The Appellate Court of Illinois ruled on August 31, 2026, that biometric data collected from employees for timekeeping purposes is not exempt from the Biometric Information Privacy Act (BIPA). This decision affects healthcare facilities that use biometric systems for employee management. The ruling clarifies the legal boundaries regarding employee biometric data and its protections under Illinois law.
The case, Townsend v. Estates of Hyde Park, LLC, involved Debra Townsend, a former nurse at the Estates of Hyde Park, a rehabilitation and long-term care facility in Cook County. Townsend filed a class action lawsuit claiming that her employer violated the BIPA by improperly collecting and using biometric data, specifically hand scans, without proper consent and disclosures. The court's ruling is significant as it addresses the intersection of employee privacy rights and healthcare regulations.
In 2019, Townsend alleged that the facility required employees to use hand scans for clocking in and out, which constituted a violation of the BIPA. The facility argued that these hand scans were necessary for compliance with federal and state healthcare regulations, claiming that payroll records generated from these scans fell under the category of health care operations exempt from the BIPA. The trial court initially denied the facility's motion for judgment on the pleadings, leading to the appeal.
The appellate court's ruling focused on a certified question from the trial court: whether biometric data collected by a healthcare provider for timekeeping is exempt from the BIPA under the definition of health care operations as outlined in the Health Insurance Portability and Accountability Act (HIPAA). The court ultimately ruled that the payroll records generated from the biometric timekeeping system do not qualify as health care operations under HIPAA.
Justice Oden Johnson, who delivered the court's opinion, stated, "We answer the certified question in the negative: defendant’s payroll records are not exempt from the Act." The court emphasized that the exemption under the BIPA applies only to specific health care operations involving patient care, not general employee management practices.
The ruling clarified that biometric identifiers, including hand scans, are protected under the BIPA unless explicitly exempted by law. The court referenced the Illinois Supreme Court's previous decision in Mosby v. Ingalls Memorial Hospital, which highlighted the need for a patient-specific connection for HIPAA exemptions to apply. The appellate court noted that the hand scans used for timekeeping did not relate to individual patient care and therefore did not meet the criteria for exemption.
This ruling has significant implications for healthcare employers across Illinois. It reinforces the importance of compliance with biometric privacy laws and highlights the need for employers to ensure that they are transparent about the collection and use of biometric data. Employers must provide clear information regarding the purpose of data collection, retention schedules, and guidelines for data destruction.
The decision also sets a precedent for similar cases in the future, indicating that courts may closely scrutinize claims of exemption under the BIPA, especially when it comes to employee biometric data. This ruling may prompt healthcare facilities and other employers to reevaluate their biometric data practices to ensure compliance with state laws.
Looking ahead, the Estates of Hyde Park has the option to appeal the ruling to the Illinois Supreme Court. However, the appellate court's decision may stand as a significant legal precedent regarding the treatment of biometric data in the workplace. As biometric technology continues to evolve, this case underscores the necessity for employers to stay informed about legal obligations and employee rights concerning biometric information.
In summary, the Appellate Court of Illinois has ruled that biometric data collected from employees for timekeeping purposes is not exempt from the protections of the Biometric Information Privacy Act. This decision is a crucial development in the ongoing conversation about privacy rights in the workplace, particularly in the healthcare sector.