Opinion
1-20-0822 1-21-0895
09-30-2022
LUCILLE MOSBY, Individually, and on Behalf of All Others Similarly Situated, Plaintiff-Appellee, v. THE INGALLS MEMORIAL HOSPITAL, UCM COMMUNITY HEALTH & HOSPITAL DIVISION, INC., and BECTON, DICKINSON AND COMPANY, Defendants Beckton, Dickinson and Company, Defendant-Appellant. YANA MAZYA, Individually, and on Behalf of All Others Similarly Situated, Plaintiff-Appellee, v. NORTHWESTERN LAKE FOREST HOSPITAL, and NORTHWESTERN MEMORIAL HEALTHCARE, Defendants-Appellants.
Attorneys for Appellants: Gary M. Miller, Matthew C. Wolfe, and Elisabeth A. Hutchinson, of Shook, Hardy & Bacon L.L.P., both of Chicago, for appellant Becton, Dickinson and Company. Joel Griswold and Bonnie Keane DelGobbo, of Baker & Hostetler LLP, of Chicago, for Northwestern Lake Forest Hospital and Northwestern Memorial HealthCare. Attorneys for Appellee: James B. Zouras, Ryan F. Stephan, Andrew C. Ficzko, Catherine T. Mitchell, and Paige L. Smith, of Stephan Zouras, LLP, of Chicago, for appellees. Amici Curiae: Michael A. Woods, of Naperville, for amici curiae Illinois Health and Hospital Association and Richard H. Tilghman, of Nixon Peabody LLP, of Chicago, for amici curiae Alexian Brothers-AHS Midwest Region Health Co. d/b/s AMITA Health.
Appeal from the Circuit Court of Cook County No. 18 CH 05031 The Honorable Pamela McLean Meyerson, Judge, Presiding.
Appeal from the Circuit Court of Cook County. No. 18 CH 71601 The Honorable Alison C. Conlon, Judge, Presiding.
Attorneys for Appellants: Gary M. Miller, Matthew C. Wolfe, and Elisabeth A. Hutchinson, of Shook, Hardy & Bacon L.L.P., both of Chicago, for appellant Becton, Dickinson and Company. Joel Griswold and Bonnie Keane DelGobbo, of Baker & Hostetler LLP, of Chicago, for Northwestern Lake Forest Hospital and Northwestern Memorial HealthCare.
Attorneys for Appellee: James B. Zouras, Ryan F. Stephan, Andrew C. Ficzko, Catherine T. Mitchell, and Paige L. Smith, of Stephan Zouras, LLP, of Chicago, for appellees.
Amici Curiae: Michael A. Woods, of Naperville, for amici curiae Illinois Health and Hospital Association and Richard H. Tilghman, of Nixon Peabody LLP, of Chicago, for amici curiae Alexian Brothers-AHS Midwest Region Health Co. d/b/s AMITA Health.
JUSTICE ODEN JOHNSON delivered the judgment of the court, with opinion. Justice Mitchell concurred in the judgment and opinion. Presiding Justice Mikva dissented with opinion.
OPINION
ODEN JOHNSON, JUSTICE
¶ 1 Plaintiff Lucille Mosby, a registered nurse, filed a class-action suit individually and on behalf of others similarly situated against defendants Ingalls Memorial Hospital and UCM Community Health & Hospital Division, Inc. (collectively, Ingalls), and Becton, Dickinson and Company (BD). Similarly, plaintiff Yana Mazya, a registered nurse, filed a class-action suit individually and on behalf of others similarly situated against defendants Northwestern Lake Forest Hospital and Northwestern Memorial Healthcare (collectively Northwestern). Both suits were filed under the Biometric Information Privacy Act (Act) (740 ILCS 14/1 et seq/) (West 2018)).
¶ 2 During the course of the Mosby litigation, Ingalls and BD filed a petition for leave to file an interlocutory appeal under Illinois Supreme Court Rule 308 (eff. Oct. 1, 2019) asking this court to answer the following certified question:
"Whether the exclusion in Section 10 of [the Act] for 'information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996' [HIPAA] applies to biometric information of health care workers (as opposed to patients) collected, used or stored for health care treatment, payment or operations under HIPAA?"
¶ 3 Subsequently, Northwestern also filed a petition in the Mayza litigation for leave to file a Rule 308 interlocutory appeal concerning a similar issue:
"Does finger-scan information collected by a health care provider from its employees fall within the [Act's] exclusion for 'information collected, used, or stored for health care
treatment, payment or operations under the federal [HIPAA],' 740 ILCS 14/10, when the employee's finger-scan information is used for purposes related to 'healthcare,' 'treatment,' 'payment,' and/or 'operations' as those terms are defined by the HIPAA statute and regulations?"
¶ 4 While Ingalls and Bd phrase the question as a tautology that presumes certain facts, the parties essentially seek the answer to the same question of whether the biometric information of health care workers is excluded under the Act. We answer "no."
¶ 5 For the reasons explained below, we find that the biometric information of health care workers is not excluded under the Act.
¶ 6 I. BACKGROUND
¶ 7 A. Mosby
¶ 8 On April 18, 2018, Mosby filed a class-action suit against Ingalls and BD seeking redress for each defendant's violations pursuant to section 15(a)-(d) of the Act (740 ILCS 14/15(a)-(d) (West 2018)). Mosby worked as a registered pediatrics nurse at Ingalls Memorial Hospital from October 1987 to February 2017. As a condition of her employment with Ingalls, Mosby was required to scan her fingerprint to authenticate her identity and gain access to Pyxis MedStation, a medication dispensing system distributed and marketed by BD. Mosby alleged that she left Ingalls' employ without ever having been provided with a statement of defendants' destruction policy and schedule.
¶ 9 Mosby alleged that defendants' actions exposed employees like herself to serious irreversible privacy risks. Mosby alleged that defendants violated the Act by (1) not informing her in writing of the specific purpose and the length of time for which her fingerprints were being collected, stored, and used; (2) failing to provide a publicly available retention schedule and guidelines for permanently destroying Mosby's fingerprints; (3) failing to obtain a written release from Mosby to collect, store, disseminate, or otherwise use her fingerprint; and (4) failing to obtain consent before disclosing Mosby's fingerprints to third-party vendors that host the data. On May 14, 2019, plaintiff filed an amended class-action complaint substantially similar to the original.
¶ 10 On June 5, 2019, defendants filed a combined motion to dismiss pursuant to section 2-619.1 (735 ILCS 5/2-619.1 (West 2018)) of the Code of Civil Procedure (Code) or to strike the amended complaint. The motion argued that the complaint should be dismissed pursuant to section 2-619(a)(9) (id. § 2-619(a)(9)) because (1) the biometric data that was collected, used, and/or stored restricted access to protected health information and medication and (2) the data was used for healthcare treatment and operations pursuant to HIPAA (45 C.F.R. § 164.501 (2018)) and was thereby specifically excluded from the scope of the Act. Defendants argued that, pursuant to section 2-615 (735 ILCS 5/2-615 (West 2018)), Mosby failed to allege any well-pleaded facts regarding any disclosures of her fingerprints.
¶ 11 On January 13, 2020, the circuit court ruled that the exception was limited to the information protected under HIPAA. To hold otherwise, the court noted, would result in a broad exception for all employees involved in operations that impact patients protected by HIPAA. The circuit court opined that, if the legislature intended to exempt employees entirely, it would have expressly done so. The court denied defendants' motion to dismiss based on this issue. The circuit court dismissed BD from the complaint in its entirety, without prejudice, and found that Mosby failed to state a claim as to how defendants disseminated her biometric information. With authorization of the circuit court, Mosby amended her pleadings on February 24, 2020, which realleged all of the claims contained in the previously dismissed claim.
¶ 12 On March 16, 2020, defendants filed a joint motion to certify a question for interlocutory appeal under Illinois Supreme Court Rule 308 (eff. Oct. 1, 2019) and stay proceedings. Defendants argued that the question of whether employee information was also exempt under the Act was a question of first impression and had never been heard before this court. Defendants argued that the question was one of statutory construction and there existed a substantial ground for a difference of opinion, which made it appropriate to bring under Rule 308. Defendants maintained that raising the question would be beneficial in a variety of ways, such as: (1) it would advance the outcome of the case with prejudice if the Act was interpreted in their favor, (2) judicial economy would be served, and (3) the need for a uniform construction and application of the law would be served. Defendants also requested a stay in the circuit court proceedings because the determination could lead to a dismissal and Mosby would not be prejudiced.
¶ 13 On April 20, 2020, Mosby filed a motion in opposition to defendants' joint motion to certify the question for interlocutory appeal, arguing that substantial grounds for difference of opinion did not exist. Mosby maintained that to hold otherwise would mean that the General Assembly intended to place anyone employed in the healthcare industry into an "unregulated biometric abyss," by having no biometric protections. Mosby argued that defendants did not demonstrate that they faced any hardship or inequity to justify a stay that would outweigh the prejudice she would suffer. Mosby maintained that the prejudice she would suffer if a stay was granted was the denial of pursuing her claim in an expedient manner and, if successful, the collection of damages. Mosby argued that defendants' conduct was ongoing and continuous and every day that passed would compound the injuries that they were inflicting.
¶ 14 On May 4, 2020, defendants filed a joint reply arguing that the proposed certified question was tailored and limited to those circumstances where the biometric data collected from healthcare workers were used for healthcare treatment, payment, or operations under HIPAA. Defendants further argued that the circuit court did not entirely reject its argument and found it plausible but ultimately concluded that the General Assembly would have been more explicit if the legislative intent was to exclude healthcare employees' biometric data.
¶ 15 On June 18, 2020, the circuit court granted defendants' motion to certify and stay the proceedings. The circuit court ruled that the issue posed by defendants presented a question of law where there was substantial ground for difference of opinion and could ultimately determine whether or not the case should be dismissed.
¶ 16 On July 17, 2020, defendants filed an application for leave to appeal pursuant to Rule 308, which we denied on August 24, 2020. Defendants filed a petition for leave to appeal with the Illinois Supreme Court, on October 30, 2020. On March 3, 2021, the Illinois Supreme Court issued a mandate vacating this court's decision and ordered this court to allow the application for leave to appeal. On June 11, 2021, Ingalls filed an unopposed motion for extension of time to file an opening brief, in which it informed the circuit court that Ingalls and Mosby had reached a settlement in principle. This agreement was between Ingalls and Mosby, not BD.
¶ 17 On March 14, 2022, the circuit court granted final approval of the settlement agreement between Ingalls and Mosby. Ingalls then moved in this court to withdraw from this appeal, which we granted on March 30, 2022, leaving BD as the sole defendant-appellant in the Mosby appeal.
¶ 18 B. Mazya
¶ 19 On April 10, 2019, Yana Mazya and Tiki Taylor filed an amended class-action complaint against Northwestern, Omnicell Inc., and BD seeking redress for each defendant's violations pursuant to section 15(a)-(d) of the Act (740 ILCS 14/15(a)-(d) (West 2018)). Northwestern used medication dispensing systems distributed by both Omnicell and BD. However, both Omnicell and BD were dismissed from this action, as was Taylor. Taylor was dismissed on July 2, 2019, without prejudice. As a party to a collective bargaining agreement, Taylor's claims were preempted.
The initial complaint that was filed is not provided in the record, which is of no consequence here, because Northwestern Memorial Hospital Taylor and Northwestern Memorial Hospital were not originally parties.
While Omnicell and BD were dismissed, the record does not reflect exactly when that occurred.
While Mazya was a nurse,Taylor worked as a patient care technician at Northwestern Memorial Hospital.
Taylor's dismissal occurred after Northwestern removed this case to the Northern District of Illinois under case number 19 C 3191 (Mazya v. Northwestern Lake Forest Hospital, No. 19-CV-3191 (N.D. Ill. June 19, 2019)); the case was subsequently returned to the circuit court.
¶ 20 Like Mosby, Mazya was also employed as a registered nurse, but at Northwestern Memorial Lake Forest Hospital. Like Mosby, Mazya is no longer employed at this hospital, having also left in 2017. Mayza worked for Northwestern from 2012 until December 2017. Like Mosby, Mazya was required to scan her fingerprint to gain access to a medication dispensing system as a condition of her employment. Like Mosby, Mazya alleged that she left defendant's employ without ever having been provided with a statement of its destruction policy and schedule.
¶ 21 Mazya alleged that Northwestern disregarded her statutorily protected privacy rights by unlawfully collecting, storing, using, and disseminating her biometric data in violation of the Act. Like Mosby, Mazya alleged that defendant was in violation of the Act by failing (1) to inform her in writing of the specific purpose and length of time for which her fingerprints were being collected, stored, and used; (2) to provide a publicly available retention schedule and guidelines for permanently destroying her fingerprints; (3) to obtain a written release to collect, store, or otherwise use her fingerprints; and (4) to obtain consent from her to disclose, redisclose, or otherwise disseminate her fingerprints to a third party.
¶ 22 On January 17, 2020, Northwestern filed a motion to dismiss pursuant to section 2-619.1 (735 ILCS 5/2-619.1 (West 2018)) of the Code. Northwestern argued that the complaint should be dismissed pursuant to section 2-619(a)(9) (id. § 2-619(a)(9)) because the General Assembly specifically excluded information collected from healthcare treatment, payment, or operations in the Act. Northwestern further argued that the complaint should be dismissed pursuant to section 2-615 (id. § 2-615) for failure to state a claim because Northwestern did not store or possess her biometric information in violation of the Act when it was used for healthcare treatment, payment, or operations. Northwestern maintained that nothing in the Act was intended to interfere with HIPAA and that applying it to their medication dispensing systems would conflict with guidance previously given by the Department of Health and Human Services (HHS), which encouraged the use of biometrics in health. Northwestern argued that Mazya knew her information was being collected and had the power to withhold consent, citing Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, ¶ 34, as support. Northwestern further argued that Mazya failed to provide factual allegations supporting her conclusory assertions that Northwestern's conduct was intentional or reckless. Lastly, Northwestern requested that Northwestern Memorial Hospital be dismissed from the proceedings, since Taylor was dismissed.
The record reflects that on March 10, 2020, Mazya moved to voluntarily dismiss Northwestern Memorial Hospital from this action; however, the record does not reflect when the motion was granted.
¶ 23 On March 13, 2020, Mazya filed a response to Northwestern's motion to dismiss, arguing that her claims were actionable because they did not fall under any exemption under the Act and the failure to comply with distinct requirements of the Act was all that she needed to demonstrate. Mazya maintained that the Act's explicit reference to biometric data taken from a patient shows the intent of the General Assembly to exclude patient biometrics from the Act's protection because patients were already protected by HIPAA. Mazya further maintained that if the General Assembly wanted to provide a sweeping categorical exemption for hospitals it would have done so as evidenced by the exclusion of financial institutions reflected in section 25(c) of the Act (740 ILCS 14/25(c) (West 2018)).
¶ 24 Northwestern filed a reply on April 3, 2020, arguing that Mazya's interpretation of the Act ignored the disjunctive "or" provided in section 10 of the Act, which connotes two different alternatives, and thus the exemption included employee information. Northwestern maintained that Mazya failed to rebut its argument that she failed to state a claim because her claims were not supported by the language of the statute and were solely policy-based. Northwestern further maintained that it would be good policy to interpret the statute their way given that the usage of biometric information has been encouraged by the government.
¶ 25 On November 2, 2020, the circuit court denied Northwestern's section 2-619.1 motion. The circuit court found Northwestern's section 2-619 argument unpersuasive because the burden for compliance with the Act falls on the collector of the data, not the provider. Put another way, Mazya did not waive her consent by continuing to offer her biometric data to Northwestern as a condition of her duties as a nurse. The circuit court found that accepting Northwestern's interpretation of the Act would amount to medical professionals having no protections for their biometric information. In regard to Northwestern's section 2-615 arguments, the circuit court found that, to have a viable claim, (1) the claimant need not lack knowledge of the violation, as the violation itself was enough to support the statutory cause of action, and (2) the claimant was not required to plead an intentional or reckless violation of the Act, at that stage of the proceedings.
¶ 26 On November 30, 2020, Northwestern filed a corrected motion for Rule 308 certification and to stay the proceedings. Northwestern argued that there were substantial grounds for difference of opinion given the disjunctive "or" in section 10. Northwestern further argued that the proceedings should be stayed pending this court's decision because our answer to the question could expedite the resolution of the underlying case.
¶ 27 On December 11, 2020, Mazya filed a motion to strike Northwestern's motion for certification and stay. Mazya argued that Northwestern was trying to certify the same question that this court denied in Mosby v. Ingalls Memorial Hospital, No. 1-20-0822. On January 13, 2021, Mazya filed a response in opposition to Northwestern's motion for Rule 308 certification and stay, reiterating her previous arguments and noting that Northwestern had not lodged any new arguments or law on the matter.
¶ 28 On February 9, 2021, Northwestern filed a reply in further support of its Rule 308 motion, informing the circuit court that the Illinois Supreme Court directed this court to vacate its August 24, 2020, order and accept the Rule 308 appeal (Mosby v. Ingalls Memorial Hospital, No. 126590 (Ill. Jan. 27, 2021) (supervisory order)). On February 9, 2021, the circuit court denied Northwestern's Rule 308 motion but stayed the proceedings pending this court's decision in Mosby.
¶ 29 On June 15, 2021, Northwestern filed a motion to reconsider the circuit court's denial of its Rule 308 certification, arguing that the hospital defendant in Mosby (Ingalls) had reached a settlement in principle with the plaintiff in Mosby and, therefore, no one would be presenting any arguments on appeal on behalf of a hospital that used medication dispensing systems secured by finger-scan technology. Mazya responded on June 22, 2021, that she was not opposed to the appellate court hearing a certified question.
¶ 30 On July 23, 2021, the circuit court granted Northwestern's motion to reconsider and stayed the proceedings, noting that the issue involves a question of law as to which there were substantial grounds for difference of opinion and that an immediate appeal could materially advance the ultimate termination of the litigation. Accordingly, the circuit court certified its question to this court.
¶ 31 On July 27, 2021, Northwestern filed an application for leave to appeal pursuant to Rule 308 reiterating the arguments it had made at the circuit court and requesting that the case be consolidated with Mosby. We granted the motion on August 13, 2021.
¶ 32 After Northwestern filed its consolidation motion, but before this court granted it, we also granted a motion on August 5, 2021, by Northwestern, as well as the Illinois Health and Hospital Association and Amita Health, to file an amicus curiae brief in the Mosby appeal. Northwestern and the two amici reiterated defendants' arguments and observed that "[h]ealth care employs 10% of the state's workforce." They argued that interpreting section 10 in favor of plaintiffs regarding the medical supply dispensing systems at issue could result in undesirable consequences for healthcare providers, and would be financially burdensome, resulting in a lower quality of care for patients.
In its brief in the Mayza appeal, Northwestern explained that it joined in the amicus brief in the Mosby appeal only because the deadline for doing so expired before this court granted its Rule 308 petition for leave to appeal.
¶ 33 C. Petition for Rehearing
¶ 34 On February 25, 2022, this court issued an opinion finding that the exclusion at issue did not apply to biometric information collected by a health care provider from its employees. On March 18, 2022, Northwestern and BD, the only remaining defendants in both appeals, filed a joint petition for rehearing arguing, among other things, (1) that the exclusion sets forth two categories, with the first category relating to patient information and the second category relating to the information of others, such as its employees; (2) that the phrase "under [HIPAA]" in the second category applies to "treatment, payment or operations" rather than to "collected, used or stored"; and (3) that we should use the secondary meaning of "under" in the Merriam-Webster Dictionary, which is "subject to the authority of." We granted the petition for rehearing, ordered additional briefing and now modify our order to address these arguments. For reasons that we explain below, we do not find these arguments persuasive. Supra ¶¶ 58-64.
¶ 35 II. ANALYSIS
¶ 36 On appeal, Northwestern, BD and the two amici (collectively, defendants) argue that this court should answer both certified questions in the affirmative, because section 10 of the Act (740 ILCS 14/10 (West 2018) excludes employee biometric information used in medication dispensing systems from the protections of the Act.
¶ 37 A. Jurisdiction
¶ 38 As a preliminary matter, we observe that Illinois Supreme Court Rule 308 (eff. Oct. 1, 2019) provides this court with jurisdiction to review the certified questions on this appeal. "Generally, courts of appeal have jurisdiction to review only final judgments entered in the trial court, absent a statutory exception or rule of the supreme court." In re Estate of Luccio, 2012 IL App (1st) 121153, ¶ 17. "Supreme Court Rule 308 provides one such exception." Luccio, 2012 IL App (1st) 121153, ¶ 17. "Rule 308 allows for permissive appeal of an interlocutory order certified by the trial court as involving a question of law as to which there is substantial ground for difference of opinion and where an immediate appeal may materially advance the ultimate termination of the litigation." Luccio, 2012 IL App (1st) 121153, ¶ 17.
¶ 39 "Generally, the scope of our review is limited to the certified question." Moore v. Chicago Park District, 2012 IL 112788, ¶ 9. However, a reviewing court may disregard words in the question that mischaracterize the issue and consider, instead, "the question remaining." Moore, 2012 IL 112788, ¶¶ 11-14 (although the word "unnatural" was present in the certified question, the court disregarded it and considered the remaining question, because this word mischaracterized the issue).
¶ 40 B. Standard of Review and Statutory Construction
¶ 41 When reviewing a certified question of law pursuant to Illinois Supreme Court Rule 308 (eff. Oct. 1, 2019), we apply a de novo standard of review. O 'Halloran v. Luce, 2013 IL App (1st) 113735, ¶ 31. De novo review means that the reviewing court owes "no deference to the trial court." People v. Anderson, 2021 IL App (1st) 200040, ¶ 41. "In addition, we may affirm on any basis appearing in the record, whether or not the trial court relied on that basis and whether or not the trial court's reasoning was correct." Khan v. Fur Keeps Animal Rescue, Inc., 2021 IL App (1st) 182694, ¶ 25. De novo review is also appropriate because it applies when resolution turns, as it does here, on a question of statutory interpretation. Eighner v. Tiernan, 2020 IL App (1st) 191369, ¶ 8.
¶ 42 With statutory interpretation, our primary goal is to ascertain and give effect to the intent of the statute's drafters. VC&M, Ltd. v. Andrews, 2013 IL 114445, ¶ 30. The most reliable indicator of the drafters' intent is the language they chose to use in the statute itself. VC&M, Ltd., 2013 IL 114445, ¶ 30. The drafters' language should be given its plain and ordinary meaning, (VC&M, Ltd., 2013 IL 114445, ¶ 30), and the statute that they crafted should be read as a whole (Watson v. Legacy Healthcare Financial Services, L.L.C, 2021 IL App (1st) 210279, ¶ 38 (BIPA must be read in its entirety)). In addition, statutory exclusions are interpreted narrowly when they exclude certain members of the public from enjoying rights given to all. American Federation of State, County and Municipal Employees, Council 31 v. Illinois Labor Relations Board, 2014 IL App (1st) 132455, ¶ 31; see also City of Chicago v. Janssen Pharmaceuticals, Inc., 2017 IL App (1st) 150870, ¶ 15 ("exemptions are read narrowly" so as not to defeat the legislative purpose).
¶ 43" 'When a statute does not define its own terms, a reviewing court may use a dictionary to ascertain the plain and ordinary meaning of those terms.'" Watson, 2021 IL App (1st) 210279, ¶ 36 (citing Maschek v. City of Chicago, 2015 IL App (1st) 150520, ¶ 56 (citing People v. McChristian, 2014 IL 115310, ¶ 15, and People v. Bingham, 2014 IL 115964))); see also People v. Chapman, 2012 IL 111896, ¶ 24 ("When a statute contains a term that is not specifically defined, it is entirely appropriate to look to the dictionary to ascertain the plain and ordinary meaning of the term."). This court has previously relied on Merriam-Webster Online Dictionary when interpreting words in this Act, including specifically the words "capture" and "collect" which are used in the exclusion at issue on this appeal. Watson, 2021 IL App (1st) 210279, ¶¶ 58-59.
¶ 44 If the language of the statute is plain and ambiguous, we apply it without resort to any further aids of statutory interpretation. In re Lance H., 2014 IL 114899, ¶ 11; Krohe v. City of Bloomington, 204 Ill.2d 392, 395 (2003); Maschek, 2015 IL App (1st) 150520, ¶ 44 ("If the statutory language is clear, we must apply it, without resort to any aids of statutory construction."). "If, and only if, the statutory language is ambiguous" may we "look to other sources to ascertain the legislature's intent," such as the statute's legislative history and debates. Maschek, 2015 IL App (1st) 150520, ¶ 44.
¶ 45 C. Biometric Information
¶ 46 For purposes of this appeal, defendants do not dispute that the fingerprints captured here qualify as biometric information as that phrase is defined by the Act.
As BD notes in its brief to this court, "[defendants deny Plaintiffs allegations, including *** that the data falls under BIPA's definitions of biometric identifier and information." However, since theses cases were "at the motion to dismiss stage" when these appeals were taken, defendants acknowledge that "[Plaintiffs allegations must be taken as true."
¶ 47 The Act defines "biometric information" as "any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual." 740 ILCS 14/10 (West 2018). The Act defines "biometric identifiers" as "a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry." Id. On this appeal, and for the limited purpose of this appeal, the parties do not dispute that the fingerprint scan of plaintiffs and other similarly situated hospital employees is a biometric identifier and, when stored, this fingerprint constitutes biometric information as defined in the Act.
¶ 48 D. Exclusions at Issue
¶ 49 The dispute on this appeal concerns whether the nurses' fingerprints, although biometric information, are nonetheless excluded from the Act's protections..
¶ 50 Section 10 of the Act provides a number of exclusions from the protections of the Act. The following exclusion is the one at the heart of this appeal:
"Biometric identifiers do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996." Id.
Defendants argue that the exclusion above sets forth two categories of excluded information. . In essence, defendants argue that the exclusion should be read as follows:
"Biometric identifiers do not include
[First category or sub-exclusion] information captured from a patient in a health care setting or
[Second category or sub-exclusion] information collected used or stored for health care treatment, payment, or operations under the federal Health Insurance, Portability and Accountability Act of 1996." Id. § 10.
In addition, Section 25 of the Act excludes certain sectors of the workforce:
"(c) Nothing in this Act shall be deemed to apply in any manner to a financial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 [(15 U.S.C. § 6803 (2018))] and the rules promulgated thereunder.
***
(e) Nothing in this Act shall be construed to apply to a contractor, subcontractor, or agent of a State agency or local unit of government when working for that State agency or local unit of government." Id. § 25(c), (e).
¶ 51 E. Parties' Arguments on Appeal
¶ 52 Defendants contend that hospital workers' use of medication dispensing systems falls within section 10's exclusion for health care information. They argue that the medication dispensing systems at issue in this case are permitted to collect information for "healthcare treatment, payment, or operations" as defined by HIPAA. 45 C.F.R. § 164.501(2) (2018). They further argue that this includes the fingerprint scans of employees who facilitate the dispensing and administration of medications prescribed to patients. Defendants assert that the collection, use, and storage of healthcare workers' biometric information is for "health care" and "treatment" that healthcare systems provide to patients, as those terms are defined by HIPAA. Id. Defendants contend that medication dispensing systems also act to provide an audit trail, which prevents diversion and fraud, and enables abuse detection. Defendants assert that such a system additionally aids in patient safety, quality of care, and accurate billing. Defendants contend that the nurses' biometric information is collected through the medication dispensing system and used for "health care operations" and "payment."
¶ 53 Defendants contend that the circuit court erred in finding that the exclusion for health care information applies only to information from a patient because the exclusion does not state that it is limited to patient biometric data. Defendants observe that the health care exclusion contains an "or," and they argue that this "or" is disjunctive and connotes two different categories of excluded information. Defendants assert that the second category is not limited to patient data. Defendants maintain that, to fall within this exclusion of the Act, the biometric information must either (1) be obtained from a patient in a healthcare setting or (2) be collected, used, or stored in connection with healthcare treatment, payment, and operations under HIPAA.
¶ 54 Plaintiffs argue that the Act excludes only patient biometric data from its protections because patient data is already protected by HIPAA. Plaintiffs assert that finding otherwise would leave thousands of hospital workers unprotected from the risks that the Act was designed to protect against. Plaintiffs assert that defendants' interpretation of the second category does not make sense because it states, "under HIPAA" and patient information is the only information governed by HIPAA.
¶ 55 In their reply briefs, defendants argue, among other things, that the storage of healthcare workers' biometric information, obtained when accessing a medication dispensing system, is for the "health care" and "treatment" of patients as those terms are defined by HIPAA; and, therefore, the "under HIPAA" language does not exclude this type of information.
¶ 56 F. Plain Language
¶ 57 We find that the language of the statute is clear.
¶ 58 First, there is no redundancy, as defendants claim results from our interpreting both categories as covering patient information. Defendants' arguments about redundancy overlook the verbs used in the two sub-exclusions or categories. The first sub-exclusion or category is for information "captured." 740 ILCS 14/10 (West 2018). The first couple of definitions of "capture" in the dictionary, such as "to take captive" or "to emphasize," do not apply here. Merriam-Webster Online Dictionary, https://ww.merriam-webster.com/dictionary/capture (last visited May 9, 2022). However, the secondary meaning of "to record in a permanent file (as in a computer)" clearly applies here. After this definition, the dictionary provides the following example of its use in a sentence: "The system is used to capture data ***." Similarly, in the first category of this exclusion, the information is captured, or recorded in a permanent file, from an individual patient in a healthcare setting.
¶ 59 By contrast, the second sub-exclusion or category is for information that is "collected, used or stored." 740 ILCS 14/10 (West 2018). The first definitions of "collect" in the dictionary are: "to bring together into one body and place," "to gather or exact from a number of persons or sources," and "to gather an accumulation of." Merri am-Webster Online Dictionary, https://ww.merriam-webster.com/dictionary/collect (last visited May 9, 2022). Thus, after the capture of information from an individual patient in a healthcare setting (described in the first category), that information may be gathered or accumulated from a number of persons into one place. So far in our reading of the statute, there is no redundancy in coverage: the first category covers when the information is captured from a patient in a health care setting; and the second category applies when information is subsequently gathered and accumulated. The second sub-exclusion or category goes on to cover information when, after its capture and accumulation, it is then used or stored. There is simply no redundancy in this statute. While both categories apply to patient information, we cannot overlook the different verbs used to modify the categories of information in the two clauses thereby giving two very different meanings and eliminating any redundancy. 740 ILCS 14/10 (West 2018).
¶ 60 Our interpretation of the two categories tracks closely the two objectives of the Act identified by our supreme court. In West Bend Mutual Insurance Co. v. Krishna Schaumburg Tan, 2021 IL 125978, our supreme court found that the Act protects an individual in two distinct and important ways. Our highest court found: "the Act codifies (1) an individual's right to privacy in their biometric identifiers-fingerprints, retina or iris scans, voiceprints, or scans of hand or face geometry-and (2) an individual's right to privacy in their biometric information-information based on an individual's biometric identifiers that is then used to identify an individual." Similarly, in the case at bar, the exclusion applies to (1) information as it is captured from the patient in a healthcare setting; and (2) information that is collected, used or stored. There is no redundancy here, even though both clauses refer to patient information, as we explain below.
In addition, the two categories can be seen as protecting: (1) information captured from the patient in a healthcare setting and (2) information that is already protected "under the federal Health Insurance Portability and Accountability Act of 1996." 740 ILCS 14/10 (West 2018). The disjunctive "or" means that information as it is captured directly from the patient and information under HIPAA are alternatives to be considered separately. Goldberg v. Brooks, 409 Ill.App.3d 106, 111 (2011).
¶ 61 Second, defendants argue that the "under [HIPAA]" clause applies: (1) not to both types of information; and (2) not to "collected, used or stored"; (3) but only to "treatment, payment or operations." Defendants argue that, since "under [HIPAA]" appears after a disjunctive "or," the clause does not apply to anything that appears before that first "or." For this reason, they assert that it does not apply to both types of information. However, although defendants argue that the "under [HIPAA]" clause applies only to what immediately precedes it, they argue that it applies-not simply to "operations"-but to "treatment, payment or operations." (Emphasis added.) Thus, they argue that the first use of "or" means that the clause does not apply to what precedes the "or," but that this same logic does not apply to the statute's second use of "or." We do not find persuasive an argument with an internal contradiction. .
In essence, defendants read the first "or" as disjunctive but the second "or" as conjunctive, thereby, giving two different meanings to the very same word in the very same sentence. Encino Motorcars, LLC v. Navarro, ___ U.S. ___, 138 S.Ct. 1134, 1141-42 (2018) ("it would be odd to read the exemption as starting with" a disjunctive phrasing "and then, halfway through and without warning, switching" to a conjunctive phrasing-"all while using the same word ('or') to signal both meanings").
Defendants here are trying to manipulate the last antecedent doctrine, which provides that qualifying words or phrases apply to the words or phrases immediately preceding them, and not to "more remote" words, "unless the intent of the legislature, as disclosed by the context and reading of the entire statute requires such an extension or inclusion." In re E.B., 231 Ill.2d 459, 467 (2008).
¶ 62 Defendants argue that, under the series-qualifier canon of statutory construction, a modifier at the end of a series of two or more nouns or verbs applies to the entire series. Facebook, Inc. v. Duguid, ___ U.S. ___, 141 S.Ct. 1163, 1169 (2021). Under that logic, "under [HIPAA" applies to both types of "information." 740 ILCS 14/10 (West 2018). As defendants note, "[u]nder conventional rules of grammar, '[w]hen there is a straightforward, parallel construction that involves all nouns *** in a series,' a modifier at the end of the list 'normally applies to the entire series.'" Facebook, 141 S.Ct. at 1169 (quoting A. Scalia & B. Garner, Reading Law: The Interpretation of Legal Texts 147 (2012) (Scalia & Garner) (quotation modified in opinion)). In the exclusion at issue, defendants argue that there are two categories of information-in other words, a straightforward parallel construction setting forth two categories of "information." 740 ILCS 14/10 (West 2018). Under the series-qualifier canon argued by defendants, the clause "under [HIPAA," which appears at the end, would, therefore, apply to both types of information in the series-not just to the second type as they argue. 740 ILCS 14/10 (West 2018).
¶ 63 Defendants further argue that "under" means "subject to the *** guidance, or instruction of." Merriam-Webster Online Dictionary, https://ww.merriam-webster.com/dictionary/under (last visited May 9, 2022). For this definition, defendants rely on the Merriam-Webster Online Dictionary, but they skip the first or primary meaning and utilize instead the second or secondary meaning. However, the first or primary meaning of "under," when used as a preposition as it is here, is "below or beneath so as to be *** covered [or] protected *** by." Merriam-Webster Online Dictionary, https://ww.merriam-webster.com/dictionary/under (last visited May 9, 2022). The information covered and protected by HIPAA is that of the patients, not the employees. U.S. v. Bek, 493 F.3d 790, 802 (2007) (HIPAA protects patient medical records from unauthorized disclosure by creating a procedure for obtaining authority to use them).
We agree with defendants that, since "under" in this instance is being used as a preposition, it is the second entry for preposition that must be utilized here. Merriam-Webster Online Dictionary, https://ww.merriam-webster.com/dictionary/under (last visited May 9, 2022).
¶ 64 At oral argument, Northwestern argued that this court should not consider the terminology "under HIPAA" and instead we should consider this as "defined by HIPAA." However, "under HIPAA" is what the Act expressly states, and that cannot be ignored. We are simply unable to rewrite the statute. Zahn v. North American Power & Gas, LLC, 2016 IL 120526, ¶ 15. Either way, the biometric information of employees is simply not defined or protected "under HIPAA." Accordingly, the plain language of the statute does not exclude employee information from the Act's protections because they are neither (1) patients nor (2) protected under HIPAA. We further find that, if the legislature intended to exclude all healthcare workers from the Act's protections, it would have done so. Where the legislators wanted to create blanket exclusions for certain sectors of the workforce, they expressly provided that the Act did not apply either to financial institutions subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 or to employees, contractors, or subcontractors of local government or the State as provided in section 25. 740 ILCS 14/25(c), (e) (West 2018). No such express, blanket exclusion exists for healthcare workers and we will not rewrite the Act to provide one. Northwestern and the amici argue that "[h]ealth care employs 10% of the state's workforce." If that is true, then creating such an exclusion would have far reaching implications.
While the Act provides that "nothing" in it "shall be construed to conflict with" HIPAA (740 ILCS 14/25 (b) (West 2018)), that is not the same as a blanket exclusion for healthcare workers. When legislators wanted the Act not to apply at all to a certain sector of the workforce, they explicitly stated that "[n]othing in this Act shall be construed to apply" and then named the institutions that were exempt. By contrast, subsection (b) does not exempt or exclude or even name hospitals or third-party vendors, such as defendants in the appeal at bar. 740 ILCS 14/25 (b) (West 2018),
According to its amicus brief, Northwestern alone employs "29,800 physicians, nurses, allied health professionals, clinical support staff and administrative employees." In fiscal year 2020, the Northwestern health system had "more than 104,000 inpatient admissions and more than 2.2 million outpatient encounters.
¶ 65 Defendants' attempt to include employee biometric information under this exclusion goes beyond the plain language of the Act. A reviewing court is unable to "rewrite a statute to add provisions or limitations the legislature did not include." Zahn, 2016 IL 120526, ¶ 15. "No rule of construction authorizes us to declare that the legislature did not mean what the plain language of the statute imports." Id. There is simply no provision or reference to the exclusion of employee biometric data in the Act or its protection in HIPAA. Thus, we will not add employee biometric data as information to be excluded by the Act because it would be contrary to its plain language.
¶ 66 G. Objectives
¶ 67 Part of the plain language of this Act are its objectives, which are stated right in the Act itself. The legislative purpose of this Act is easy to discern because the Act's drafters provided a statutory section entitled: "Legislative findings; intent." 740 ILCS 14/5 (West 2018); Watson, 2021 IL App (1st) 210279, ¶ 49 ("The legislative purpose of BIPA "is easy to discern because the Act's drafters provided a statutory section" stating just that). The section notes that "corporations" are interested in utilizing the new biometric technology. 740 ILCS 14/5(b) (West 2018). However, "[a]n overwhelming majority" of the public are wary. 740 ILCS 14/5(d) (West 2018). The section explains that the public is wary because, "once" a corporation has "compromised" an individual's unique biometric identifier, "the individual has no recourse." 740 ILCS 14/5(c) (West 2018). The purpose of the Act is to reassure a wary public by providing a means for "regulating the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information." 740 ILCS 14/5(g) (West 2018). Finding that the nurses at issue here are covered by the Act vis-a-vis their employers and the MedStation marketing company furthers the stated goals of the Act. The primary purpose of this Act is to protect the secrecy interest of the "individual" in his or her biometric information, such as the finger scans at issue here. West Bend, 2021 IL 125978, ¶ 46 ("the Act protects a secrecy interest-here, the right of an individual to keep his or her personal identifying information like fingerprints secret"). Our findings today further that purpose.
¶ 68 Since the language is plain, we need not consider other sources to discern statutory meaning. "[A]bsent ambiguity *** there is no basis to delve into the conference reports or statements of legislators." Kaider, 2012 IL App (1st) 111109, ¶ 11. However, as a final matter, we note that, even if we were to consider defendants' legislative-history argument, we would not find it persuasive. Defendants cite the following line from a page of remarks by the House sponsor of the bill, Representative Kathleen Ryg: "[The Act] provides exemptions as necessary for hospitals[.]" 95th Ill. Gen. Assem., House Proceedings, May 30, 2008, at 249 (statement of Representative Ryg) (found at http://www.ilga.gov/house/transcripts /htrans95/09500276.pdf); Maschek, 2015 IL App (1st) 150520, ¶ 62 (when interpreting an ambiguous phrase in a statute, courts look especially to the remarks of the bill's sponsor). In the quoted line, Representative Ryg did not assert that the Act provided a blanket exclusion for all healthcare workers; rather she asserted that it provided "exemptions as necessary." Her remark is completely consistent with our finding that the Act excludes from coverage information as it is captured from a patient in a healthcare setting, as well as HIPAA-protected information that is "collected, used or stored." 740 ILCS 14/10 (West 2018). These exclusions are the ones that legislators like Representative Ryg apparently deemed "necessary." Representative Ryg ended her remarks, immediately prior to passage, by stating: "we are in very serious need of protections for the citizens of Illinois when it comes to biometric information." 95th Ill. Gen. Assem., House Proceedings, May 30, 2008, at 249 (statement of Representative Ryg) (found at http://www.ilga.gov/house/transcripts/htrans95/09500276 .pdf); Maschek, 2015 IL App (1st) 150520, ¶ 62 ("The remarks made immediately prior to passage are particularly important."). Those citizens include the nurses at issue here.
In any event, Representative Ryg's comment about "hospitals" does nothing to aid third-party vendors like BD.
"The crafting of specific language often reflects legislative compromise reached after hard fought battles over the means to reach even common goals. Courts should only reluctantly turn to legislative history for fear of upsetting the delicate balance reflected in a finally worded piece of legislation." Trustees of Iron Workers Local 473 Pension Trust v. Allied Products Corp., 872 F.2d 208, 213 (1989).
¶ 69 This court has previously observed that: "Representative's Ryg's remarks establish that the primary impetus behind the bill was to allay the fears of and provide protections for 'thousands of people who had provided their biometric data for use as identifiers and who were now left 'wondering what will become of this data. Watson, 2021 IL App (1st) 210279, ¶ 64 (quoting 95th Ill. Gen. Assem., House Proceedings, May 30, 2008, at 249 (statement of Representative Ryg) (found at http://www.ilga.gov/house/transcripts/htrans95/09500276 .pdf). "This is the position" that Mosby and Mayza "found [themselves] in, after leaving defendants' employ" in 2017 "without ever having been provided with a statement of defendants' destruction policy and schedule." Watson, 2021 IL App (1st) 210279, ¶ 64. Consideration of the legislative history and the Act's objectives leave no doubt that we are reaching the correct finding.
¶ 70 III. CONCLUSION
¶ 71 Consistent with the plain language of the Act, we find that the legislature did not exclude health-care employee biometric information from its protections. We remand this cause for further proceedings consistent with this opinion.
¶ 72 Certified questions answered; cause remanded.
¶ 73 PRESIDING JUSTICE MIKVA, dissenting:
¶ 74 Having considered the parties' arguments on rehearing, I must respectfully dissent from the majority's opinion in this case. I am now convinced that the General Assembly did intend to exclude from the Act's protections the biometric information of healthcare workers- including finger-scan information collected by those workers' employers-where that information is collected, used, or stored for health care treatment, payment, or operations, as those functions are defined by HIPAA. In my view, plaintiffs and the majority ignore important rules of statutory construction, while overcomplicating a more straightforward reading of this exclusion. For the reasons that follow, I would answer "yes" to the certified questions in these consolidated cases.
¶ 75 The exclusion in section 10 of the Act provides that "[b]iometric identifiers do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996 [(HIPAA)]." (Emphasis added.) 740 ILCS 14/10 (West 2016). I agree with defendants that the first part of this provision excludes from the Act's coverage information from a particular source-patients in a health care setting-and the second part excludes information used for particular purposes-healthcare treatment, payment, or operations-regardless of the source of that information. The plain language of the statute, and particularly the use of the words "from" and "for," make this clear.
¶ 76 The majority's interpretation of this exclusion ignores two fundamental rules of statutory construction: the last antecedent rule and the rule that statutes should be construed, wherever possible, such that no word or phrase is rendered superfluous or meaningless. Application of these two basic rules make clear to me that this exclusion extends to biometric information collected from health care workers by their employers-where that information is collected, used, or stored for health care treatment, payment, or operations-and is not limited, as the majority concludes, to biometric information collected from patients.
¶ 77 The last antecedent rule is "a long-recognized grammatical canon of statutory construction." In re E.B., 231 Ill.2d 459, 467 (2008). That rule "provides that relative or qualifying words, phrases, or clauses are applied to the words or phrases immediately preceding them and are not construed as extending to or including other words, phrases, or clauses more remote." Id.
¶ 78 Applying the last antecedent rule, the phrase "under [HIPAA]" in section 10's exclusion applies to "health care treatment, payment, or operations," the phrase that immediately precedes it, rather than to the more remote phrase "information collected, used, or stored." Healthcare treatment, payment and operations are terms of art that are carefully and explicitly defined in HIPAA's implementing regulations. See 45 C.F.R. § 164.501 (titled "Definitions") (West 2016).
¶ 79 Healthcare operations, for example, is defined as "any of the following activities of the covered entity to the extent that the activities are related to covered functions," followed by a list of six specific activities. Id. Treatment and payment are also defined in detail. Id. It is these definitions that the exclusion in section 10 is referencing when it says "under HIPAA."
¶ 80 This triumvirate of healthcare treatment, payment, and operations is repeatedly used to define the activities of covered entities that are the subject of those regulations. See, e.g., 45 C.F.R. § 164.506 (titled "Uses and disclosures to carry out treatment, payment, or health care operations" and employing the phrase "treatment, payment, or health care operations" an additional seven times); id. § 164.502 (using the phrase twice); id. § 164.504 (using the phrase three times); id. § 164.508 (using the phrase once); id. § 164.514 (using the phrase once); id. § 164.520 (using the phrase twice); id. § 164.522 (using the phrase twice); id. § 164.528 (using the phrase once); id. § 170.210 (using the phrase twice); and id. § 170.315 (using the phrase once).
¶ 81 As defendants point out, one definition of the word "under" is "subject to the authority, control, guidance, or instruction of." Merriam-Webster's Online Dictionary, https://www.merriam-webster.com/dictionary/under (last visited Sept. 8, 2022). "Treatment," "payment," and "operations," are "under" HIPAA because a particular meaning is ascribed to each of these terms by HIPAA's implementing regulations. Under the provisions of HIPAA, those three terms have definite and well-known meanings that our General Assembly saw no reason to duplicate or reinvent when it drafted the legislation that is the subject of this appeal. Incorporating by reference established definitions in this manner promotes clarity, consistency, and familiarity in the law, a "familiar legislative process" long recognized by our supreme court (People v. Murray, 2019 IL 123289, ¶¶ 13, 24 (noting that the statute defining the offense of unlawful possession of a firearm by a street gang member incorporates by reference the definition of a "streetgang" set out in the Illinois Streetgang Terrorism Omnibus Prevention Act)). The General Assembly has in fact borrowed these same definitions on other occasions, and it has used the phrase "under HIPAA" to do so. See 210 ILCS 25/2-134, 2-136, and 2-137 (West 2016) (providing, for purposes of the Illinois Clinical Laboratory and Blood Bank Act, that each of these terms-treatment, payment, and health care operations-"has the meaning ascribed to it under HIPAA" and "as specified in 45 CFR 164.501" (emphasis added)).
¶ 82 The majority criticizes defendant's reliance on the last antecedent rule, pointing out that, if the rule was strictly applied, "under [HIPAA]" would apply only to the word "operations." But application of the last antecedent rule is always limited by "the intent of the legislature, as disclosed by the context and reading of the entire statute." In re E.B., 231 Ill.2d at 467 . And here, "treatment," "payment," and "operations" are all closely related and indeed are all HIPAA-defined terms. In this context, "under [HIPAA]" applies to all of these activities. However, if "under HIPAA" applied only to "operations," information collected, used, or stored for health care treatment or payment would still be within the exclusion and thus the exclusion would still apply where the biometric information of health care workers is used for healthcare treatment.
¶ 83 The other bedrock principle that compels my understanding that this exclusion applies to biometric information used for healthcare treatment is that "statutes should be construed so that no word or phrase is rendered superfluous or meaningless." People v. Parvin, 125 Ill.2d 519, 525 (1988). The interpretation offered by the majority reads important words out of the exclusion in section 10 and indeed would render that entire exclusion redundant in light of another exclusion already in BIPA.
¶ 84 First, the majority fails, in my view, to satisfactorily consider the fact that the word "information" is deliberately used twice in this exclusion, first in reference to "information captured from a patient in a health care setting" and then after the word "or," suggesting that this is a different kind of information, in reference to "information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996 [(HIPAA)]." The majority's explanation is that "captured" is different than "collected" but, in the majority's reading, all "information" is patient information. Supra ¶¶ 58-60. Under this reading, there is simply no reason to use the word "information" twice in the disjunctive, suggesting that the exclusion is referencing two different kinds of information. ¶ 85 Moreover, if as the plaintiffs have consistently argued, the purpose of this exclusion is simply to avoid any potential conflict between BIPA and HIPAA, both of which protect privacy, the entire exclusion would be unnecessary. Section 25(b) of BIPA already makes clear that "[n]othing in this Act shall be construed to conflict with the X-Ray Retention Act, the federal Health Insurance Portability and Accountability Act of 1996 and the rules promulgated under either Act." 740 ILCS 14/25 (West 2016).
¶ 86 The majority sidesteps these rules of construction to arrive at an interpretation of the exclusion in section 10 that aligns with its preferred definition of the word "under" as meaning "protected by." See supra ¶ 63. It is true that one definition of that word is "covered [or] protected by" (Merriam -Webster's Online Dictionary, https://www.merriam-webster.com/dictionary/under (last visited Sept. 8, 2022)). I also agree that only patient information is "protected by" HIPAA. But before we decide the meaning of the word "under," we must first determine what phrase that word applies to. The last antecedent rule and the rule against treating language in a statute as superfluous both dictate that "under" HIPAA refers to "healthcare treatment, payment, and operations." None of these activities are "protected" by HIPAA. Rather, they are activities that are defined by HIPAA and that, when engaged in by covered entities, make certain HIPAA regulations applicable.
¶ 87 The majority also reasons that, if the General Assembly intended to create a blanket exclusion for the healthcare industry, it could have drafted one, just as it did for the financial industry (see 740 ILCS 14/25(c) (West 2016)). Supra ¶ 64. But defendants are not suggesting that the legislature intended to exempt the healthcare industry as whole. Rather, in their view and mine, this is a far narrower exclusion to allow the healthcare industry to use biometric information for treatment, payment and operations, as those terms are defined by HIPAA. It is hard to imagine a better example of this than finger-scan information collected by those workers' employers to ensure that medication is properly dispensed. Conversely, if the General Assembly intended only to exclude "patient information protected by HIPAA," it certainly could have said just that.
¶ 88 For all of these reasons, I would answer "yes" to the two certified questions.
¶ 89 I respectfully dissent.