LUCILLE MOSBY, Individually, and on Behalf of All Others Similarly Situated, Plaintiff-Appellee, v. THE INGALLS MEMORIAL HOSPITAL, UCM COMMUNITY HEALTH & HOSPITAL DIVISION, INC., and BECTON, DICKINSON AND COMPANY, Defendants-Appellants; YANA MAZYA, Individually, and on Behalf of All Others Similarly Situated, Plaintiff-Appellee, v. NORTHWESTERN LAKE FOREST HOSPITAL, NORTHWESTERN MEMORIAL HEALTHCARE, OMNICELL, INC., and BECTON, DICKINSON AND COMPANY, Defendants (Northwestern Lake Forest Hospital and Northwestern Memorial Healthcare, Defendants-Appellants).
Nos. 1-20-0822 and 1-21-0895, cons.
Appellate Court of Illinois, First Judicial District
February 25, 2022
2022 IL App (1st) 200822
JUSTICE ODEN JOHNSON delivered the judgment of the court, with opinion. Justices Harris and Mikva concurred in the judgment and opinion.
Appeal from
No. 18 CH 05031
The Honorable Pamela McLean Meyerson, Judge, Presiding.
Appeal from the Circuit Court of Cook County.
No. 18 CH 71601
The Honorable Alison C. Conlon, Judge, Presiding.
¶ 1 Plaintiff Lucille Mosby filed a class-action suit individually and on behalf of others similarly situated against defendants Ingalls Memorial Hospital and UCM Community Health & Hospital Division, Inc. (collectively Ingalls), and Becton, Dickinson and Company (BD) (collectively group defendants one). Similarly, plaintiff Yana Mazya filed a class-action suit individually and on behalf of others similarly situated against Northwestern Lake Forest Hospital and Northwestern Memorial Healthcare (collectively group defendants two). During the course of the litigation, group defendants one filed an interlocutory appeal pursuant to Illinois Supreme Court Rule 308 (eff. Oct. 1, 2019) to have this court answer this certified question:
“Whether the exclusion in Section 10 of BIPA for “information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996” applies to biometric information of health care workers (as opposed to patients) collected, used or stored for health care treatment, payment or operations under HIPAA?”
¶ 2 Subsequently, group defendants two also filed an interlocutory appeal pursuant to Rule 308 concerning the same issue:
“Does finger-scan information collected by a health care provider from its employees fall within the Biometric Information Privacy Act‘s exclusion for ‘information collected, used, or stored for health care treatment, payment or operations under the federal Health Insurance Portability and Accountability Act of 1996,’
740 ILCS 14/10 , when the employee‘s finger-scan information is used for purposes related to ‘healthcare,’ ‘treatment,’ ‘payment,’ and/or ‘operations’ as those terms are defined by the HIPAA statute and regulations?”
Both group defendants’ petitions for leave to appeal were permitted, as discussed in detail below. However, at this time, the only question submitted for this court‘s review is the question submitted by group defendants two, and we answer the question in the negative.
¶ 3 I. BACKGROUND
¶ 4 A. Mosby
¶ 5 On April 18, 2018, Mosby filed a class-action complaint against Ingalls and BD seeking redress for each defendant‘s violations pursuant to section 15(a)-(d) of the Biometric Information Privacy Act (Act) (
¶ 6 On May 14, 2019, plaintiff filed an amended class-action complaint that was substantially similar to the original.
¶ 7 On June 5, 2019, defendants filed a motion to dismiss pursuant to section 2-619.1 (
¶ 8 On January 13, 2020, the circuit court ruled that the exception was limited as to the information protected under HIPAA. To hold otherwise, the court noted, would result in a broad exception for all employees involved in operations that impact patients protected by HIPAA. The circuit court opined that, if the legislature intended to exempt employees entirely, they would have expressly done so. The court denied defendants’ motion to dismiss based on this issue. The circuit court dismissed BD from the complaint in its entirety, without prejudice, and found that Mosby failed to state a claim as to how defendants disseminated her biometric information. With authorization of the circuit court, Mosby amended her pleadings on February 24, 2020, which realleged all of the claims contained in the previously dismissed claim.
¶ 9 On March 16, 2020, defendants filed a joint motion to certify a question for interlocutory appeal under Illinois Supreme Court Rule 308 (eff. Oct. 1, 2019) and stay proceedings. Defendants argued that the question of whether employee information was also exempt under the Act was a question of first impression and has never been heard before this court. Defendants argued that the question was one of statutory construction and there existed a substantial ground for a difference of opinion, which made it appropriate to bring under Rule 308. Defendants maintained that raising the question would be beneficial in a variety of ways, such as: (1) it would advance the outcome of the case with prejudice if the Act was interpreted in their favor, (2) judicial economy would be served, and (3) the need for a uniform construction and application of the law would be served. Defendants also requested a stay in the circuit court proceedings because the determination could lead to a dismissal and Mosby would not be prejudiced.
¶ 10 On April 20, 2020, Mosby filed a motion in opposition to defendants’ joint motion to certify the question for interlocutory appeal, arguing that substantial grounds for difference of opinion did not exist. Mosby maintained that to hold otherwise would mean that the General Assembly intended to place anyone employed
¶ 11 On May 4, 2020, defendants filed a joint reply arguing that the proposed certified question was tailored and limited to those circumstances where the biometric data collected from healthcare workers were used for healthcare treatment, payment, or operations under HIPAA. Defendants further argued that the circuit court did not entirely reject its argument and found it plausible but ultimately concluded that the General Assembly would have been more explicit if the legislative intent was to exclude healthcare employees’ biometric data.
¶ 12 On June 18, 2020, the circuit court granted defendants’ motion to certify and stay the proceedings. The circuit court ruled that the issue posed by defendants presented a question of law where there was substantial ground for difference of opinion and could ultimately determine whether or not the case should be dismissed.
¶ 13 On July 17, 2020, defendants filed an application for leave to appeal pursuant to Rule 308, which we denied on August 24, 2020. Defendants filed a petition for leave to appeal with the Illinois Supreme Court, on October 30, 2020. On March 3, 2021, the Illinois Supreme Court issued a mandate vacating this court‘s decision and ordered this court to hear the certified question on appeal. On June 11, 2021, Ingalls filed an unopposed motion for extension of time to file an opening brief, where they informed the circuit court that the parties reached a settlement in principle.1
¶ 14 B. Mazya
¶ 15 On April 10, 2019, Yana Mazya and Tiki Taylor filed an amended class-action complaint2 against Northwestern Lake Forest Hospital, Northwestern Memorial Healthcare, Northwestern Memorial Hospital (collectively Northwestern), Omnicell Inc., and BD seeking redress for each defendant‘s violations pursuant to section 15(a)-(d) of the Act (
Hospital; both were required to scan their fingerprints to gain access to the medication dispensing system as a condition of their employment. Mazya and Taylor alleged Northwestern disregarded their statutorily protected privacy rights when they unlawfully collected, stored, used, and disseminated their biometric data in violation of the Act. Mazya and Taylor specifically alleged that defendants were in violation of the Act because it
¶ 16 On July 2, 2019, Taylor was dismissed without prejudice from the complaint as her claims were preempted because she was a party to a collective bargaining agreement.3
¶ 17 On January 17, 2020, Northwestern4 filed a motion to dismiss pursuant to section 2-619.1 (
intended to interfere with HIPAA and that applying it to their medication dispensing systems would conflict with guidance previously given by the Department of Health and Human Services (HHS), which encouraged the use of biometrics in health. Northwestern argued that Mazya knew her information was being collected and had the power to withhold consent, citing Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, ¶ 34, as support. Northwestern further argued that Mazya failed to provide factual allegations supporting her conclusory assertions that Northwestern‘s conduct was intentional or reckless. Lastly, Northwestern requested that Northwestern Memorial Hospital be dismissed from the proceedings, since Taylor was dismissed.5
¶ 18 On March 13, 2020, Mazya filed a response to Northwestern‘s motion to dismiss, arguing that her claims were actionable because they did not fall under any exemption under the Act and the failure to comply with distinct requirements of the Act was all that she needed to demonstrate. Mazya maintained that the Act‘s explicit reference to biometric data taken from a patient shows the intent of the General Assembly to exclude patient biometrics from the Act‘s protection because they were already protected by HIPAA. Mazya further maintained that if the
¶ 19 Northwestern filed a reply on April 3, 2020, arguing that Mazya‘s interpretation of the Act ignored the disjunctive “or” provided in section 10 of the Act, which connotes two different alternatives, and thus the exemption included employee information. Northwestern maintained that Mazya failed to rebut their argument that she failed to state a claim because her claims were not supported by the language of the statute and were solely policy-based. Northwestern further maintained that it would be good policy to interpret the statute their way given that the usage of biometric information has been encouraged by the government.
¶ 20 On November 2, 2020, the circuit court denied Northwestern‘s section 2-619.1 motion. The circuit court found Northwestern‘s section 2-619 argument unpersuasive because the burden for compliance with the Act falls on the collector of the data, not the provider. Put another way, Mazya did not waive her consent by continuing to offer her biometric data to Northwestern as a condition of her duties as a nurse. The circuit court found that accepting Northwestern‘s interpretation of the Act would amount to medical professionals having no protections for their biometric information. In regard to Northwestern‘s section 2-615 arguments, the circuit court found that, to have a viable claim, (1) the claimant need not lack knowledge of the violation, as the violation itself was enough to support the statutory cause of action, and (2) the claimant was not required to plead an intentional or reckless violation of the Act, at that stage of the proceedings.
¶ 21 On November 30, 2020, Northwestern filed a corrected motion for Rule 308 certification and to stay the proceedings. Northwestern argued that there were substantial grounds for difference of opinion given the disjunctive “or” in section 10. Northwestern further argued that the proceedings should be stayed pending this court‘s decision because our answer to the question could expedite the resolution of the underlying case.
¶ 22 On December 11, 2020, Mazya filed a motion to strike Northwestern‘s motion for certification and stay. Mazya argued that Northwestern was trying to certify the same question that this court denied in Mosby v. Ingalls Memorial Hospital, No. 1-20-0822, which led to the circuit court‘s denial of the defendant‘s section 2-619.1 motion; therefore, the motion to certify was frivolous and did not warrant interlocutory review.
¶ 23 Later, on January 13, 2021, Mazya filed a response in opposition to Northwestern‘s motion for
¶ 24 On February 9, 2021, Northwestern filed a reply in further support of their Rule 308 motion, informing the circuit court that the Illinois Supreme Court directed this court to vacate its August 24, 2020, order and accept the Rule 308 appeal (Mosby v. Ingalls Memorial Hospital, No. 126590 (Ill. Jan. 27, 2021) (supervisory order)).
¶ 25 On February 9, 2021, the circuit court denied Northwestern‘s Rule 308 motion but stayed the proceedings pending the decision in Mosby.
¶ 26 On June 15, 2021, Northwestern filed a motion to reconsider the denial of their Rule 308 certification, arguing that the parties in Mosby reached a settlement in principle and that no one would be presenting any arguments on appeal on behalf of a hospital that uses medication dispensing systems secured by finger-scan technology. Mazya responded on June 22, 2021, that plaintiffs were not opposed to the appellate court hearing a certified question.
¶ 27 On July 23, 2021, the circuit court granted the motion to reconsider and stayed the proceedings, noting that the issue involves a question of law as to which there were substantial grounds for difference of opinion and that an immediate appeal could materially advance the ultimate termination of the litigation. Accordingly, the circuit court certified its question to this court.
¶ 28 On July 27, 2021, Northwestern filed an application for leave to appeal pursuant to Rule 308 reiterating the arguments they made at the circuit court and requesting that the case be consolidated with Mosby. We granted the motion on August 13, 2021.
¶ 29 On August 5, 2021, an amicus curiae brief was filed on behalf of the Illinois Health and Hospital Association, Northwestern Memorial Healthcare, and Amita Health (collectively the amici), in support of defendants’ position. They reiterated defendants’ arguments and also argued that interpreting section 10 in favor of plaintiffs regarding the medical supply dispensing systems at issue could result in undesirable consequences for healthcare providers. The amici argued that plaintiffs’ interpretation could be financially burdensome and result in a lower quality of care for patients.
¶ 30 II. ANALYSIS
¶ 31 On appeal, Northwestern contends that this court should answer the certified question in the affirmative because the plain language of section 10 demonstrates that employee biometric information used in medication dispensing systems is excluded from protections of the Act.
¶ 32 A. Jurisdiction
¶ 33 We have jurisdiction to review the certified question pursuant to Illinois Supreme Court Rule 308 (eff. Oct. 1, 2019). In general, courts of
¶ 34 B. Standard of Review
¶ 35 When reviewing a certified question of law pursuant to Illinois Supreme Court Rule 308 (eff. Oct. 1, 2019), we apply a de novo standard of review. O‘Halloran v. Luce, 2013 IL App (1st) 113735, ¶ 31. De novo review is also appropriate because this resolution turns on a question of statutory construction. Eighner v. Tiernan, 2020 IL App (1st) 191369, ¶ 8. “The primary rule of statutory construction is to give effect to the
¶ 36 1. Plain Language
¶ 37 The Act on which the certified question is based defines “biometric information” as “any information, regardless of how it is captured, converted, stored, or shared, based on an individual‘s biometric identifier used to identify an individual.”
¶ 38 Section 10 of the Act provides exclusions to the protections of the Act; specifically at issue is the following language:
“Biometric identifiers do not include information captured from a patient in a health care setting or information collected, used, or stored
for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996.”
Id. While section 25(c) and (e) expressly provides that the Act will not apply to certain entities and persons:
“(c) Nothing in this Act shall be deemed to apply in any manner to a financial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 [(
15 U.S.C. § 6803 (2018))] and the rules promulgated thereunder.***
(e) Nothing in this Act shall be construed to apply to a contractor, subcontractor, or agent of a State agency or local unit of government when working for that State agency or local unit of government.” Id.
§ 25(c) ,(e) .
¶ 39 Northwestern and the amici contend that the hospital workers’ use of medication dispensing systems falls within the Act‘s definitional carveouts for health-related information. Northwestern and
¶ 40 Northwestern and the amici contend that
¶ 41 Plaintiffs contend that the circuit court did not err in holding that Northwestern is not exempt from the Act and that it excludes only patient biometric data from its protections because patient data is already protected by HIPAA. Plaintiffs assert that this would in effect leave thousands
¶ 42 Northwestern‘s reply brief asserts that the storage of healthcare workers’ biometric information, obtained when accessing a medication dispensing system, is for the “health care” and “treatment” of patients as those terms are defined by HIPAA; therefore, the “under HIPAA” language does not exclude this type of information.
¶ 43 We find that the language of the statute is clear and simple disagreement between the parties will not create ambiguity in the statute. Kaider v. Hamos, 2012 IL App (1st) 111109, ¶ 11. What is excluded from the protections of section 10 are (1) information from the patient in a healthcare setting and (2) information that is already protected “under the federal Health Insurance Portability and Accountability Act of 1996.”
¶ 44 At oral argument, Northwestern argued that this court should not consider the terminology “under HIPAA” and instead we should consider this as “defined by HIPAA.” However, “under HIPAA” is what the Act expressly states, and that cannot be ignored. We are simply unable to rewrite the statute. Zahn v. North American Power & Gas, LLC, 2016 IL 120526, ¶ 15. Either way, the biometric information of employees is simply not defined or protected “under HIPAA.” Accordingly, the plain language of the statute does not exclude
¶ 45 Northwestern‘s inclusion of employee‘s biometric information under the exclusion goes beyond the plain language of the Act. We are unable to rewrite the statute to add provisions or limitations that the legislature did not include. Zahn, 2016 IL 120526, ¶ 15. No rule of construction permits this court to declare that the legislature did not mean what the plain language of the statute imports. Id. There is simply no provision or
¶ 46 III. CONCLUSION
¶ 47 Consistent with the plain language of the Act, we find that the legislature did not exclude employee biometric information from its protections, and we answer the certified question in the negative. We remand this cause for further proceedings consistent with this opinion.
¶ 48 Certified question answered; cause remanded.
Cite as: Mosby v. Ingalls Memorial Hospital, 2022 IL App (1st) 200822
Decision Under Review: Appeal from the Circuit Court of Cook County, Nos. 18-CH-05031, 18-CH-07161; the Hon. Pamela McLean Meyerson and the Hon. Alison C. Conlon, Judges, presiding.
Attorneys for Appellant: Joseph A. Strubbe, Frederic T. Knape, and Zachary J. Watters,
Joel Griswold and Bonnie Keane DelGobbo, of Baker & Hostetler LLP, of Chicago, for other appellants.
Attorneys for Appellee: James B. Zouras, Ryan F. Stephan, Andrew C. Ficzko, Catherine T. Mitchell, and Paige L. Smith, of Stephan Zouras, LLP, of Chicago, for appellees.
Amici Curiae: Michael A. Woods, of Naperville, and Richard H. Tilghman, of Nixon Peabody LLP, and Bonnie Keane DelGobbo and Joel Griswold, of Baker & Hostetler LLP, both of Chicago, for amici curiae Illinois Health and Hospital Association et al.