Heard v. Becton, Dickinson and CompanyHeard v. Becton, Dickinson and Company
Case Information
UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION
COREY HEARD, individually and on behalf of )
all others similarly situated, )
)
Plaintiff, )
) v. ) Case No. 19 C 4158
) BECTON, DICKINSON & CO. ) Judge Rebecca R. Pallmeyer
)
Defendant. )
MEMORANDUM OPINION AND ORDER
Since 2015, Plaintiff Corey Heard has worked as a respiratory therapist at several
hospitals in Illinois that use the Pyxis MedStation system—an automated medication dispensing
system manufactured by Defendant Becton, Dickinson and Company ("BD"). A user gains access
to Pyxis devices by scanning his fingerprint. Heard alleges that he "was required" to access Pyxis
devices with his fingerprint "[a]s a condition of his employment" at the hospitals. (Compl. [1-
1] ¶ 50.) He has sued BD on behаlf of a putative class for allegedly collecting, storing, and
disseminating biometric data—specifically, fingerprints—in violation of the Illinois Biometric
Information Privacy Act,
BACKGROUND
The court recounts the following facts from Heard's Complaint. BD is a leading manufacturer and seller of medical technology, including the Pyxis MedStation system and related Pyxis devices (hereinafter, "Pyxis" or "Pyxis devices"). (Compl. ¶ 1.) As noted, Pyxis devices "require . . . users to scan a fingerprint" for access to the system and the medication it dispenses. ( Id. ¶¶ 1-2.) "[W]hen an employee first begins work at a company that uses a Pyxis device," he is "required to have [his] fingerprint or palm print scanned in order to enroll [him] in the Pyxis database." ( Id. ¶ 38.) Once the employee has done so, he has "access to multiple Pyxis devices" at his place of employment. ( Id. ¶ 2.) BD "markets its Pyxis devices . . . as superior" to other medication-disbursement methods by emphasizing that they "improve[] precision and accurаcy of user access via biometric information." ( Id. ¶ 42.) BD "provides Pyxis devices to dozens of hospitals" in Illinois. ( Id. ¶ 1.)
Between 2015 and the present, Heard has worked for at least five hospitals (the "Hospitals") that use Pyxis devices. ( Id. ¶ 49.) "As a condition of employment" at the Hospitals, Heard "was required to scan his fingerprint so it could be used as an authentication method to access the Pyxis devices." ( Id. ¶ 50.) BD "subsequently stored [Heard's] fingerprint data in their systems." ( Id. ¶ 51; see also id. ¶ 44 (аlleging that BD has "assembl[ed] a database of biometric data through broadly deployed fingerprint scanners").) The Hospitals, too, "subsequently stored [Heard's] fingerprint data in their systems." ( Id. ¶ 52.) Heard was "required to scan his fingerprint each time he accessed the Pyxis devices." ( Id. ¶ 53.) Heard alleges "[u]pon information and belief" that BD "improperly discloses Pyxis user's [sic] fingerprint data to other, currently unknown, third parties, including but not limited to third parties that host biometric data in their data center(s)." ( Id. ¶ 11.)
The BIPA "imposes numerous restrictions on how private entities collect, retain, disclose
and destroy biometric identifiers," including fingerprints.
Rosenbach v. Six Flags Entm't Corp.
,
In recent months, employees who have been subject to fingerprint scans have brought
suit against their employers under the BIPA.
[1]
In this case, Heard sues the manufacturer of the
fingerprint scanning device itself, Defendant BD. He alleges that BD never informed him or
similarly situated individuals that it was collecting, using, or storing their biometric data, and never
statеd the purpose and length of time for which it was doing so, in violation of
DISCUSSION
A motion to dismiss under
A. Whether the BIPA's "Health Care Exemption" Is Limited to Patient Information
BD argues that the court should dismiss Heard's claims outright because, according to
BD, the biometric data at issue falls under a "health care exemption" to the BIPA, which can be
found in the Act's definition of biometric identifiers. (BD Mem. in Supp. of Mot. to Dismiss ("BD
Mot.") [16], 4.) The definition states, in relevant part, that "[b]iometric identifiers
do not include
information captured from a patient in а health care setting
or
information collected, used, or
stored for health care treatment, payment, or operations under the federal Health Insurance
Portability and Accountability Act of 1996 ["HIPAA"]."
The court is aware of only two other cases in which defendants have advanced this theory.
Both were in Illinois circuit courts, and the courts reached opposite conclusions concerning the
theory's viability. ( Ex. A to BD Reply in Supp. of Mot. to Dismiss [29-1],
Diaz v. Silver Cross
Hosp. & Med. Ctrs.
, No. 2018 CH 001327 (Cir. Ct. of Ill. Will Cnty.), Aug. 29, 2019 Hrg. Tr. 4:1-6,
19:16-18, 21:11-24 (determining that HIPAA protects not only data that is "patient-driven," but
also data that "relates to the patient" in a "secondary" sense; finding that a plaintiff-nurse's
fingerprint wаs "information collected, used, or stored for health care treatment"; agreeing that the
BIPA exempts such information; and dismissing the plaintiff's claims on that basis); Ex. 1 to Heard
Opp. to BD Mot. to Dismiss [25-1],
Bruhn v. New Alberton's, Inc.
, No. 2018 CH 01737 (Cir. Ct. of
Ill. Cook Cnty.), July 2, 2019 Hrg. Tr. 53:1-22 (stating that interpreting the statute in the same
manner BD proposes here would be "nonsensical" because it would leave "large categories" of
health care workers—whose biometric information is
not
protected under HIPAA—without
recourse to protect that information under the BIPA, and stating if the Illinois legislature had
intended to create such a significant "doughnut hole," it would have said so in clearer terms).)
The court finds the reasoning in
Bruhn
more persuasive, particularly considering the Illinois
Supreme Court's recent statement that the Illinois legislature "codified [in the BIPA] that
individuals possess a right to privacy in and control over their biometric" data.
Rosenbach
, 129
N.E.3d at 1206,
B.
Unlike
The parties dispute, however, whether
Heard's arguments are flawed. First, Heard agrees that
Heard has not adequately pleaded that BD took such any such step. For example, Heard repeatedly alleges that BD "collected" his biometric data without alleging how, when, or any other factual detail. ( See, e.g. , Compl. ¶¶ 9, 37, 39-40, 54, 68, 82, 91, 94, 95, 101; see also id. ¶ 93 (alleging that BD "systematically and automatically collected" Heard's and the putative class members' biometric data).) These allegations "merely parrot" the BIPA's statutory language; thеy do not provide any "specific facts to ground [Heard's] legal claims." Brooks , 578 F.3d at 581. Heard also alleges that "[a]s a condition of employment" at the Hospitals, he "was required to scan his fingerprint" to use Pyxis—and that BD "subsequently stored [his] fingerprint data in their systems." (Compl. ¶¶ 50-51.) But Heard does not allege how the data made its way to BD's systems. Nor does he argue or allege that there is a difference between storage and mere possession.
Heard's allegations are much like those in
Namuwonge
, where a court dismissed the
plaintiff's
Notably, in
Neals v. PAR Technology Corp.
, a court in this district determined that to state
a claim for a
The court concludes that Heard has not plausibly alleged that BD "collect[ed], capture[d],
purchase[d], receive[d] through trade, or otherwise obtain[ed]" biometric data from Heard or the
putative class members.
C.
Nonetheless, the court agrees with BD that Heard has not adequately pleaded
"possession" because he fails to allege that BD "exercised
any
dominion or control over [his]
biometric data." (BD Mot. 11.) Like Heard's allegations concerning collection, most of his
allegations concerning possession merely parrot the statutory language. ( Compl. ¶¶ 9, 37,
39-40, 54, 68, 93-95 (alleging, without more, that BD "stored" biometric information).) Only one
paragraph of the Complaint provides more detail: it states that at some time after the hospitals
required Heard to scan his fingerprint into Pyxis devices, BD "subsequently stored [Heard's]
fingerprint data in their systems." (
Id.
¶ 51.) This allegation does not plead that BD exercised
any form of control over the data or that it held the data "at [its] disposal."
Ward
,
The court also dismisses Heard's claim under
For the reasons stated above, the court grants BD's motion to dismiss Heard's claims for
violations of
CONCLUSION
For the foregoing reasons, the court grants Defendant Becton, Dickinson and Company's Motion to Dismiss [15] and terminates Defendant Becton, Dickinson and Company's Motion to Strike Class Allegations [18] as moot, without prejudice to refiling. If Heard wishes to file an amended complaint, he must do so by March 31, 2020.
ENTER:
Dated: February 24, 2020 _________________________________________
REBECCA R. PALLMEYER United States District Judge
Notes
[1] Heard himself is a lead plaintiff in at least four other putative class actions brought under the BIPA in Illinois state courts. ( BD Mem. in Supp. of Mot. to Strike Class Allegations [19], 1 n.1 (referencing Heard v. Omnicell, Inc. , No. 2019-CH-06817 (Cir. Ct. of Ill. Cook Cnty.); Heard v. Weiss Mem'l Hosp. , No. 2019-CH-06763 (Cir. Ct. of Ill. Cook Cnty.); Heard v. St. Bernard Hosp. , No. 2017-CH-16828 (Cir. Ct. of Ill. Cook Cnty.); Heard v. TCH-North Shore, Inc. , No. 2017- CH-16918 (Cir. Ct. of Ill. Cook Cnty.)).)
[2] Namuwonge was issued after the parties had fully briefed BD's motion to dismiss.
[3] Neals , too, was decided after the parties had fully briefed BD's motion to dismiss.