NOTICE
2025 IL App (5th) 240784-U NOTICE
Decision filed 04/09/25. The This order was filed under text of this decision may be NO. 5-24-0784 Supreme Court Rule 23 and is changed or corrected prior to not precedent except in the the filing of a Petition for IN THE limited circumstances allowed Rehearing or the disposition of under Rule 23(e)(1).
the same.
APPELLATE COURT OF ILLINOIS
FIFTH DISTRICT
______________________________________________________________________________
SUZANNE CLINE, on Behalf of Herself and ) Appeal from the All Other Persons Similarly Situated, ) Circuit Court of Known and Unknown, ) Williamson County.
)
Plaintiff-Appellant, )
)
v. ) No. 20-L-52 )
MARION REHABILITATION AND NURSING ) CENTER, LLC, d/b/a Integrity Healthcare of Marion, ) Honorable ) Jeffrey A. Goffinet,
Defendant-Appellee. ) Judge, presiding.
______________________________________________________________________________
JUSTICE CATES delivered the judgment of the court.
Justices Boie and Sholar concurred in the judgment.
ORDER
¶1 Held: The circuit court erred in dismissing the plaintiff’s class action complaint where the defendant failed to meet its burden of establishing that an affirmative matter defeated the plaintiff’s claims.
¶2 The plaintiff, Suzanne Cline, appeals the circuit court’s order dismissing her class action complaint. The plaintiff claims that the circuit court incorrectly applied the “attached-papers” and “particularity” requirements of Illinois Supreme Court Rule 191(a) (eff. Jan. 4, 2013); the circuit court incorrectly held that certain timekeeping activities for employees fell within the Biometric Information Privacy Act’s (BIPA) 1 healthcare exemption; and the circuit
1
Biometric Information Privacy Act (BIPA) (740 ILCS 14/1 et seq. (West 2020)).
2
court improperly dismissed the plaintiff’s lawsuit as a result of its rulings. For the following reasons, we reverse and remand for further proceedings.
¶3 I. BACKGROUND
¶4 The plaintiff was a registered healthcare worker through the Illinois Department of Public Health and worked for the defendant, Marion Rehabilitation and Nursing Center, LLC, as the social services director from October 25, 2016, to December 17, 2017. During that period, the defendant required the plaintiff, and other employees, to scan their hands using a biometric timeclock. Each employee was required to scan their hand when they started and ended their workday and when they started and finished their lunch breaks.
¶5 The plaintiff filed a three-count class action complaint on May 1, 2020, which alleged that the defendant violated the Biometric Information Privacy Act (BIPA) (740 ILCS 14/1 et seq. (West 2020)) by unlawfully collecting hand geometry scans, using a biometric timeclock. The plaintiff claimed that the hand geometry scans qualified as biometric identifiers 2 under BIPA and that the collection of these biometric identifiers violated BIPA because the collection of these biometric identifiers compromised the privacy and security of the biometric identifiers and biometric information 3 of the plaintiff and other similarly situated employees. 4
¶6 Specifically, in count I of the complaint, the plaintiff alleged that the defendant violated section 15(b) of BIPA (740 ILCS 14/15(b) (West 2020)), where the plaintiff had acquired and retained biometric information from the plaintiff’s hand geometry scans without first informing
2 BIPA defines “biometric identifier” as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” 740 ILCS 14/10 (West 2020).
3 BIPA defines “biometric information” as “any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual.” 740 ILCS 14/10 (West 2020).
4 Plaintiff brought this cause of action on behalf of herself and a class of other similarly situated employees. The term, “plaintiff,” as used herein refers generally to the individual plaintiff and the purported class unless otherwise specifically identified.
3
the plaintiff and other similarly situated employees in writing that defendant was doing so. The defendant additionally failed to inform the plaintiff of the purpose for the collection of the personal identifying information and the length of time the biometric identifiers and biometric information would be stored. Count I further alleged that the defendant had not obtained plaintiff’s consent or other form of release allowing defendant to collect the biometric identifiers and/or biometric information. In count II, the plaintiff alleged violations of section 15(a) of BIPA (740 ILCS 14/15(a) (West 2020)), where the defendant possessed personal identifying information obtained from the plaintiff’s hand geometry scans without creating and following a written policy, made available to the public, establishing a retention schedule and destruction guidelines. In count III, the plaintiff alleged violations of section 15(d) of BIPA (740 ILCS 14/15(d) (West 2020)) where the defendant disclosed or otherwise disseminated the plaintiff’s hand geometry scans and personal identifying information to defendant’s timekeeping vendor, without first obtaining plaintiff’s consent for such disclosure or dissemination.
¶7 On August 24, 2021, the defendant filed a motion to dismiss the class action lawsuit. The defendant argued, in its written motion, that the plaintiff’s claims were untimely under a one-year statute of limitations; that the plaintiff failed to plead facts to establish harm caused by a BIPA violation; that the plaintiff lacked standing; that the plaintiff failed to allege specific facts regarding the disclosure of biometric information to an unidentified third party timekeeping vendor and that any such disclosure by defendant would be exempt from BIPA requirements because the disclosure would have been to effectuate a financial transaction; and that the plaintiff’s exclusive remedy for workplace injury damages was through the Illinois Workers’ Compensation Act (820 ILCS 305/1 et seq. (West 2020)). The circuit court denied the defendant’s initial motion to dismiss, and the formal written order was entered on November 3, 2021.
4
¶8 The defendant filed an answer and affirmative defenses on December 1, 2021. The defendant denied multiple allegations in the complaint including many of the background facts alleged by the plaintiff regarding the nature of the data captured from the defendant’s biometric timeclock and the biometric identifiers and information disclosed to the defendant’s timekeeping vendor. The defendant additionally denied multiple other allegations, such as the plaintiff’s allegation that the defendant had achieved a labor management benefit from using a biometric timeclock.
¶9 The defendant requested a stay in this proceeding pending the resolution of other BIPA cases pending in various courts throughout Illinois. The circuit court entered a stay in this action pending decisions by the Illinois Supreme Court in three BIPA cases: Cothron v. White Castle System, Inc., 2023 IL 128004, McDonald v. Symphony Bronzeville Park, LLC, 2022 IL 126511, and Tims v. Black Horse Carriers, Inc., 2023 IL 127801. The stay was lifted on February 28, 2023. The defendant then requested an additional stay based on pending litigation in another BIPA case, Mosby v. Ingalls Memorial Hospital, 2023 IL 129081, which the circuit court granted.
¶ 10 After the Mosby decision was issued, the plaintiff filed a motion to compel outstanding discovery responses, and the circuit court issued an order granting the motion to compel. The defendant filed a motion for leave to file a second motion to dismiss pursuant to the Mosby decision, a motion for clarification regarding the circuit court’s order granting the plaintiff’s motion to compel discovery and requested that the circuit court hold further discovery in abeyance.
¶ 11 The defendant subsequently filed a supplemental motion to dismiss pursuant to section 2- 619(a)(9) of the Code of Civil Procedure (735 ILCS 5/2-619(a)(9) (West 2022)) and relied on Mosby, 2023 IL 129081. In Mosby, nurses’ biometric information obtained from a medication dispensing system used for patient care was excluded from coverage under BIPA. See Mosby,
5
2023 IL 129081. Mosby determined that “information collected, used, or stored for health care treatment, payment, or operations under [HIPAA 5]” was exempt from BIPA requirements. Mosby, 2023 IL 129081, ¶ 54. The defendant argued that the individual plaintiff, and the proposed class, were healthcare workers and that the data allegedly collected from the use of defendant’s timeclock was for healthcare operations and payments. Thus, according to the defendant, the plaintiff’s BIPA claims failed as the alleged biometric data fell within certain specific statutory exemptions.
¶ 12 In support of its supplemental motion to dismiss, the defendant attached an affidavit from Kelly Kelley, the chief executive officer (CEO) of Integrity Healthcare Communities. Kelley averred that her affidavit was based on her personal knowledge. Kelley’s affidavit also included the following statement:
“In my role, I routinely review the records discussed in this Affidavit as part of my regular duties. Based on my experience, I can attest that the business records that I have reviewed for purposes of this Affidavit were made at or near the time of the event they record, and made and kept in the ordinary course of Marion’s business of operating a skilled nursing facility.”
¶ 13 Kelley’s affidavit made numerous references to “punch data,” which she identified as the data generated from the plaintiff and other workers when they scanned their hands on the timeclock. Kelley averred that the defendant used the “punch data” to prepare and audit its staffing requirements; to know which employees were on site; to prepare its required annual financial and statistical report; to prepare a portion of an annual report; to submit direct care staffing information; to prepare quarterly staffing reports; to investigate, resolve, and combat issues involving patient safety, facility sanitation, and fraud and abuse prevention; to identify each employee clocking in to prevent time fraud; to demonstrate compliance with Medicaid and Medicare regulations; to
5 “HIPAA” refers to the federal Health Insurance Portability and Accountability Act of 1996. See 45 C.F.R. § 164.501 (2018).
6
investigate allegations of possible drug diversion; to investigate complaints of patient treatment; to maintain certified nursing assistant (CNA) certification status; for use in business planning and other general administrative activities; and to confirm compliance with requirements that patients received medically-related social services. A 2016 financial statement was attached to the affidavit, but “punch data,” or other documents that referenced “punch data,” were not attached.
¶ 14 The plaintiff responded to the defendant’s 2-619 motion to dismiss and argued that timekeeping activities were not exempt under BIPA. The plaintiff additionally claimed that Kelley’s affidavit failed to comply with Illinois Supreme Court Rule 191(a) (eff. Jan. 4, 2013) as it included many conclusory allegations and lacked exhibits to support and/or verify those conclusory allegations. Plaintiff further claimed that the only attachment, a 2016 financial report, was insufficient and noted that plaintiff’s employment began at the end of 2016 and extended into 2017.
¶ 15 The plaintiff, in her response, also argued that the “punch data” description provided in the affidavit was unclear. The “punch data” may refer to the biometric hand geometry scan identifiers or it could refer to the summary data used to determine the dates and times that the employees clocked into and out of work. The plaintiff assumed that the “punch data” referenced was not the biometric data identified in the complaint and argued that the use of the summary data would not excuse the defendant from liability. Furthermore, the plaintiff claimed that if the “punch data” were the biometric data identified in the complaint, the data was not used for healthcare “payment” or “operations” under HIPAA and no exemption applied.
¶ 16 The plaintiff attached copies of emails to the response to the motion to dismiss which demonstrated that the parties had engaged in discovery. The defendant, however, had not produced
7
any documents. Specifically, no “punch data” had been produced prior to the motion to dismiss hearing.
¶ 17 During the hearing on the defendant’s supplemental motion to dismiss, the defendant argued that an exclusion applied to BIPA which allowed the healthcare industry to use biometric information for treatment, payment, or operations as defined by HIPAA. The defendant claimed that it used the hand geometry scan data for purposes that fell within the operations and payment prongs of the HIPAA. Without the biometric data generated from the plaintiffs’ use of the timeclocks, the defendant argued that it would not have been able to comply with reporting requirements. The data was also allegedly used for payment purposes, used to ensure compliance with regulations, and used for other activities such as obtaining reimbursements from Medicaid and Medicare programs.
¶ 18 The defendant further argued that Kelley’s affidavit was unrebutted, and that the affidavit was compliant with Rule 191(a) where Kelley’s affidavit was based on personal knowledge and experience. See Ill. S. Ct. R. 191(a) (eff. Jan. 4, 2013). The defendant argued that the financial statement referenced in the affidavit was attached and was sufficient to satisfy the “attached- papers” requirement of Rule 191(a). See Ill. S. Ct. R. 191(a) (eff. Jan. 4, 2013). The defendant also argued that Kelley had clearly stated facts on which she based her opinion.
¶ 19 In response, the plaintiff argued that Kelley’s affidavit was not compliant with Rule 191(a) and, therefore, the burden never shifted to the plaintiff to provide a counteraffidavit. See Ill. S. Ct. R. 191(a) (eff. Jan. 4, 2013). The plaintiff claimed the affidavit did not comply with the “attached- papers” requirement or the “particularity” requirement. Kelley had stated in her affidavit that she reviewed documents for the purpose of drafting her affidavit and referred to “punch data,” which she failed to attach.
8
¶ 20 The plaintiff additionally argued that discovery was necessary to review the “punch data” and to make a determination if “punch data” was the same data as described in the complaint. The plaintiff believed that Kelley’s described “punch data” was summary data, such as an excel spreadsheet, and not a hand scan or a mathematical representation of a hand scan. If the “punch data” referred to by Kelley was summary data, then that data was not specific to the claims related to the hand geometry scans identified in the plaintiff’s complaint.
¶ 21 The plaintiff further argued that Kelley had not used the data identified in the complaint for anything defined as a “healthcare payment” and/or “operations,” and that HIPAA’s definition of “healthcare operations” did not encompass everything that occurs in a healthcare setting. Even if the circuit court accepted every fact in Kelley’s affidavit, including that Kelley had referred to biometric data which was used for healthcare payment and operations, the plaintiff argued that the circuit court would not have specific enough information to grant the motion to dismiss because Kelley had not identified when the data was used for healthcare payment and operations. The plaintiff requested that the circuit court deny the motion to dismiss because questions remained regarding the amount of data and when the data was used for healthcare payment and operations.
¶ 22 Nevertheless, the defendant sought dismissal of the complaint based on allegations of its use of “punch data” that it failed provided to the court. The circuit court took the matter under advisement.
¶ 23 The circuit court entered a written order granting the defendant’s supplemental motion to dismiss with prejudice. The circuit court found that
“any alleged biometric identifiers and biometric information generated from the use of Defendant’s timeclock fall under the Biometric Information Privacy Act’s (‘BIPA’) statutory exemption for ‘information collected, used, or stored for health care treatment, payment, or operations under [HIPAA],’ and are therefore not subject to the BIPA’s requirements. See 740 ILCS 14/10.”
9
¶ 24 The plaintiff filed a motion to reconsider the circuit court’s order of dismissal. The circuit court denied the motion to reconsider. This appeal followed.
¶ 25 II. ANALYSIS
¶ 26 On appeal, the plaintiff challenges the circuit court’s order granting the defendant’s section 2-619(a)(9) motion to dismiss where the defendant solely relied on Kelley’s affidavit. See 735 ILCS 5/2-619(a)(9) (West 2022). The plaintiff argues that Kelley’s affidavit was insufficient, and the circuit court incorrectly applied the “attached-papers” requirement and the “particularity” requirement of Illinois Supreme Court Rule 191(a) (eff. Jan. 4, 2013). The plaintiff additionally argues that the circuit court improperly dismissed the action based on its finding that the defendant’s timekeeping activities for employees fell within BIPA’s healthcare exemption.
¶ 27 A section 2-619(a)(9) motion to dismiss asserts that a claim against the defendant is barred by an affirmative matter avoiding the legal effect of or defeating the claim while admitting the legal sufficiency of the complaint. Kuykendall v. Schneidewind, 2017 IL App (5th) 160013, ¶ 32. “An ‘affirmative matter’ is a type of defense that negates a cause of action completely or refutes critical conclusions of law or conclusions of material fact that are unsupported by specific factual allegations contained in or inferred from the complaint.” Kuykendall, 2017 IL App (5th) 160013,
¶ 32. Initially, the defendant has the burden of establishing that an affirmative matter defeats the plaintiff’s claim. Kuykendall, 2017 IL App (5th) 160013, ¶ 32. Then, the burden shifts to the plaintiff, who must establish that the affirmative defense is “ ‘unfounded or requires the resolution of an essential element of material fact before it is proven.’ ” Epstein v. Chicago Board of Education, 178 Ill. 2d 370, 383 (1997) (quoting Kedzie &103rd Currency Exchange, Inc. v. Hodge, 156 Ill. 2d 112, 116 (1993)).
10
¶ 28 A section 2-619 motion to dismiss should only be granted if the plaintiff cannot prove a set of facts that would support the cause of action. In re Estate of Boyar, 2013 IL 113655, ¶ 27. “If defendant’s evidence in support of a section 2-619(a)(9) motion does nothing more than refute the well-pleaded allegations of the complaint, the complaint trumps that evidence, and dismissal is improper.” Doe v. University of Chicago Medical Center, 2015 IL App (1st) 133735, ¶ 43. A summary judgment motion is the appropriate procedural tool to use when addressing the complaint’s factual allegations. Kuykendall, 2017 IL App (5th) 160013, ¶ 32. The standard of review of a section 2-619 motion to dismiss is de novo. Krilich v. American National Bank & Trust Co. of Chicago, 334 Ill. App. 3d 563, 571 (2002).
¶ 29 The circuit court may consider affidavits when deciding a section 2–619(a)(9) motion to dismiss an affirmative matter, if such a matter is not apparent on the face of the complaint. Epstein, 178 Ill. 2d at 383. Under Illinois Supreme Court Rule 191(a),
“affidavits submitted in connection with a motion for involuntary dismissal under section 2-619 of the Code of Civil Procedure *** shall be made on the personal knowledge of the affiants; shall set forth with particularity the facts upon which the claim, counterclaim, or defense is based; shall have attached thereto sworn or certified copies of all documents upon which the affiant relies; shall not consist of conclusions but of facts admissible in evidence; and shall affirmatively show that the affiant, if sworn as a witness, can testify competently thereto.” Ill. S. Ct. R.
191(a) (eff. Jan. 4, 2013).
¶ 30 The provisions of Supreme Court Rule 191(a) should be adhered to as written and construed according to the plain and ordinary meaning of its language. Robidoux v. Oliphant, 201 Ill. 2d 324, 347 (2002). “The requirement that documents be attached is not a mere ‘technicality’ and, if not adhered to, is fatal.” Selby v. O’Dea, 2020 IL App (1st) 181951, ¶ 136. Strict compliance with Supreme Court Rule 191(a) ensures that the circuit court is presented with valid evidentiary facts upon which to base a decision. Robidoux, 201 Ill. 2d at 336.
11
¶ 31 In Doe v. Coe, the defendants argued that the “attached-papers” requirement of Rule 191(a) did not mandate the attachment of documents where the affiants professed personal knowledge. Doe v. Coe, 2017 IL App (2d) 160875, ¶ 11. The affiants in Coe specified the documents in support of their assertions and thereby relied on the documents within the meaning of Rule 191(a). Coe, 2017 IL App (2d) 160875, ¶ 11. The documents were, nevertheless, required to be attached as they would have allowed the circuit court the opportunity to review the bases for the assertions in the affidavits. Coe, 2017 IL App (2d) 160875, ¶ 11. Similarly, in Direct Auto Insurance Co. v. Betran, an affidavit which referenced documents failed to comply with the requirements of Rule 191(a) where the supporting documents were not attached. Direct Auto Insurance Co. v. Betran, 2013 IL App (1st) 121128, ¶ 64.
¶ 32 The plaintiff’s complaint alleged multiple BIPA violations based on the use of a biometric timeclock which allegedly compromised the privacy and security of the biometric identifiers and information of the individual plaintiff and other similarly situated employees. BIPA defines “biometric information” as “any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual.” 740 ILCS 14/10 (West 2020). BIPA defines “biometric identifier” as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” 740 ILCS 14/10 (West 2020).
¶ 33 The defendant argued that BIPA’s healthcare exemption barred the plaintiff’s claims in the defendant’s section 2-619(a)(9) motion to dismiss. Under BIPA, biometric identifiers “do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996.” 740 ILCS 14/10 (West 2020). Under Mosby, a biometric identifier exemption applied where a healthcare worker’s biometric information was
12
used to permit access to medication dispensing stations for patient care. Mosby, 2023 IL 129081,
¶ 54.
¶ 34 In support of the defendant’s 2-619(a)(9) motion to dismiss, the defendant provided a single affidavit from Kelley which claimed that the defendant used employees’ “punch data” for healthcare operations and payments and claimed that biometric identifier exemptions applied. Kelley made specific and repeated references to “punch data,” which she defined as the data generated from the plaintiff and other workers scanning their hands on the timeclock. The “punch data” description was vague. The review of a hand geometry scan would not likely produce the information that Kelley referenced as “punch data,” used for multiple functions including the preparation of audits and reports, or to demonstrate compliance with regulations. Although Kelley averred that her affidavit was based on personal knowledge, Kelley also stated that she had reviewed business records for the purpose of drafting her affidavit. However, no “punch data” documents or other business records were attached to Kelley’s affidavit.
¶ 35 The plaintiff additionally argues that the circuit court improperly dismissed the action based on its finding that the defendant’s timekeeping activities for employees fell within BIPA’s healthcare exemption. We note that the defendant filed an answer prior to the motion to dismiss and denied multiple allegations in the complaint. For instance, the defendant denied that it received a labor management benefit from using the biometric timeclock. The defendant additionally denied background facts such as capturing or collecting the plaintiff’s unique biometric identifiers and information and sharing those identifiers and information with its timekeeping vendor.
¶ 36 Kelley averred that the “punch data” was used for numerous purposes and the information was collected, used, or stored for healthcare treatment, payment, or operations. Yet, it is unknown if “punch data” is the same information that the plaintiff referred to in the complaint as the unique
13
biometric identifiers and information which was shared with the defendant’s timekeeping vendor where the “punch data” has not been produced.
¶ 37 Because Kelley relied on “punch data” in her affidavit, she was required under Rule 191(a) to have attached thereto sworn or certified copies of the “punch data” documents which she had reviewed and/or upon which she relied. See Ill. S. Ct. R. 191(a) (eff. Jan. 4, 2013). The only document attached was conclusory and did not reference “punch data.” Therefore, Kelley’s affidavit fails to comply with the requirements of Rule 191(a). See Ill. S. Ct. R. 191(a) (eff. Jan. 4, 2013). Without further particularity and compliance with the “attached-papers” requirement, the circuit court erred in granting the defendant’s 2-619(a)(9) motion to dismiss as the defendant failed to meet its burden of establishing that an affirmative matter defeated the plaintiff’s claims.
¶ 38 III. CONCLUSION
¶ 39 For the foregoing reasons, we reverse the judgment of the circuit court of Williamson County and remand for further proceedings.
¶ 40 Reversed and remanded.