare treatment, payment, or operations”
as defined by HIPAA. 45 C.F.R. § 164.501(2) (2018). This includes the fingerprint scan of its
employees who facilitate the dispensing and administration of medications proscribed by
patients. Northwestern and the amici assert that the collection, use, and storage of healthcare
-13-
Nos. 1-20-0822 and 1-21-0895, cons.
workers’ biometric information is for “health care” and “treatment” that Northwestern provides
to its patients and those terms are defined by HIPAA. Id. Northwestern and the amici contend
that this medication dispensing system also acts to provide an audit trail, which includes
diversion, fraud, and abuse detection. Northwestern and the amici assert that this system
additionally aids in patient safety, quality of care, and accurate billing. Northwestern and the
amici contend that the biometric information is collected through the medication dispensing
system and is also used for “health care operations” and “payment.”
¶ 40 Northwestern and the amici contend that the circuit court erred in finding that the carveouts
for health-related information apply only to information taken from a patient because the plain
language of the Act does not read to limit patient biometric data. Northwestern and the amici
maintain that biometric identifiers as defined by the Act included an “or” exception as they
pertain to health care information. Northwestern and the amici assert that “or” is disjunctive
and connotes two different alternatives. Northwestern and the amici assert that this “or”
indicates that a different category of exemptions is allowed and that this is not limited to patient
data. Northwestern and the amici maintain that, to fall within the exception of the Act, the
biometric information obtained must either (1) be obtained in a healthcare setting or (2) be
collected, used, or stored in connection with healthcare treatment, payment, and operations
under HIPAA.
¶ 41 Plaintiffs contend that the circuit court did not err in holding that Northwestern is not
exempt from the Act and that it excludes only patient biometric data from its protections
because patient data is already protected by HIPAA. Plaintiffs assert that this would in effect
leave thousands of hospital workers unprotected from the risks that the Act was designed to
protect against. Plaintiffs assert that Northwestern’s interpretation of how “or” creates two
-14-
Nos. 1-20-0822 and 1-21-0895, cons.
clauses would make sense if the “under HIPAA” language was not present because patient
information is the only information governed by HIPAA.
¶ 42 Northwestern’s reply brief asserts that the storage of healthcare workers’ biometric
information, obtained when accessing a medication dispensing system, is for the ”health care”
and “treatment” of patients as those terms are defined by HIPAA; therefore, the “under
HIPAA” language does not exclude this type of information.
¶ 43 We find that the language of the statute is clear and simple disagreement between the
parties will not create ambiguity in the statute. Kaider v. Hamos, 2012 IL App (1st) 111109,
¶ 11. What is excluded from the protections of section 10 are (1) information from the patient
in a healthcare setting and (2) information that is already protected “under the federal Health
Insurance Portability and Accountability Act of 1996.” 740 ILCS 14/10 (West 2018). Even
taking into consideration the disjunctive “or,” section 10 still has the same effect of excluding
those two classifications of information. Indeed, the disjunctive “or” means that patient
information and information under HIPAA are alternatives that are to be considered separately.
Goldberg v. Brooks, 409 Ill. App. 3d 106, 111 (2011).
¶ 44 At oral argument, Northwestern argued that this court should not consider the terminology
“under HIPAA” and instead we should consider this as “defined by HIPAA.” However, “under
HIPAA” is what the Act expressly states, and that cannot be ignored. We are simply unable to
rewrite the statute. Zahn v. North American Power & Gas, LLC, 2016 IL 120526, ¶ 15. Either
way, the biometric information of employees is simply not defined or protected “under
HIPAA.” Accordingly, the plain language of the statute does not exclude employee
information from the Act’s protections because they are neither (1) patients nor (2) protected
under HIPAA. We further find that, if the legislature intended to create a wide-ranging
-15-
Nos. 1-20-0822 and 1-21-0895, cons.
exemption for hospitals, it would have done so, since the Act does contain a separate blanket
exclusion. This is demonstrated in the Act when the legislature expressly provided that the Act
was not to apply to financial institutions subject to Title V of the federal Gramm-Leach-Bliley
Act of 1999 and employees, contractors, or subcontractors of local government or the State as
provided in section 25. 740 ILCS 14/25 (West 2018).
¶ 45 Northwestern’s inclusion of employee’s biometric information under the exclusion
goes beyond the plain language of the Act. We are unable to rewrite the statute to add
provisions or limitations that the legislature did not include. Zahn, 2016 IL 120526, ¶ 15. No
rule of construction permits this court to declare that the legislature did not mean what the plain
language of the statute imports. Id. There is simply no provision or reference to the protection
of employee biometric data in the Act or in HIPAA. Thus, we will not add employee biometric
data as information to be excluded by the Act because it would be contrary to the plain
language of the Act. Based thereon, we need not consider other sources in order to find the
statutory meaning. Kaider, 2012 IL App (1st) 111109, ¶ 11.
¶ 46 III. CONCLUSION
¶ 47 Consistent with the plain language of the Act, we find that the legislature did not exclude
employee biometric information from its protections, and we answer the certified question in
the negative. We remand this cause for further proceedings consistent with this opinion.
¶ 48 Certified question answered; cause remanded.
-16-
Nos. 1-20-0822 and 1-21-0895, cons.
No. 1-20-0822
Cite as: Mosby v. Ingalls Memorial Hospital, 2022 IL App (1st) 200822Decision Under Review: Appeal from the Circuit Court of Cook County, Nos. 18-CH-
05031, 18-CH-07161; the Hon. Pamela McLean Meyerson and
the Hon. Alison C. Conlon, Judges, presiding.
Attorneys Joseph A. Strubbe, Frederic T. Knape, and Zachary J. Watters,
for of Vedder Price P.C., and Gary M. Miller, Matthew C. Wolfe,
Appellant: and Elisabeth A. Hutchinson, of Shook, Hardy & Bacon L.L.P.,
both of Chicago, for appellants Ingalls Memorial Hospital, UCM
Community Health & Hospital Division, Inc., and Becton,
Dickinson and Company.
Joel Griswold and Bonnie Keane DelGobbo, of Baker &
Hostetler LLP, of Chicago, for other appellants.
Attorneys James B. Zouras, Ryan F. Stephan, Andrew C. Ficzko, Catherine
for T. Mitchell, and Paige L. Smith, of Stephan Zouras, LLP, of
Appellee: Chicago, for appellees.
Amici Curiae: Michael A. Woods, of Naperville, and Richard H. Tilghman, of
Nixon Peabody LLP, and Bonnie Keane DelGobbo and Joel
Griswold, of Baker & Hostetler LLP, both of Chicago, for amici
curiae Illinois Health and Hospital Association et al.
-17-