Mosby v. Ingalls Memorial Hospital

2022 IL App (1st) 200822

• Court: Appellate Court of Illinois
• Decided: February 25, 2022
• Docket: 1-20-0822
• Status: Published

Opinion

2022 IL App (1st) 200822

SIXTH DIVISION Filing Date February 25, 2022

Nos. 1-20-0822 and 1-21-0895, cons. ______________________________________________________________________________ IN THE APPELLATE COURT OF ILLINOIS FIRST JUDICIAL DISTRICT ______________________________________________________________________________

LUCILLE MOSBY, Individually, and on Behalf of All ) Appeal from the Others Similarly Situated, ) Circuit Court of ) Cook County. Plaintiff-Appellee, ) ) No. 18 CH 05031 v. ) THE INGALLS MEMORIAL HOSPITAL, UCM ) The Honorable COMMUNITY HEALTH & HOSPITAL DIVISION, ) Pamela McLean Meyerson, INC., and BECTON, DICKINSON AND COMPANY, ) Judge, Presiding. ) Defendants-Appellants).

YANA MAZYA, Individually, and on Behalf of All ) Appeal from the Others Similarly Situated, ) Circuit Court of ) Cook County. Plaintiff-Appellee, ) ) No. 18 CH 71601 v. ) NORTHWESTERN LAKE FOREST HOSPITAL, ) The Honorable NORTHWESTERN MEMORIAL HEALTHCARE, ) Alison C. Conlon, OMNICELL, INC., and BECTON, DICKINSON AND ) Judge, Presiding. COMPANY, )

Defendants

(Northwestern Lake Forest Hospital and Northwestern Memorial Healthcare, Defendants-Appellants). Nos. 1-20-0822 and 1-21-0895, cons.

JUSTICE ODEN JOHNSON delivered the judgment of the court, with opinion. Justices Harris and Mikva concurred in the judgment and opinion.

OPINION

¶1 Plaintiff Lucille Mosby filed a class-action suit individually and on behalf of others

similarly situated against defendants Ingalls Memorial Hospital and UCM Community Health

& Hospital Division, Inc. (collectively Ingalls), and Becton, Dickinson and Company (BD)

(collectively group defendants one). Similarly, plaintiff Yana Mazya filed a class-action suit

individually and on behalf of others similarly situated against Northwestern Lake Forest

Hospital and Northwestern Memorial Healthcare (collectively group defendants two). During

the course of the litigation, group defendants one filed an interlocutory appeal pursuant to

Illinois Supreme Court Rule 308 (eff. Oct. 1, 2019) to have this court answer this certified

question:

“Whether the exclusion in Section 10 of BIPA for “information collected, used, or

stored for health care treatment, payment, or operations under the federal Health Insurance

Portability and Accountability Act of 1996” applies to biometric information of health care

workers (as opposed to patients) collected, used or stored for health care treatment,

payment or operations under HIPAA?”

¶2 Subsequently, group defendants two also filed an interlocutory appeal pursuant to Rule 308

concerning the same issue:

“Does finger-scan information collected by a health care provider from its employees

fall within the Biometric Information Privacy Act’s exclusion for ‘information collected,

used, or stored for health care treatment, payment or operations under the federal Health

Insurance Portability and Accountability Act of 1996,’ 740 ILCS 14/10, when the

-2- Nos. 1-20-0822 and 1-21-0895, cons.

employee’s finger-scan information is used for purposes related to ‘healthcare,’

‘treatment,’ ‘payment,’ and/or ‘operations’ as those terms are defined by the HIPAA statute

and regulations?”

Both group defendants’ petitions for leave to appeal were permitted, as discussed in detail below.

However, at this time, the only question submitted for this court’s review is the question submitted

by group defendants two, and we answer the question in the negative.

¶3 I. BACKGROUND

¶4 A. Mosby

¶5 On April 18, 2018, Mosby filed a class-action complaint against Ingalls and BD seeking

redress for each defendant’s violations pursuant to section 15(a)-(d) of the Biometric

Information Privacy Act (Act) (740 ILCS 14/15(a)-(d) (West 2018)). Mosby worked as a

registered pediatrics nurse at Ingalls Memorial Hospital. As a condition of Mosby’s

employment, she was required to scan her fingerprint to authenticate her identity and gain

access to a medication dispensing system. Mosby alleged that defendants’ behavior exposed

employees like herself to serious irreversible privacy risks. Mosby alleged that defendants

violated the Act by (1) not informing her in writing of the specific purpose and the length of

time for which her fingerprints were being collected, stored, and used; (2) failing to provide a

publicly available retention schedule and guidelines for permanently destroying Mosby’s

fingerprints; (3) failing to obtain a written release from Mosby to collect, store, disseminate,

or otherwise use her fingerprint; and (4) failing to obtain consent before disclosing Mosby’s

fingerprints to third-party vendors that host the data.

¶6 On May 14, 2019, plaintiff filed an amended class-action complaint that was substantially

similar to the original.

-3- Nos. 1-20-0822 and 1-21-0895, cons.

¶7 On June 5, 2019, defendants filed a motion to dismiss pursuant to section 2-619.1 (735

ILCS 5/2-619.1 (West 2018)) of the Code of Civil Procedure (Code) or to strike the amended

complaint. The motion argued that the complaint should be dismissed pursuant to section 2-

619(a)(9) (id. § 2-619(a)(9)) because (1) the biometric data that was collected, used, and/or

stored restricted access to protected health information and medication and (2) the data was

used for healthcare treatment and operations pursuant to the Health Insurance Portability and

Accountability Act of 1996 (HIPAA) (45 C.F.R. § 164.501 (2018)) and was thereby

specifically excluded from the scope of the Act. Defendants argued that, pursuant to section 2-

615 (735 ILCS 5/2-615 (West 2018)), Mosby failed to allege any well-pleaded facts regarding

any disclosures of her fingerprints.

¶8 On January 13, 2020, the circuit court ruled that the exception was limited as to the

information protected under HIPAA. To hold otherwise, the court noted, would result in a

broad exception for all employees involved in operations that impact patients protected by

HIPAA. The circuit court opined that, if the legislature intended to exempt employees entirely,

they would have expressly done so. The court denied defendants’ motion to dismiss based on

this issue. The circuit court dismissed BD from the complaint in its entirety, without prejudice,

and found that Mosby failed to state a claim as to how defendants disseminated her biometric

information. With authorization of the circuit court, Mosby amended her pleadings on

February 24, 2020, which realleged all of the claims contained in the previously dismissed

claim.

¶9 On March 16, 2020, defendants filed a joint motion to certify a question for interlocutory

appeal under Illinois Supreme Court Rule 308 (eff. Oct. 1, 2019) and stay proceedings.

Defendants argued that the question of whether employee information was also exempt under

-4- Nos. 1-20-0822 and 1-21-0895, cons.

the Act was a question of first impression and has never been heard before this court.

Defendants argued that the question was one of statutory construction and there existed a

substantial ground for a difference of opinion, which made it appropriate to bring under Rule

308. Defendants maintained that raising the question would be beneficial in a variety of ways,

such as: (1) it would advance the outcome of the case with prejudice if the Act was interpreted

in their favor, (2) judicial economy would be served, and (3) the need for a uniform

construction and application of the law would be served. Defendants also requested a stay in

the circuit court proceedings because the determination could lead to a dismissal and Mosby

would not be prejudiced.

¶ 10 On April 20, 2020, Mosby filed a motion in opposition to defendants’ joint motion to

certify the question for interlocutory appeal, arguing that substantial grounds for difference of

opinion did not exist. Mosby maintained that to hold otherwise would mean that the General

Assembly intended to place anyone employed in the healthcare industry into an “unregulated

biometric abyss,” by having no biometric protections. Mosby argued that defendants did not

demonstrate that they faced any hardship or inequity to justify a stay that would outweigh the

prejudice she would suffer. Mosby maintained that the prejudice she would suffer if a stay was

granted was the denial of pursuing her claim in an expedient manner and, if successful, the

collection of damages. Mosby argued that defendants’ conduct was ongoing and continuous

and every day that passed would compound the injuries that they were inflicting.

¶ 11 On May 4, 2020, defendants filed a joint reply arguing that the proposed certified question

was tailored and limited to those circumstances where the biometric data collected from

healthcare workers were used for healthcare treatment, payment, or operations under HIPAA.

Defendants further argued that the circuit court did not entirely reject its argument and found

-5- Nos. 1-20-0822 and 1-21-0895, cons.

it plausible but ultimately concluded that the General Assembly would have been more explicit

if the legislative intent was to exclude healthcare employees’ biometric data.

¶ 12 On June 18, 2020, the circuit court granted defendants’ motion to certify and stay the

proceedings. The circuit court ruled that the issue posed by defendants presented a question of

law where there was substantial ground for difference of opinion and could ultimately

determine whether or not the case should be dismissed.

¶ 13 On July 17, 2020, defendants filed an application for leave to appeal pursuant to Rule 308,

which we denied on August 24, 2020. Defendants filed a petition for leave to appeal with the

Illinois Supreme Court, on October 30, 2020. On March 3, 2021, the Illinois Supreme Court

issued a mandate vacating this court’s decision and ordered this court to hear the certified

question on appeal. On June 11, 2021, Ingalls filed an unopposed motion for extension of time

to file an opening brief, where they informed the circuit court that the parties reached a

settlement in principle. 1

¶ 14 B. Mazya

¶ 15 On April 10, 2019, Yana Mazya and Tiki Taylor filed an amended class-action complaint2

against Northwestern Lake Forest Hospital, Northwestern Memorial Healthcare, Northwestern

Memorial Hospital (collectively Northwestern), Omnicell Inc., and BD seeking redress for

each defendant’s violations pursuant to section 15(a)-(d) of the Act (740 ILCS 14/15(a)-(d)

(West 2018)). Mazya was employed as a registered nurse at Northwestern Memorial Lake

Forest Hospital, while Taylor worked as a patient care technician at Northwestern Memorial

1 This agreement was between Ingalls and Mosby, not BD. 2 The initial complaint that was filed is not provided in the record, which was of no consequence here, because Northwestern Memorial Hospital Taylor and Northwestern Memorial Hospital were not originally parties.

-6- Nos. 1-20-0822 and 1-21-0895, cons.

Hospital; both were required to scan their fingerprints to gain access to the medication

dispensing system as a condition of their employment. Mazya and Taylor alleged Northwestern

disregarded their statutorily protected privacy rights when they unlawfully collected, stored,

used, and disseminated their biometric data in violation of the Act. Mazya and Taylor

specifically alleged that defendants were in violation of the Act because it failed to (1) inform

them in writing of the specific purpose and length of time for which their fingerprints were

being collected, stored, and used; (2) receive a written release to collect, store, or otherwise

use their fingerprints; (3) provide a publicly available retention schedule and guidelines for

permanently destroying their fingerprints; and (4) obtain consent from them to disclose,

redisclose, or otherwise disseminate their fingerprints to a third party.

¶ 16 On July 2, 2019, Taylor was dismissed without prejudice from the complaint as her claims

were preempted because she was a party to a collective bargaining agreement. 3

¶ 17 On January 17, 2020, Northwestern 4 filed a motion to dismiss pursuant to section 2-619.1

(735 ILCS 5/2-619.1 (West 2018)) of the Code. Northwestern argued that the complaint should

be dismissed pursuant to section 2-619(a)(9) (id. § 2-619(a)(9)) because the General Assembly

specifically excluded information collected from healthcare treatment, payment, or operations

in the Act. Northwestern further argued that the complaint should be dismissed pursuant to

section 2-615 (id. § 2-615) for failure to state a claim because Northwestern did not store or

possess her biometric information in violation of the Act when it was used for healthcare

treatment, payment, or operations. Northwestern maintained that nothing in the Act was

3 The dismissal occurred after Northwestern removed this case to the Northern District of Illinois under case number 19 C 3191 (Mazya v. Northwestern Lake Forest Hospital, No. 19-CV-3191 (N.D. Ill. June 19, 2019)); the case was subsequently returned to the circuit court. 4 Defendants Omnicell Inc. and BD were dismissed from this complaint; however, the record does not reflect exactly when that occurred. We will address these defendants collectively as Northwestern for the remainder of this opinion.

-7- Nos. 1-20-0822 and 1-21-0895, cons.

intended to interfere with HIPAA and that applying it to their medication dispensing systems

would conflict with guidance previously given by the Department of Health and Human

Services (HHS), which encouraged the use of biometrics in health. Northwestern argued that

Mazya knew her information was being collected and had the power to withhold consent, citing

Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, ¶ 34, as support. Northwestern

further argued that Mazya failed to provide factual allegations supporting her conclusory

assertions that Northwestern’s conduct was intentional or reckless. Lastly, Northwestern

requested that Northwestern Memorial Hospital be dismissed from the proceedings, since

Taylor was dismissed. 5

¶ 18 On March 13, 2020, Mazya filed a response to Northwestern’s motion to dismiss, arguing

that her claims were actionable because they did not fall under any exemption under the Act

and the failure to comply with distinct requirements of the Act was all that she needed to

demonstrate. Mazya maintained that the Act’s explicit reference to biometric data taken from

a patient shows the intent of the General Assembly to exclude patient biometrics from the Act’s

protection because they were already protected by HIPAA. Mazya further maintained that if

the General Assembly wanted to provide a sweeping categorical exemption for hospitals it

would have done so as evidenced by the exclusion of financial institutions reflected in section

25(c) of the Act (740 ILCS 14/25(c) (West 2018)).

¶ 19 Northwestern filed a reply on April 3, 2020, arguing that Mazya’s interpretation of the Act

ignored the disjunctive “or” provided in section 10 of the Act, which connotes two different

alternatives, and thus the exemption included employee information. Northwestern maintained

5 The record reflects that on March 10, 2020, Mazya moved to voluntarily dismiss Northwestern Memorial Hospital from this action; however, the record does not reflect when the motion was granted.

-8- Nos. 1-20-0822 and 1-21-0895, cons.

that Mazya failed to rebut their argument that she failed to state a claim because her claims

were not supported by the language of the statute and were solely policy-based. Northwestern

further maintained that it would be good policy to interpret the statute their way given that the

usage of biometric information has been encouraged by the government.

¶ 20 On November 2, 2020, the circuit court denied Northwestern’s section 2-619.1 motion.

The circuit court found Northwestern’s section 2-619 argument unpersuasive because the

burden for compliance with the Act falls on the collector of the data, not the provider. Put

another way, Mazya did not waive her consent by continuing to offer her biometric data to

Northwestern as a condition of her duties as a nurse. The circuit court found that accepting

Northwestern’s interpretation of the Act would amount to medical professionals having no

protections for their biometric information. In regard to Northwestern’s section 2-615

arguments, the circuit court found that, to have a viable claim, (1) the claimant need not lack

knowledge of the violation, as the violation itself was enough to support the statutory cause of

action, and (2) the claimant was not required to plead an intentional or reckless violation of the

Act, at that stage of the proceedings.

¶ 21 On November 30, 2020, Northwestern filed a corrected motion for Rule 308 certification

and to stay the proceedings. Northwestern argued that there were substantial grounds for

difference of opinion given the disjunctive “or” in section 10. Northwestern further argued that

the proceedings should be stayed pending this court’s decision because our answer to the

question could expedite the resolution of the underlying case.

¶ 22 On December 11, 2020, Mazya filed a motion to strike Northwestern’s motion for

certification and stay. Mazya argued that Northwestern was trying to certify the same question

that this court denied in Mosby v. Ingalls Memorial Hospital, No. 1-20-0822, which led to the

-9- Nos. 1-20-0822 and 1-21-0895, cons.

circuit court’s denial of the defendant’s section 2-619.1 motion; therefore, the motion to certify

was frivolous and did not warrant interlocutory review.

¶ 23 Later, on January 13, 2021, Mazya filed a response in opposition to Northwestern’s motion

for Rule 308 certification and stay, reiterating her previous arguments and noting that

Northwestern had not lodged any new arguments or law on the matter.

¶ 24 On February 9, 2021, Northwestern filed a reply in further support of their Rule 308

motion, informing the circuit court that the Illinois Supreme Court directed this court to vacate

its August 24, 2020, order and accept the Rule 308 appeal (Mosby v. Ingalls Memorial

Hospital, No. 126590 (Ill. Jan. 27, 2021) (supervisory order)).

¶ 25 On February 9, 2021, the circuit court denied Northwestern’s Rule 308 motion but stayed

the proceedings pending the decision in Mosby.

¶ 26 On June 15, 2021, Northwestern filed a motion to reconsider the denial of their Rule 308

certification, arguing that the parties in Mosby reached a settlement in principle and that no

one would be presenting any arguments on appeal on behalf of a hospital that uses medication

dispensing systems secured by finger-scan technology. Mazya responded on June 22, 2021,

that plaintiffs were not opposed to the appellate court hearing a certified question.

¶ 27 On July 23, 2021, the circuit court granted the motion to reconsider and stayed the

proceedings, noting that the issue involves a question of law as to which there were substantial

grounds for difference of opinion and that an immediate appeal could materially advance the

ultimate termination of the litigation. Accordingly, the circuit court certified its question to this

court.

-10- Nos. 1-20-0822 and 1-21-0895, cons.

¶ 28 On July 27, 2021, Northwestern filed an application for leave to appeal pursuant to Rule

308 reiterating the arguments they made at the circuit court and requesting that the case be

consolidated with Mosby. We granted the motion on August 13, 2021.

¶ 29 On August 5, 2021, an amicus curiae brief was filed on behalf of the Illinois Health and

Hospital Association, Northwestern Memorial Healthcare, and Amita Health (collectively the

amici), in support of defendants’ position. They reiterated defendants’ arguments and also

argued that interpreting section 10 in favor of plaintiffs regarding the medical supply

dispensing systems at issue could result in undesirable consequences for healthcare providers.

The amici argued that plaintiffs’ interpretation could be financially burdensome and result in

a lower quality of care for patients.

¶ 30 II. ANALYSIS

¶ 31 On appeal, Northwestern contends that this court should answer the certified question in

the affirmative because the plain language of section 10 demonstrates that employee biometric

information used in medication dispensing systems is excluded from protections of the Act.

¶ 32 A. Jurisdiction

¶ 33 We have jurisdiction to review the certified question pursuant to Illinois Supreme Court

Rule 308 (eff. Oct. 1, 2019). In general, courts of appeal have jurisdiction to review only final

judgments entered in the circuit court unless there is a specific statutory exception or rule of

the supreme court. In re Estate of Luccio, 2012 IL App (1st) 121153, ¶ 17. Rule 308 is one

such exception that allows for the permissive appeal of an interlocutory order certified by the

circuit court, as involving a question of law, as to which there is substantial ground for

difference of opinion and where an immediate appeal may materially advance the ultimate

-11- Nos. 1-20-0822 and 1-21-0895, cons.

termination of the litigation. Id. Therefore, we are limited to answering the specific question

certified by the circuit court. Moore v. Chicago Park District, 2012 IL 112788, ¶ 9.

¶ 34 B. Standard of Review

¶ 35 When reviewing a certified question of law pursuant to Illinois Supreme Court Rule 308

(eff. Oct. 1, 2019), we apply a de novo standard of review. O’Halloran v. Luce, 2013 IL App

(1st) 113735, ¶ 31. De novo review is also appropriate because this resolution turns on a

question of statutory construction. Eighner v. Tiernan, 2020 IL App (1st) 191369, ¶ 8. “The

primary rule of statutory construction is to give effect to the intent of the legislature.” Ultsch

v. Illinois Municipal Retirement Fund, 226 Ill. 2d 169, 181 (2007). The statutory language

itself is the best evidence of legislative intent, which must be given its plain and ordinary

meaning. Id. The statute should be read as a whole. Id. “Where the meaning of a statute is

unclear from a reading of its language, courts may look beyond the statutory language and

consider the purpose of the law, the evils it was intended to remedy, and the legislative history

of the statute.” Id.

¶ 36 1. Plain Language

¶ 37 The Act on which the certified question is based defines “biometric information” as “any

information, regardless of how it is captured, converted, stored, or shared, based on an

individual’s biometric identifier used to identify an individual.” 740 ILCS 14/10 (West 2018).

The Act defines “biometric identifiers” as “a retina or iris scan, fingerprint, voiceprint, or scan

of hand or face geometry.” Id. The parties do not dispute that the fingerprint scan of plaintiff

and other similarly situated hospital employees is a biometric identifier and, when stored, this

fingerprint constitutes biometric information as outlined in the Act.

-12- Nos. 1-20-0822 and 1-21-0895, cons.

¶ 38 Section 10 of the Act provides exclusions to the protections of the Act; specifically at issue

is the following language:

“Biometric identifiers do not include information captured from a patient in a health care

setting or information collected, used, or stored for health care treatment, payment, or

operations under the federal Health Insurance Portability and Accountability Act of 1996.”

Id.

While section 25(c) and (e) expressly provides that the Act will not apply to certain entities and

persons:

“(c) Nothing in this Act shall be deemed to apply in any manner to a financial

institution or an affiliate of a financial institution that is subject to Title V of the federal

Gramm-Leach-Bliley Act of 1999 [(15 U.S.C. § 6803 (2018))] and the rules promulgated

thereunder.

***

(e) Nothing in this Act shall be construed to apply to a contractor, subcontractor,

or agent of a State agency or local unit of government when working for that State

agency or local unit of government.” Id. § 25(c), (e).

¶ 39 Northwestern and the amici contend that the hospital workers’ use of medication

dispensing systems falls within the Act’s definitional carveouts for health-related information.

Northwestern and the amici maintain that the medication dispensing system that is at issue in

this case is permitted to collect information for “healthcare treatment, payment, or operations”

as defined by HIPAA. 45 C.F.R. § 164.501(2) (2018). This includes the fingerprint scan of its

employees who facilitate the dispensing and administration of medications proscribed by

patients. Northwestern and the amici assert that the collection, use, and storage of healthcare

-13- Nos. 1-20-0822 and 1-21-0895, cons.

workers’ biometric information is for “health care” and “treatment” that Northwestern provides

to its patients and those terms are defined by HIPAA. Id. Northwestern and the amici contend

that this medication dispensing system also acts to provide an audit trail, which includes

diversion, fraud, and abuse detection. Northwestern and the amici assert that this system

additionally aids in patient safety, quality of care, and accurate billing. Northwestern and the

amici contend that the biometric information is collected through the medication dispensing

system and is also used for “health care operations” and “payment.”

¶ 40 Northwestern and the amici contend that the circuit court erred in finding that the carveouts

for health-related information apply only to information taken from a patient because the plain

language of the Act does not read to limit patient biometric data. Northwestern and the amici

maintain that biometric identifiers as defined by the Act included an “or” exception as they

pertain to health care information. Northwestern and the amici assert that “or” is disjunctive

and connotes two different alternatives. Northwestern and the amici assert that this “or”

indicates that a different category of exemptions is allowed and that this is not limited to patient

data. Northwestern and the amici maintain that, to fall within the exception of the Act, the

biometric information obtained must either (1) be obtained in a healthcare setting or (2) be

collected, used, or stored in connection with healthcare treatment, payment, and operations

under HIPAA.

¶ 41 Plaintiffs contend that the circuit court did not err in holding that Northwestern is not

exempt from the Act and that it excludes only patient biometric data from its protections

because patient data is already protected by HIPAA. Plaintiffs assert that this would in effect

leave thousands of hospital workers unprotected from the risks that the Act was designed to

protect against. Plaintiffs assert that Northwestern’s interpretation of how “or” creates two

-14- Nos. 1-20-0822 and 1-21-0895, cons.

clauses would make sense if the “under HIPAA” language was not present because patient

information is the only information governed by HIPAA.

¶ 42 Northwestern’s reply brief asserts that the storage of healthcare workers’ biometric

information, obtained when accessing a medication dispensing system, is for the ”health care”

and “treatment” of patients as those terms are defined by HIPAA; therefore, the “under

HIPAA” language does not exclude this type of information.

¶ 43 We find that the language of the statute is clear and simple disagreement between the

parties will not create ambiguity in the statute. Kaider v. Hamos, 2012 IL App (1st) 111109,

¶ 11. What is excluded from the protections of section 10 are (1) information from the patient

in a healthcare setting and (2) information that is already protected “under the federal Health

Insurance Portability and Accountability Act of 1996.” 740 ILCS 14/10 (West 2018). Even

taking into consideration the disjunctive “or,” section 10 still has the same effect of excluding

those two classifications of information. Indeed, the disjunctive “or” means that patient

information and information under HIPAA are alternatives that are to be considered separately.

Goldberg v. Brooks, 409 Ill. App. 3d 106, 111 (2011).

¶ 44 At oral argument, Northwestern argued that this court should not consider the terminology

“under HIPAA” and instead we should consider this as “defined by HIPAA.” However, “under

HIPAA” is what the Act expressly states, and that cannot be ignored. We are simply unable to

rewrite the statute. Zahn v. North American Power & Gas, LLC, 2016 IL 120526, ¶ 15. Either

way, the biometric information of employees is simply not defined or protected “under

HIPAA.” Accordingly, the plain language of the statute does not exclude employee

information from the Act’s protections because they are neither (1) patients nor (2) protected

under HIPAA. We further find that, if the legislature intended to create a wide-ranging

-15- Nos. 1-20-0822 and 1-21-0895, cons.

exemption for hospitals, it would have done so, since the Act does contain a separate blanket

exclusion. This is demonstrated in the Act when the legislature expressly provided that the Act

was not to apply to financial institutions subject to Title V of the federal Gramm-Leach-Bliley

Act of 1999 and employees, contractors, or subcontractors of local government or the State as

provided in section 25. 740 ILCS 14/25 (West 2018).

¶ 45 Northwestern’s inclusion of employee’s biometric information under the exclusion

goes beyond the plain language of the Act. We are unable to rewrite the statute to add

provisions or limitations that the legislature did not include. Zahn, 2016 IL 120526, ¶ 15. No

rule of construction permits this court to declare that the legislature did not mean what the plain

language of the statute imports. Id. There is simply no provision or reference to the protection

of employee biometric data in the Act or in HIPAA. Thus, we will not add employee biometric

data as information to be excluded by the Act because it would be contrary to the plain

language of the Act. Based thereon, we need not consider other sources in order to find the

statutory meaning. Kaider, 2012 IL App (1st) 111109, ¶ 11.

¶ 46 III. CONCLUSION

¶ 47 Consistent with the plain language of the Act, we find that the legislature did not exclude

employee biometric information from its protections, and we answer the certified question in

the negative. We remand this cause for further proceedings consistent with this opinion.

¶ 48 Certified question answered; cause remanded.

-16- Nos. 1-20-0822 and 1-21-0895, cons.

No. 1-20-0822

Decision Under Review: Appeal from the Circuit Court of Cook County, Nos. 18-CH- 05031, 18-CH-07161; the Hon. Pamela McLean Meyerson and the Hon. Alison C. Conlon, Judges, presiding.

Attorneys Joseph A. Strubbe, Frederic T. Knape, and Zachary J. Watters, for of Vedder Price P.C., and Gary M. Miller, Matthew C. Wolfe, Appellant: and Elisabeth A. Hutchinson, of Shook, Hardy & Bacon L.L.P., both of Chicago, for appellants Ingalls Memorial Hospital, UCM Community Health & Hospital Division, Inc., and Becton, Dickinson and Company.

Joel Griswold and Bonnie Keane DelGobbo, of Baker & Hostetler LLP, of Chicago, for other appellants.

Attorneys James B. Zouras, Ryan F. Stephan, Andrew C. Ficzko, Catherine for T. Mitchell, and Paige L. Smith, of Stephan Zouras, LLP, of Appellee: Chicago, for appellees.

Amici Curiae: Michael A. Woods, of Naperville, and Richard H. Tilghman, of Nixon Peabody LLP, and Bonnie Keane DelGobbo and Joel Griswold, of Baker & Hostetler LLP, both of Chicago, for amici curiae Illinois Health and Hospital Association et al.

-17-