LUCILLE MOSBY et al., Individually and On Behalf of All Others Similarly Situated, Appellees, v. THE INGALLS MEMORIAL HOSPITAL et al. (Becton, Dickinson and Company et al., Appellants).
No. 129081
Supreme Court of Illinois
November 30, 2023
2023 IL 129081
Illinois Official Reports
Docket No. 129081
Filed November 30, 2023
Decision Under Review Appeal from the Appellate Court for the First District; heard in that court on appeal from the Circuit Court of Cook County, the Hon. Pamela McLean Meyerson and the Hon. Alison C. Conlon, Judges, presiding.
Judgment Certified questions answered. Judgments reversed. Cause remanded.
Counsel on Appeal Bonnie Keane DelGobbo, Joel Griswold, and Amy L. Lenz, of Baker & Hostetler LLP, and Matthew C. Wolfe, William F. Northrip, Gary M. Miller, Mehgan E. Keeley, and Kathleen M. Ryan, of Shook, Hardy & Bacon L.L.P., both of Chicago, for appellants.
James B. Zouras, Ryan F. Stephan, Andrew C. Ficzko, Catherine T. Mitchell, and Molly E. Stemper, of Stephan Zouras, LLP, of Chicago, for appellees.
Daniel D. Birk and John K. Adams, of Eimer Stahl LLP, of Chicago for amici curiae Illinois Chamber of Commerce et al.
J. Timothy Eaton, Jonathan B. Amarilio, and Benjamin S. Morrell, of Taft Stettinius & Hollister LLP, of Chicago, for amici curiae Advocate Health and Hospitals Corporation et al.
Cynthia S. Betz and Natalie H. Mantell, of McCarter & English, LLP, of Newark, New Jersey, for amicus curiae Advanced Medical Technology Association.
Randall D. Schmidt, of Edwin F. Mandel Legal Aid Clinic of the University of Chicago Law School, of Chicago, for amici curiae American Nurses Association et al.
Justices JUSTICE OVERSTREET delivered the judgment of the court, with opinion. Chief Justice Theis and Justices Neville, Holder White, Cunningham, Rochford, and O‘Brien concurred in the judgment and opinion.
OPINION
¶ 1 The instant action involves an interlocutory appeal pursuant to
“Whether the exclusion in Section 10 of [the Biometric Information Privacy Act (Act) (
740 ILCS 14/10 (West 2018))] for ‘information collected, used, or stored for health care treatment, payment, or operations under the federal Health [I]nsurance [P]ortability and Accountability Act of 1996’ [(HIPAA)] applies to biometric information of health care workers (as opposed to patients) collected, used or stored for health care treatment, payment or operations under HIPAA,”
and
“Does finger-scan information collected by a health care provider from its employees fall within the [Act‘s] exclusion for ‘information collected, used, or stored for health care treatment, payment, or operations under [HIPAA],’
740 ILCS 14/10 [(West 2018)], when the employee‘s finger-scan information is used for purposesrelated to ‘health care,’ ‘treatment,’ ‘payment,’ or ‘operations’ as those terms are defined by the HIPAA statute and regulations?”
¶ 2 The appellate court allowed the Rule 308 appeal and answered the Cook County circuit court‘s certified questions in the negative. 2022 IL App (1st) 200822, ¶ 4. This court allowed the petition for leave to appeal (
I. BACKGROUND
A. Mosby
¶ 5 Plaintiff, Lucille Mosby, a registered nurse employed by Ingalls Memorial Hospital, filed a class-action suit individually and on behalf of others similarly situated, alleging that she used a medication dispensing system and its finger-scan device, distributed and marketed by BD, to provide patient care, i.e., to authenticate her identity and access controlled and restricted material.1 In an amended class-action complaint, Mosby alleged that BD violated section 15(a), (b), and (d) of the Biometric Information Privacy Act (Act) (
¶ 6 BD filed a motion to dismiss pursuant to section 2-619.1 of the Code of Civil Procedure (Code) (
¶ 7 The circuit court ruled that the exception found in section 10 of the Act was limited to patient information protected under HIPAA. See
¶ 8 Thereafter, BD filed a joint motion to certify a question for interlocutory appeal under
B. Mazya
¶ 10 Plaintiff, Yana Mazya, a registered nurse at NLFH, and Tiki Taylor,2 a patient care technician, filed an amended class-action complaint alleging that Northwestern health care providers required her to scan her fingerprints for identification to access medication dispensing systems and gain authorized access to stored materials and medications for patients. Mazya alleged that she scanned her fingerprints multiple times a day to access the BD and Omnicell medical stations for health care treatment and operations.3 Mazya alleged Northwestern failed to provide certain notices and obtain consent in writing in violation of section 15(a), (b), and (d) of the Act (
¶ 11 Northwestern filed a motion to dismiss pursuant to section 2-619.1 (
¶ 12 Northwestern argued that the use of health care workers’ fingerprint scans was directly related to the dispensing of prescription drugs, as well as the provision, coordination, and management of health care. Northwestern further argued that the records created by the medication dispensing systems allowed it to ensure proper billing for medications and, therefore, the information it collected through the medication dispensing systems was also used for health care operations and payment under HIPAA.
¶ 13 The circuit court denied Northwestern‘s motion to dismiss, holding that the referenced exclusion in section 10 of the Act (
¶ 15 The appellate court initially issued an opinion finding that the exclusion at issue did not apply to biometric information collected by a health care provider from its employees, but the appellate court granted the petition for rehearing filed by Northwestern and BD, the only remaining defendants in both appeals, to address additional arguments. 2022 IL App (1st) 200822, ¶ 5. Finding that the parties essentially sought the answer to the same question—whether the biometric information of health care workers is excluded from the Act‘s protections—the appellate court answered the question in the negative. Id. ¶ 71.
¶ 16 The appellate court found that the relevant provision of section 10 of the Act excluded from the Act‘s protections only patient biometric information. Id. ¶ 58. The appellate court rejected the contention that a reading of the exclusion to apply to only patient information would render “information captured from a patient in a health care setting” (
¶ 17 The appellate court declined to conclude that ” ‘under HIPAA’ ” means ” ‘as defined by HIPAA.’ ” Id. ¶ 64. The appellate court held that the primary meaning of ” ‘under’ ” when used as a preposition in the clause is ” ‘covered’ ” or ” ‘protected.’ ” Id. ¶ 63 (quoting Merriam-Webster Online Dictionary, https://www.merriam-webster.com/dictionary/under (last visited May 9, 2022)). The appellate court thus held that the “biometric information of employees is simply not defined or protected ‘under HIPAA.’ ” Id. ¶ 64. Accordingly, the appellate court held that “the plain language of the statute does not exclude employee information from the Act‘s protections because they are neither (1) patients nor (2) protected under HIPAA.” Id.
¶ 18 The appellate court found that, “if the legislature intended to exclude all health care workers from the Act‘s protections, it would have done so.” Id.
“Where the legislators wanted to create blanket exclusions for certain sectors of the workforce, they expressly provided that the Act did not apply either to financial institutions subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 or to employees, contractors, or subcontractors of local government or the State as provided in section 25.” Id. (citing
740 ILCS 14/25(c), (e) (West 2018)).
The appellate court concluded that “[n]o such express, blanket exclusion exists for health care workers and [declined to] rewrite the Act to provide one.” Id. The appellate court held that its finding, that the nurses at issue are covered by the Act vis-à-vis their employers and the medication dispensing system marketing company, furthers the primary goal of the Act: to protect the secrecy interest of the individual in his or her biometric information, such as the fingerprint scans at issue here. Id. ¶ 67.
¶ 19 Presiding Justice Mikva dissented,
“convinced that the General Assembly did intend to exclude from the Act‘s protections the biometric information of health care workers—including finger-scan information collected by those workers’ employers—where that information is collected, used, or stored for health care treatment, payment, or operations, as those functions are defined by HIPAA.” (Emphasis omitted.) Id. ¶ 74 (Mikva, P.J., dissenting).
¶ 20 Presiding Justice Mikva suggested that the majority‘s view ignored rules of statutory construction and overcomplicated a more straightforward reading of this exclusion. Id.
¶ 21 Presiding Justice Mikva opined that the first part of the exclusion in section 10 of the Act “excludes from the Act‘s coverage information from a particular source—patients in a health care setting—and the second part excludes information used for particular purposes—health care treatment, payment, or operations—regardless of the source of that information.” Id. ¶ 75. Presiding Justice Mikva asserted that “[t]he plain language of the statute, and particularly the use of the words ‘from’ and ‘for,’ make this clear.” Id.
¶ 22 In the dissent, Presiding Justice Mikva contended that the majority‘s interpretation of the exclusion ignored two fundamental rules of statutory construction: the last antecedent rule and the rule that statutes should be construed to avoid rendering a word or phrase superfluous. Id. ¶ 76. Presiding Justice Mikva further contended that application of these two basic rules makes clear that the “exclusion extends to biometric information collected from health care workers by their employers—where that information is collected, used, or stored for health care treatment, payment, or operations—and is not limited, as the majority concludes, to biometric information collected from patients.” Id.
¶ 23 Applying the last antecedent rule of statutory construction, Presiding Justice Mikva asserted that the phrase ” ‘under [HIPAA]’ ” in section 10‘s exclusion applied to ” ‘health care treatment, payment, or operations,’ ” the phrase that immediately precedes it, rather than to the more remote phrase ” ‘information collected, used, or stored.’ ” Id. ¶ 78 (quoting
¶ 24 Presiding Justice Mikva asserted that the majority‘s construction resulted in redundance because it failed to consider that the word “information” is deliberately used twice in the exclusion and the majority instead improperly concluded that all “information” is patient information. Id. ¶ 84. Presiding Justice Mikva suggested that “[u]nder this reading, there is simply no reason to use the word ‘information’ twice in the disjunctive, suggesting that the exclusion is referencing two different kinds of information.” Id.. Presiding Justice Mikva concluded that “[t]he last antecedent rule and the rule against treating language in a statute as superfluous both dictate that ‘under’ HIPAA refers to ‘health care treatment, payment, and operations.’ ” Id. ¶ 86. Presiding Justice Mikva continued: “None of these activities are ‘protected’ by HIPAA. Rather, they are activities that are defined by HIPAA and that, when engaged in by covered entities, make certain HIPAA regulations applicable.” (Emphasis in original.) Id.
¶ 26 This court granted the defendants’ petition for leave to appeal.
II. ANALYSIS
¶ 28
“When the trial court, in making an interlocutory order not otherwise appealable, finds that the order involves a question of law as to which there is substantial ground for difference of opinion and that an immediate appeal from the order may materially advance the ultimate termination of the litigation, the court shall so state in writing, identifying the question of law involved. Such a statement may be made at the time of the entry of the order or thereafter on the court‘s own motion or on motion of any party. The [a]ppellate [c]ourt may thereupon in its discretion allow an appeal from the order.”
¶ 29 “By definition, certified questions are questions of law subject to de novo review.” Rozsavolgyi v. City of Aurora, 2017 IL 121048, ¶ 21. “Questions of statutory construction are [also] questions of law and reviewed de novo.” Raab v. Frank, 2019 IL 124641, ¶ 18. Moreover, “[u]nder either section [2-615 or 2-619], our standard of review is de novo.” Solaia Technology, LLC v. Specialty Publishing Co., 221 Ill. 2d 558, 579 (2006); see also Cahokia Unit School District No. 187 v. Pritzker, 2021 IL 126212, ¶ 24 (“A section 2-615 or section 2-619 motion to dismiss admits as true all well-pleaded facts and all reasonable inferences from those facts.“).
¶ 30 The certified question in this case asks us to construe the language of the Act to determine whether the language following “or” in section 10‘s definitions section, which excludes as “[b]iometric identifiers” “information collected, used, or stored for health care treatment, payment, or operations under [HIPAA],” refers exclusively to a patient‘s biometric information or includes a health care worker‘s biometric information used to access patient medications and provide patient care. “The fundamental rule of statutory construction is to ascertain and
¶ 31 When the statutory language is plain and unambiguous, a court may not “depart from a statute“s plain language by reading into the law exceptions, limitations, or conditions that the legislature did not express.” Schultz v. Illinois Farmers Insurance Co., 237 Ill. 2d 391, 408 (2010). “Nevertheless, in construing a statute, the court may consider the reason for the law, the problems sought to be remedied, the purposes to be achieved, and the consequences of construing the statute one way or another.” McDonald v. Symphony Bronzeville Park, LLC, 2022 IL 126511, ¶ 18.
¶ 32 The Act was enacted in 2008 to regulate “the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.”
¶ 33 Among other things, section 15(a) of the Act requires that private entities establish a retention schedule and guidelines for permanently destroying biometric data when the purpose for collecting it is satisfied, or within three years of the individual‘s last interaction with the private entity.
¶ 34 The Act defines ” ‘[p]rivate entity’ ” broadly to include “any individual, partnership, corporation, limited liability company, association, or other group, however organized,” subject to exceptions not relevant here.
¶ 35 Section 10 of the Act excepts certain information from the “biometric identifier” designation.
¶ 36 Each word in a statute is to be “given a reasonable meaning and not rendered superfluous.” Sylvester v. Industrial Comm‘n, 197 Ill. 2d 225, 232 (2001). “The word ‘or’ is disjunctive. As used in its ordinary sense, the word ‘or’ marks an alternative indicating the various parts of the sentence which it connects are to be taken separately. [Citation.] In other words, ‘or’ means ‘or.’ ” Elementary School District 159 v. Schiller, 221 Ill. 2d 130, 145 (2006). “Disjunctive therefore connotes two different alternatives.” Id.
¶ 38 The plain language of the Act also includes repetition of the word “information” at the beginning of each separate clause. By using “information” twice, the legislature indicated that each of the two clauses separated by the “or” generally exempts a different specified category of information. The second clause does not include the word “patient.”
¶ 39 Defendants argue that the appellate court construed the two subexclusions in a manner that makes them redundant of each other, in that the appellate court construed both subexclusions to mean patient information, ignoring the disjunctive “or” and the repetition of “information.” The appellate court explained away the redundancy by stating that “[t]he first sub-exclusion or category is for information ‘captured’ ” (2022 IL App (1st) 200822, ¶ 58 (quoting
¶ 40 Defendants argue there is simply no tenable interpretation of the Act‘s text that would limit the second clause to information collected from a patient. The “or” and second “information” mean that any information—not just patient information—collected, used, or stored in connection with health care treatment, payment, or operations under HIPAA is exempt from the Act. Defendants argue that, as noted by Presiding Justice Mikva‘s dissent, the two categories of information are different because under the first clause the excluded information originates from the patient, whereas under the second clause, the excluded information may originate from any source. Defendants note that, under their interpretation, the language “collected *** for health care treatment” as that term is defined under HIPAA most certainly covers information that is not covered under “information captured from a patient” and, therefore, avoids any redundancy. See
¶ 41 We agree with defendants and Presiding Justice Mikva‘s dissent, that the first part of the provision excludes from the Act‘s coverage information from a particular source—a patient in a health care setting—and the second part excludes information used for a particular purpose—health care treatment, payment, or operations—regardless of the information‘s source. See 2022 IL App (1st) 200822, ¶ 75 (Mikva, P.J., dissenting). As noted in the dissent, “[t]he plain language of the statute, and particularly the use of the words ‘from’ and ‘for,’ make this clear.” Id.
¶ 43 The parties also take issue with the legislature‘s use of the word “under” in describing “information collected, used, or stored for health care treatment, payment, or operations under [HIPAA].” (Emphasis added.)
¶ 44 Defendants contend that plaintiffs, like the appellate court, omit the full definition of “under” that it adopted, as provided in the dictionary they cite. When used as a preposition, the Merriam-Webster Online Dictionary defines “under” as “below or beneath so as to be overhung, surmounted, covered, protected, or concealed by” as in “under sunny skies,” “under a stern exterior,” and “under cover of darkness.” Merriam-Webster Online Dictionary, https://www.merriam-webster.com/dictionary/under (last visited Nov. 13, 2023) [https://perma.cc/J35R-VJHA]; see also Merriam-Webster‘s Collegiate Dictionary 1363 (11th ed. 2020). Defendants argue that both the full definition and the examples given make clear that this usage of the term “under” is referring to a physical location or attribute and that such a construction makes no sense in the context of the health care exclusions reference to “under [HIPAA],” as HIPAA is not a physical location or attribute. Instead, defendants argue that the only appropriate definition of “under” in the context of the subexclusion is defined in the Merriam-Webster Online Dictionary as “subject to the authority, control, guidance, or instruction of” as in “served under the general,” “under the terms of the contract,” and “a program that runs under any operating system.” Merriam-Webster Online Dictionary, https://www.merriam-webster.com/dictionary/under (last visited Nov. 13, 2023) [https://perma.cc/J35R-VJHA]; see also Merriam-Webster‘s Collegiate Dictionary 1363 (11th ed. 2020). Under this definition, defendants argue, HIPAA provides the guidance needed to determine the meaning of “health care treatment, payment, or operations.”
¶ 45 To support their positions, the parties also cite canons of statutory construction. Below, defendants argued that the second subexclusion is not limited to information captured from a patient because a clause following a disjunctive is considered inapplicable to the subject matter of the preceding clause. In other words, defendants argued that application of the qualifier “under [HIPAA]” to the first subexclusion involving patient information, despite the following disjunctive “or,” is nonsensical. See Facebook, Inc. v. Duguid, 592 U.S. 395, 402-403 (2021) (when interpreting a concise list of nouns followed by a modifying clause, under conventional rules of grammar, a modifier at the end of the list applies to the straightforward, parallel construction that involves all nouns in the series (citing Antonin Scalia & Bryan A. Garner, Reading Law: The Interpretation of Legal Texts 147 (2012))). The series-qualifier canon would suggest that “under [HIPPA]” applies to all three nouns in “health care treatment, payment, or operations” found in the second subexclusion. Plaintiffs and the majority below suggest, however, that this canon also applies to the first subexclusion involving patient information.
¶ 47 Here, the qualifying phrase “under [HIPAA]” is immediately preceded by the words “health care treatment, payment, or operations.” See
¶ 48 These canons, however, are limited by context. See Facebook, Inc., 592 U.S. at 411 (Alito, J., concurring) (series-qualifier canon is limited and is highly sensitive to context); In re E.B., 231 Ill. 2d at 467 (application of last antecedent is limited by “the intent of the legislature, as disclosed by the context and reading of the entire statute“). “[T]reatment, payment, and operations” is a phrase the Illinois legislature borrowed from HIPAA regulations. See, e.g.,
¶ 49 “[H]ealth care treatment, payment, or operations” are terms defined by HIPAA regulations. See
¶ 50 ” ‘Treatment’ means the provision, coordination, or management of health care and related services by one or more health care providers,” which includes “the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a patient; or the referral of a patient for health care from one health care provider to another.”
¶ 51 “Payment” includes “activities undertaken by *** [a] health care provider or health plan to obtain or provide reimbursement for the provision of health care.”
¶ 52 Therefore, the legislature‘s decision to use the phrase “health care treatment, payment, and operations” and to immediately follow it with the prepositional phrase “under [HIPAA]” makes clear that the legislature was directing readers to HIPAA to discern the meaning of those
¶ 53 As noted by the appellate court dissent, ” ‘[t]reatment,’ ‘payment,’ and ‘operations,’ are ‘under’ HIPAA because a particular meaning is ascribed to each of these terms by HIPAA‘s implementing regulations.” 2022 IL App (1st) 200822, ¶ 81 (Mikva, P.J., dissenting). ”Under the provisions of HIPAA, those three terms have definite and well-known meanings that our General Assembly saw no reason to duplicate or reinvent when it drafted the legislation that is the subject of this appeal.” (Emphasis in original.) Id. “Incorporating by reference established definitions in this manner promotes clarity, consistency, and familiarity in the law, a ‘familiar legislative process’ long recognized by” this court. Id. “The General Assembly has in fact borrowed these same definitions on other occasions, and it has used the phrase ‘under HIPAA’ to do so.” Id.; see
¶ 54 Pursuant to its plain language, the Act excludes from its protections the biometric information of health care workers where that information is collected, used, or stored for health care treatment, payment, or operations, as those functions are defined by HIPAA. A health care worker‘s biometric information, used to permit access to medication dispensing stations for patient care, falls under “information collected, used, or stored for health care treatment, payment, or operations under [HIPAA]” and is exempt from the Act‘s protections pursuant to section 10 of the Act. See
¶ 55 Plaintiffs argue that, if the legislature intended to exempt HIPAA-covered entities (and their suppliers) from compliance or exclude their workers from the Act‘s protections when biometrics are collected for “operations,” it would have expressly done so in section 25, as opposed to burying it in the middle of a definition. See
¶ 56 Defendants counter that plaintiffs’ assertions that defendants are seeking a broad exemption of the entire health care industry that would cover, for example, a landscaper mowing the lawn, simply ignore that HIPAA includes carefully crafted definitions for each of these terms that place limits on the scope of the exclusion. Defendants argue that plaintiffs’ argument ignores the context of this appeal, which concerns automated dispensing cabinets used by health care providers, the use of which fall within HIPAA‘s definitions of health care treatment, payment, and operations. Defendants argue that the legislature‘s placement of the exclusion within the definition of “biometric identifier,” rather than including it within section 25 of the Act, makes sense because the exclusion is not a broad exemption of the entire health care industry, like the ones found in section 25.
¶ 57 We are not construing the language at issue as a broad, categorical exclusion of biometric identifiers taken from health care workers. Here, the nurses’ biometric information, as alleged in the complaints, was collected, used, and stored to access medications and medical supplies for patient health care treatment and is excluded from coverage under the Act because it is
III. CONCLUSION
¶ 59 For the foregoing reasons, we answer the certified questions in the affirmative, reverse the judgment of the appellate court, and remand the cause to the circuit court for further proceedings.
¶ 60 Certified questions answered.
¶ 61 Judgments reversed.
¶ 62 Cause remanded.