Labor & Employment Law Daily Wrap Up, STATE-LAW CLAIMS—Ill. App.: Hand scans used for timekeeping purposes not exempt from Biometric Information Privacy Act, (Sep 2, 2026)

By Ronald Miller, J.D.

The appellate court determined that payroll records and timekeeping are not the functions that make the employer a health care provider.

Answering a certified question from a trial court, an Illinois appellate court concluded that a health care facility’s use of hand scans for timekeeping purposes was not exempt from the requirements of the Illinois Biometric Information Privacy Act (BIPA). In a motion for judgment on the pleadings, the employer had argued that the act of scanning an employee’s hand for timekeeping purposes was excluded from the BIPA’s protections on the ground that the Act exempted from its protections “health care *** operations. However, the appellate court observed that the exemption does not apply to all healthcare operations, but only to those healthcare operations under HIPAA. The HIPAA regulations’ definition of “health care *** under [HIPAA]” is specific to the health care of an individual, as opposed to a system. Justice Wilson filed a separate concurring opinion (Townsend v. The Estates of Hyde Park, LLC, No. 1-25-0096 (Ill. App. Aug. 31, 2026)).

Hand scans. The employer is a short-term rehabilitation and long-term care facility in Illinois. The employee worked as a nurse at the facility from April 2019 to September 2019. Hand scans were used at the facility for timekeeping purposes.

When the employer hires an employee, the employee is enrolled in its employee database, using a scan of the employee’s hand. The employer then uses its employee database to monitor the time worked by its employees. It requires its employees, as a condition of employment, to have their hand scanned by a biometric timekeeping device. Employees are required to have their hands scanned “to clock-in and clock-out, recording their time worked.”

In October 2019, the employee filed a class action complaint against the employer. The complaint alleged numerous violations of BIPA, including failing to inform employees of the length of time that their scans would be stored and failing to provide a publicly available retention schedule and guidelines for destruction. Further, the employee alleged that the employer disclosed employee hand-scan data to at least one third-party vendor.

Exclusion. In a motion for judgment on the pleadings, the employer argued that the act of scanning an employee’s hand for timekeeping purposes is excluded from the BIPA’s protections on the ground that the Act exempted from its protections “health care *** operations.” Specifically, the employer argued that its payroll qualified as a health care operation under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

In July 2024, the trial court denied the employer’s motion for judgment on the pleadings. The court noted that there was a split among trial courts regarding the application of the BIPA to biometric timekeeping systems used in health care facilities.

Question certified. In December 2024, the trial court granted the employer’s motion for certification. In February 2025, the Illinois appellate court denied the employer’s application for leave to appeal. In March, the employer petitioned for leave to appeal to the Illinois Supreme Court and in May, the supreme court denied the employer’s petition for leave to appeal to the supreme court but directed the appellate court to answer the question certified by the trial court.

The question certified by the trial court asks: “Is fingerprint or scan of a hand information collected by a healthcare provider from its employees through its timekeeping system for purposes of complying with Illinois and/or Federal healthcare regulations ‘information collected, used, or stored for health care treatment, payment, or operations under HIPAA, such that it is carved out from the definition of ‘biometric identifier’ under the Illinois Biometric Information Privacy Act?”

Biometric identifier. The BIPA explicitly defines the term “biometric identifier” to include a “scan of hand.” Thus, there was no dispute that hand scans were generally meant to be included within the term “biometric identifier.”

However, section 10 of the BIPA exempts certain limited information from the “biometric identifier” category that would otherwise be included in it. Section 10 states: “Biometric identifiers do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under [HIPAA].”

In this instance, the employer argued to the trial court that its employee hand scans were biometric information collected, used, and stored “for health care *** operations.” However, the exemption does not apply to all healthcare operations, but only to those healthcare operations “under [HIPAA].”

If legislators had intended the exemption to apply to all health care operations, they could have ended the exemption with the word “operations.” Thus, the additional phrase “under [HIPAA]” is a limiting phrase carving out some operations from the exemption’s reach.

The appellate court observed that if it interpreted payroll hand scans to be excluded, it was hard to imagine what, if anything, would be left to be covered under the BIPA, and the exemption would become the “broad, categorical exclusion of biometric identifiers taken from health care workers” that the Illinois Supreme Court warned against in Mosby v. Ingalls Memorial Hospital, 2023 IL 129081.

The appellate court agreed with the trial court that HIPAA regulations’ definition of “health care *** under [HIPAA]” is specific to the health care of an individual, as opposed to a system. Nothing in the HIPPA regulation defining the reach of health care under HIPAA covers employee tracking. Rather, the definition clearly states that “[h]ealth care” means care “related to the health of an individual,” just as the trial court found.

Accordingly, the appellate court determined that payroll records and timekeeping are not the functions that make the employer a health care provider.

Concurrence. Justice Wilson wrote a separate concurring opinion to emphasis the narrow scope of the BIPA’s health care exemption and to emphasize the patient-specific linkage that HIPAA requires. According to Justice Wilson, the statutory text and structure of the BIPA, reinforced by controlling precedent, foreclose any reading that would convert general workforce timekeeping into HIPAA “health care operations,” and thus exempt it from the Act. The BIPA exempts biometric identifiers only when “collected, used, or stored for health care treatment, payment, or operations under [HIPAA].”

The case is No. 1-25-0096.

Judge: Reilly, E.

Attorneys: Bonnie Keane DelGobbo (Baker & Hostetler) for The Estates of Hyde Park, LLC. James B. Zouras (Stephan Zouras) for Debra D. Townsend.

Companies: The Estates of Hyde Park, LLC

Cases: Privacy StateLawClaims ClassActions IllinoisNews