Verity v. Herrin Rehabilitation & Nursing Center, LLC

2025 IL App (5th) 240785-U

• Court: Appellate Court of Illinois
• Decided: April 9, 2025
• Docket: 5-24-0785
• Status: Unpublished

Opinion

NOTICE 2025 IL App (5th) 240785-U NOTICE Decision filed 04/09/25. The This order was filed under text of this decision may be NO. 5-24-0785 Supreme Court Rule 23 and is changed or corrected prior to not precedent except in the the filing of a Petition for IN THE limited circumstances allowed Rehearing or the disposition of under Rule 23(e)(1). the same. APPELLATE COURT OF ILLINOIS

FIFTH DISTRICT ______________________________________________________________________________

ELIZABETH VERITY and JESSICA CHRISTIE, ) Appeal from the on Behalf of Themselves and All Other Persons ) Circuit Court of Similarly Situated, Known and Unknown, ) Williamson County. ) Plaintiffs-Appellants, ) ) v. ) No. 20-L-41 ) HERRIN REHABILITATION AND NURSING ) CENTER, LLC, d/b/a Integrity Healthcare of Herrin, ) Honorable ) Jeffrey A. Goffinet, Defendant-Appellee. ) Judge, presiding. ______________________________________________________________________________

JUSTICE CATES delivered the judgment of the court. Justices Boie and Sholar concurred in the judgment.

ORDER

¶1 Held: The circuit court erred in dismissing the plaintiffs’ class action complaint where the defendant failed to meet its burden of establishing that an affirmative matter defeated the plaintiffs’ claims.

¶2 The plaintiffs, Elizabeth Verity and Jessica Christie, appeal the circuit court’s order

dismissing their class action complaint. The plaintiffs claim that the circuit court incorrectly

applied the “attached-papers” and “particularity” requirements of Illinois Supreme Court Rule

191(a) (eff. Jan. 4, 2013); the circuit court incorrectly held that certain timekeeping activities for

employees fell within the Biometric Information Privacy Act’s (BIPA) 1 healthcare exemption; and

1 Biometric Information Privacy Act (BIPA) (740 ILCS 14/1 et seq. (West 2020)). 1 the circuit court improperly dismissed the plaintiffs’ lawsuit as a result of its rulings. For the

following reasons, we reverse and remand for further proceedings.

¶3 I. BACKGROUND

¶4 Both Verity and Christie were certified nursing assistants (CNA) and they worked for the

defendant, Herrin Rehabilitation and Nursing Center, LLC. Verity was employed from

approximately June of 2016 to January of 2017, and Christie was employed from approximately

July of 2019 to November of 2019. During those time periods, the defendant required the plaintiffs,

and other employees, to scan their hands using a biometric timeclock. Each employee was required

to scan their hand when they started and ended their workday and when they started and finished

their lunch breaks.

¶5 The plaintiffs filed a three-count class action complaint on April 6, 2020, which alleged

that the defendant violated the Biometric Information Privacy Act (BIPA) (740 ILCS 14/1 et seq.

(West 2020)) by unlawfully collecting hand geometry scans, using a biometric timeclock. The

plaintiffs claimed that the hand geometry scans qualified as biometric identifiers 2 under BIPA and

that the collection of these biometric identifiers violated BIPA because the collection of these

biometric identifiers compromised the privacy and security of the biometric identifiers and

biometric information 3 of the plaintiffs and other similarly situated employees. 4

¶6 Specifically, in count I of the complaint, the plaintiffs alleged that the defendant violated

section 15(b) of BIPA (740 ILCS 14/15(b) (West 2020)), where the plaintiffs had acquired and

2 BIPA defines “biometric identifier” as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” 740 ILCS 14/10 (West 2020). 3 BIPA defines “biometric information” as “any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual.” 740 ILCS 14/10 (West 2020). 4 Plaintiffs brought this cause of action on behalf of themselves and a class of other similarly situated employees. The term “plaintiffs” as used herein refers generally to the individual plaintiffs and the purported class unless otherwise specifically identified. 2 retained biometric information from the plaintiffs’ hand geometry scans without first informing

the plaintiffs and other similarly situated employees in writing that defendant was doing so. The

defendant additionally failed to inform the plaintiffs of the purpose of the collection of personal

identifying information and the length of time the biometric identifiers and biometric information

would be stored. Count I further alleged that the defendant had not obtained plaintiffs’ consent or

other form of release allowing defendant to collect the biometric identifiers and/or biometric

information. In count II, the plaintiffs alleged violations of section 15(a) of BIPA (740 ILCS

14/15(a) (West 2020)), where the defendant possessed personal identifying information obtained

from the plaintiffs’ hand geometry scans without creating and following a written policy, made

available to the public, establishing a retention schedule and destruction guidelines. In count III,

the plaintiffs alleged violations of section 15(d) of BIPA (740 ILCS 14/15(d) (West 2020)) where

the defendant disclosed or otherwise disseminated the plaintiffs’ hand geometry scans and personal

identifying information to defendant’s timekeeping vendor, without first obtaining plaintiffs’

consent for such disclosure or dissemination.

¶7 The defendant requested a stay in this proceeding pending the resolution of other BIPA

cases pending in various courts throughout Illinois. The initial request for a stay was followed by

subsequent motions for renewed stays. An agreed order was entered on October 25, 2021, whereby

the defendant was ordered to file a responsive pleading to the plaintiffs’ class action complaint by

November 30, 2021.

¶8 The defendant filed a motion to dismiss the class action lawsuit pursuant to section 2-619.1

of the Code of Civil Procedure (735 ILCS 5/2-619.1 (West 2020)) on November 30, 2021. The

defendant argued, in its written motion, that the plaintiffs’ claims were untimely under a one-year

statute of limitations; that the plaintiffs failed to plead facts to establish harm caused by a BIPA

3 violation; that the plaintiffs lacked standing; that the plaintiffs failed to allege specific facts

regarding the disclosure of biometric information to an unidentified third party timekeeping vendor

and that any such disclosure by defendant would be exempt from BIPA requirements because the

disclosure would have been to effectuate a financial transaction; and that the plaintiffs’ exclusive

remedy for workplace injury damages was through the Illinois Workers’ Compensation Act (820

ILCS 305/1 et seq. (West 2020)).

¶9 On January 5, 2022, the defendant filed a renewed motion to stay proceedings. The circuit

court entered a stay in this action pending decisions by the Illinois Supreme Court in three BIPA

cases: Cothron v. White Castle System, Inc., 2023 IL 128004, McDonald v. Symphony Bronzeville

Park, LLC, 2022 IL 126511, and Tims v. Black Horse Carriers, Inc., 2023 IL 127801. The stay

was lifted on February 28, 2023. The defendant subsequently sought to continue the stay of the

proceedings based on pending litigation in another BIPA case, Mosby v. Ingalls Memorial

Hospital, 2023 IL 129081, which the circuit court denied.

¶ 10 The circuit court allowed the defendant to file an amended section 2-619.1 motion to

dismiss. See 735 ILCS 5/2-619.1 (West 2022). The defendant argued in its amended motion that

the matter was barred by the BIPA healthcare exceptions regarding healthcare treatment, payment,

and operations; the plaintiffs lacked standing; the allegations were insufficient as to possession

and disclosure of the biometric data; that the plaintiffs failed to allege specific facts regarding the

disclosure of biometric information to an unidentified third party timekeeping vendor and that any

such disclosure by defendant would be exempt from BIPA requirements because the disclosure

would have been to effectuate a financial transaction; the plaintiffs’ allegations did not support a

claim that the defendant acted recklessly or that the defendant proximately caused the plaintiffs

4 actual harm; and the plaintiffs assumed the risk of disclosure. The circuit court denied the 2-619.1

motion to dismiss in a written order entered on November 2, 2023.

¶ 11 The defendant filed an answer and affirmative defenses on November 27, 2023. The

defendant denied multiple allegations in the complaint including many of the background facts

alleged by the plaintiffs regarding the data captured from the defendant’s biometric timeclock and

the biometric identifiers and information disclosed to the defendant’s timekeeping vendor. The

defendant additionally denied multiple other allegations in the complaint, such as the plaintiffs’

allegation that the defendant had achieved a labor management benefit from using a biometric

timeclock.

¶ 12 Shortly after the defendant filed its answer and affirmative defenses, the Illinois Supreme

Court issues an opinion in Mosby v. Ingalls Memorial Hospital, 2023 IL 129081. After the Mosby

decision was issued, the defendant filed a supplemental motion to dismiss pursuant to section 2-

619(a)(9) of the Code of Civil Procedure (735 ILCS 5/2-619(a)(9) (West 2022)) and relied on

Mosby, 2023 IL 129081. In Mosby, nurses’ biometric information obtained from a medication

dispensing system used for patient care was excluded from coverage under BIPA. See Mosby,

2023 IL 129081. Mosby determined that “information collected, used, or stored for health care

treatment, payment, or operations under [HIPAA 5]” was exempt from BIPA requirements. Mosby,

2023 IL 129081, ¶ 54. Based on Mosby, the defendant argued that the individual plaintiffs, and the

proposed class, were healthcare workers and the data allegedly collected from the use of a

timeclock was used by the defendant for healthcare operations and payments. Thus, according to

5 “HIPAA” refers to the federal Health Insurance Portability and Accountability Act of 1996. See 45 C.F.R. § 164.501 (2018). 5 the defendant, the plaintiffs’ BIPA claims failed as the alleged biometric data fell within certain

specific statutory exemptions.

¶ 13 In support of its supplemental motion to dismiss, the defendant attached an affidavit from

Kelly Kelley, the chief executive officer (CEO) of Integrity Healthcare Communities. Kelley

averred that her affidavit was based on her personal knowledge. Kelley’s affidavit also included

the following statement:

“In my role, I routinely review the records discussed in this Affidavit as part of my regular duties. Based on my experience, I can attest that the business records that I have reviewed for purposes of this Affidavit were made at or near the time of the event they record, and made and kept in the ordinary course of Herrin’s business of operating a skilled nursing facility.”

¶ 14 Kelley’s affidavit made numerous references to “punch data,” which she identified as the

data generated from the plaintiffs and other workers when they scanned their hands on the

timeclock. Kelley averred that the defendant used the “punch data” to prepare and audit its staffing

requirements; to know which employees were on site; to prepare its required annual financial and

statistical report; to prepare a portion of an annual report; to submit direct care staffing information;

to prepare quarterly staffing reports; to investigate, resolve, and combat issues involving patient

safety, facility sanitation, and fraud and abuse prevention; to identify each employee clocking in

to prevent time fraud; to demonstrate compliance with Medicaid and Medicare regulations; to

investigate allegations of possible drug diversion; to investigate complaints of patient treatment;

to maintain certified nursing assistant (CNA) certification status; for use in business planning and

other general administrative activities; and to confirm compliance with requirements that patients

received medically-related social services. A 2019 financial statement was attached to the

affidavit, but “punch data,” or other documents that referenced “punch data,” were not attached.

6 ¶ 15 The plaintiffs responded to the defendant’s 2-619 motion to dismiss and argued that the

defendant’s timekeeping activities were not exempt under BIPA. The plaintiffs additionally

claimed that Kelley’s affidavit failed to comply with Illinois Supreme Court Rule 191(a) (eff. Jan.

4, 2013), as it included many conclusory allegations and lacked exhibits to support and/or verify

those conclusory allegations. The plaintiffs further claimed that the only attachment, a 2019

financial report, was insufficient and noted that Verity was employed prior to 2019.

¶ 16 The plaintiffs, in their response, also argued that the “punch data” description provided in

the affidavit was unclear. The “punch data” may refer to the biometric hand geometry scan

identifiers or it could refer to the summary data used to determine the dates and times that the

employees clocked into and out of work. The plaintiffs assumed that the “punch data” referenced

was not the biometric data identified in the complaint and argued that the use of the summary data

would not excuse the defendant from liability. Furthermore, the plaintiffs claimed that if the

“punch data” were the biometric data identified in the complaint, the data was not used for

healthcare “payment” or “operations” under HIPAA and no exemption applied.

¶ 17 The plaintiffs attached copies of emails to the response to the motion to dismiss which

demonstrated that the parties had engaged in discovery. The defendant, however, had not produced

any documents. Specifically, no “punch data” had been produced prior to the motion to dismiss

hearing.

¶ 18 During the hearing on the defendant’s supplemental motion to dismiss, the defendant

argued that an exclusion applied to BIPA which allowed the healthcare industry to use biometric

information for treatment, payment, or operations as defined by HIPAA. The defendant claimed

that it used the hand geometry scan data for purposes that fell within the operations and payment

prongs of the HIPAA. Without the biometric data generated from the plaintiffs’ use of the

7 timeclocks, the defendant argued that it would not have been able to comply with reporting

requirements. The data was also allegedly used for payment purposes, used to ensure compliance

with regulations, and used for other activities such as obtaining reimbursements from Medicaid

and Medicare programs.

¶ 19 The defendant further argued that Kelley’s affidavit was unrebutted, and that the affidavit

was compliant with Rule 191(a) where Kelley’s affidavit was based on personal knowledge and

experience. See Ill. S. Ct. R. 191(a) (eff. Jan. 4, 2013). The defendant argued that the financial

statement referenced in the affidavit was attached and was sufficient to satisfy the “attached-

papers” requirement of Rule 191(a). See Ill. S. Ct. R. 191(a) (eff. Jan. 4, 2013). The defendant also

argued that Kelley had clearly stated facts on which she based her opinion.

¶ 20 In response, the plaintiffs argued that Kelley’s affidavit was not compliant with Rule 191(a)

and, therefore, the burden never shifted to the plaintiffs to provide a counteraffidavit. See Ill. S.

Ct. R. 191(a) (eff. Jan. 4, 2013). The plaintiffs claimed the affidavit did not comply with the

“attached-papers” requirement or the “particularity” requirement. Kelley had stated in her affidavit

that she reviewed documents for the purpose of drafting her affidavit and referred to “punch data,”

which she failed to attach.

¶ 21 The plaintiffs additionally argued that discovery was necessary to review the “punch data”

and to make a determination if “punch data” was the same data as described in the complaint. The

plaintiffs believed that Kelley’s described “punch data” was summary data, such as an Excel

spreadsheet, and not a hand scan or a mathematical representation of a hand scan. If the “punch

data” referred to by Kelley was summary data, then that data was not specific to the claims related

to the hand geometry scans identified in the plaintiffs’ complaint.

8 ¶ 22 The plaintiffs further argued that Kelley had not used the data identified in the complaint

for anything defined as a “healthcare payment” and/or “operations,” and that HIPAA’s definition

of “healthcare operations” did not encompass everything that occurs in a healthcare setting. Even

if the circuit court accepted every fact in Kelley’s affidavit, including that Kelley had referred to

biometric data which was used for healthcare payment and operations, the plaintiffs argued that

the circuit court would not have specific enough information to grant the motion to dismiss because

Kelley had not identified when the data was used for healthcare payment and operations. The

plaintiffs requested that the circuit court deny the motion to dismiss because questions remained

regarding the amount of data and when the data was used for healthcare payment and operations.

¶ 23 Nevertheless, the defendant sought dismissal of the complaint based on allegations of its

use of “punch data” that it failed to provide to the court. The circuit court took the matter under

advisement.

¶ 24 The circuit court entered a written order granting the defendant’s supplemental motion to

dismiss with prejudice. The circuit court found that

“any alleged biometric identifiers and biometric information generated from the use of Defendant’s timeclock fall under the Biometric Information Privacy Act’s (‘BIPA’) statutory exemption for ‘information collected, used, or stored for health care treatment, payment, or operations under [HIPAA],’ and are therefore not subject to the BIPA’s requirements. See 740 ILCS 14/10.”

¶ 25 The plaintiffs filed a motion to reconsider the circuit court’s order of dismissal. The circuit

court denied the motion to reconsider. This appeal followed.

¶ 26 II. ANALYSIS

¶ 27 On appeal, the plaintiffs challenge the circuit court’s order granting the defendant’s section

2-619(a)(9) motion to dismiss where the defendant solely relied on Kelley’s affidavit. See 735

ILCS 5/2-619(a)(9) (West 2022). The plaintiffs argue that Kelley’s affidavit was insufficient, and

9 the circuit court incorrectly applied the “attached-papers” requirement and the “particularity”

requirement of Illinois Supreme Court Rule 191(a) (eff. Jan. 4, 2013). The plaintiffs additionally

argue that the circuit court improperly dismissed the action based on its finding that the defendant’s

timekeeping activities for employees fell within BIPA’s healthcare exemption.

¶ 28 A section 2-619(a)(9) motion to dismiss asserts that a claim against the defendant is barred

by an affirmative matter avoiding the legal effect of or defeating the claim while admitting the

legal sufficiency of the complaint. Kuykendall v. Schneidewind, 2017 IL App (5th) 160013, ¶ 32.

“An ‘affirmative matter’ is a type of defense that negates a cause of action completely or refutes

critical conclusions of law or conclusions of material fact that are unsupported by specific factual

allegations contained in or inferred from the complaint.” Kuykendall, 2017 IL App (5th) 160013,

¶ 32. Initially, the defendant has the burden of establishing that an affirmative matter defeats the

plaintiffs’ claim. Kuykendall, 2017 IL App (5th) 160013, ¶ 32. Then, the burden shifts to the

plaintiffs, who must establish that the affirmative defense is “ ‘unfounded or requires the resolution

of an essential element of material fact before it is proven.’ ” Epstein v. Chicago Board of

Education, 178 Ill. 2d 370, 383 (1997) (quoting Kedzie &103rd Currency Exchange, Inc. v. Hodge,

156 Ill. 2d 112, 116 (1993)).

¶ 29 A section 2-619 motion to dismiss should only be granted if the plaintiffs cannot prove a

set of facts that would support the cause of action. In re Estate of Boyar, 2013 IL 113655, ¶ 27. “If

defendant’s evidence in support of a section 2-619(a)(9) motion does nothing more than refute the

well-pleaded allegations of the complaint, the complaint trumps that evidence, and dismissal is

improper.” Doe v. University of Chicago Medical Center, 2015 IL App (1st) 133735, ¶ 43. A

summary judgment motion is the appropriate procedural tool to use when addressing the

complaint’s factual allegations. Kuykendall, 2017 IL App (5th) 160013, ¶ 32. The standard of

10 review of a section 2-619 motion to dismiss is de novo. Krilich v. American National Bank & Trust

Co. of Chicago, 334 Ill. App. 3d 563, 571 (2002).

¶ 30 The circuit court may consider affidavits when deciding a section 2-619(a)(9) motion to

dismiss an affirmative matter, if such a matter is not apparent on the face of the complaint. Epstein,

178 Ill. 2d at 383. Under Illinois Supreme Court Rule 191(a),

“affidavits submitted in connection with a motion for involuntary dismissal under section 2-619 of the Code of Civil Procedure *** shall be made on the personal knowledge of the affiants; shall set forth with particularity the facts upon which the claim, counterclaim, or defense is based; shall have attached thereto sworn or certified copies of all documents upon which the affiant relies; shall not consist of conclusions but of facts admissible in evidence; and shall affirmatively show that the affiant, if sworn as a witness, can testify competently thereto.” Ill. S. Ct. R. 191(a) (eff. Jan. 4, 2013).

¶ 31 The provisions of Supreme Court Rule 191(a) should be adhered to as written and

construed according to the plain and ordinary meaning of its language. Robidoux v. Oliphant, 201

Ill. 2d 324, 347 (2002). “The requirement that documents be attached is not a mere ‘technicality’

and, if not adhered to, is fatal.” Selby v. O’Dea, 2020 IL App (1st) 181951, ¶ 136. Strict compliance

with Supreme Court Rule 191(a) ensures that the circuit court is presented with valid evidentiary

facts upon which to base a decision. Robidoux, 201 Ill. 2d at 336.

¶ 32 In Doe v. Coe, the defendants argued that the “attached-papers” requirement of Rule 191(a)

did not mandate the attachment of documents where the affiants professed personal knowledge.

Doe v. Coe, 2017 IL App (2d) 160875, ¶ 11. The affiants in Coe specified the documents in support

of their assertions and thereby relied on the documents within the meaning of Rule 191(a). Coe,

2017 IL App (2d) 160875, ¶ 11. The documents were, nevertheless, required to be attached as they

would have allowed the circuit court the opportunity to review the bases for the assertions in the

affidavits. Coe, 2017 IL App (2d) 160875, ¶ 11. Similarly, in Direct Auto Insurance Co. v. Betran,

an affidavit which referenced documents failed to comply with the requirements of Rule 191(a)

11 where the supporting documents were not attached. Direct Auto Insurance Co. v. Betran, 2013 IL

App (1st) 121128, ¶ 64.

¶ 33 The plaintiffs’ complaint alleged multiple BIPA violations based on the use of a biometric

timeclock which allegedly compromised the privacy and security of the biometric identifiers and

information of the individual plaintiffs and other similarly situated employees. BIPA defines

“biometric information” as “any information, regardless of how it is captured, converted, stored,

or shared, based on an individual’s biometric identifier used to identify an individual.” 740 ILCS

14/10 (West 2020). BIPA defines “biometric identifier” as “a retina or iris scan, fingerprint,

voiceprint, or scan of hand or face geometry.” 740 ILCS 14/10 (West 2020).

¶ 34 The defendant argued that BIPA’s healthcare exemption barred the plaintiffs’ claims in the

defendant’s section 2-619(a)(9) motion to dismiss. Under BIPA, biometric identifiers “do not

include information captured from a patient in a health care setting or information collected, used,

or stored for health care treatment, payment, or operations under the federal Health Insurance

Portability and Accountability Act of 1996.” 740 ILCS 14/10 (West 2020). Under Mosby, a

biometric identifier exemption applied where a healthcare worker’s biometric information was

used to permit access to medication dispensing stations for patient care. Mosby, 2023 IL 129081,

¶ 54.

¶ 35 In support of the defendant’s 2-619(a)(9) motion to dismiss, the defendant provided a

single affidavit from Kelley which claimed that the defendant used employees’ “punch data” for

healthcare operations and payments and claimed that biometric identifier exemptions applied.

Kelley made specific and repeated references to “punch data,” which she defined as the data

generated from the plaintiffs and other workers scanning their hands on the timeclock. The “punch

data” description was vague. The review of a hand geometry scan would not likely produce the

12 information that Kelley referenced as “punch data,” used for multiple functions including the

preparation of audits and reports, or to demonstrate compliance with regulations. Although Kelley

averred that her affidavit was based on personal knowledge, Kelley also stated that she had

reviewed business records for the purpose of drafting her affidavit. However, no “punch data”

documents or other business records were attached to Kelley’s affidavit.

¶ 36 The plaintiffs additionally argue that the circuit court improperly dismissed the action

based on its finding that the defendant’s timekeeping activities for employees fell within BIPA’s

healthcare exemption. We note that the defendant filed an answer prior to filing the supplemental

motion to dismiss and had denied multiple allegations in the complaint. For instance, the defendant

denied that it received a labor management benefit from using the biometric timeclock. The

defendant additionally denied background facts such as capturing or collecting the plaintiffs’

unique biometric identifiers and information and sharing those identifiers and information with its

timekeeping vendor.

¶ 37 Kelley averred that the “punch data” was used for numerous purposes and the information

was collected, used, or stored for healthcare treatment, payment, or operations. Yet, it is unknown

if “punch data” is the same information that the plaintiffs referred to in the complaint as the unique

biometric identifiers and information which was shared with the defendant’s timekeeping vendor

where the “punch data” has not been produced.

¶ 38 Because Kelley relied on “punch data” in her affidavit, she was required under Rule 191(a)

to have attached thereto sworn or certified copies of the “punch data” documents which she had

reviewed and/or upon which she relied. See Ill. S. Ct. R. 191(a) (eff. Jan. 4, 2013). The only

document attached was conclusory and did not reference “punch data.” Therefore, Kelley’s

affidavit fails to comply with the requirements of Rule 191(a). See Ill. S. Ct. R. 191(a) (eff. Jan. 4,

13 2013). Without further particularity and compliance with the “attached-papers” requirement, the

circuit court erred in granting the defendant’s 2-619(a)(9) motion to dismiss as the defendant failed

to meet its burden of establishing that an affirmative matter defeated the plaintiffs’ claims.

¶ 39 III. CONCLUSION

¶ 40 For the foregoing reasons, we reverse the judgment of the circuit court of Williamson

County and remand for further proceedings.

¶ 41 Reversed and remanded.