Opinion
129081
11-30-2023
LUCILLE MOSBY et al., Individually and On Behalf of All Others Similarly Situated, Appellees, v. THE INGALLS MEMORIAL HOSPITAL et al. (Becton, Dickinson and Company et al., Appellants).
JUSTICE OVERSTREET delivered the judgment of the court, with opinion. Chief Justice Theis and Justices Neville, Holder White, Cunningham, Rochford, and O'Brien concurred in the judgment and opinion.
OPINION
OVERSTREET, JUSTICE
¶ 1 The instant action involves an interlocutory appeal pursuant to Illinois Supreme Court Rule 308 (eff. Oct. 1, 2019), wherein we consider the following two versions of essentially the same certified question:
"Whether the exclusion in Section 10 of [the Biometric Information Privacy Act (Act) (740 ILCS 14/10 (West 2018))] for 'information collected, used, or stored for health care treatment, payment, or operations under the federal Health [I]nsurance [P]ortability and Accountability Act of 1996' [(HIPAA)] applies to biometric information of health care workers (as opposed to patients) collected, used or stored for health care treatment, payment or operations under HIPAA,"
and
"Does finger-scan information collected by a health care provider from its employees fall within the [Act's] exclusion for 'information collected, used, or stored for health care treatment, payment, or operations under [HIPAA],' 740 ILCS 14/10 [(West 2018)], when the employee's finger-scan information is used for purposes related to 'health care,' 'treatment,' 'payment,' or 'operations' as those terms are defined by the HIPAA statute and regulations?"
¶ 2 The appellate court allowed the Rule 308 appeal and answered the Cook County circuit court's certified questions in the negative. 2022 IL App (1st) 200822, ¶ 4. This court allowed the petition for leave to appeal (Ill. S.Ct. R. 315 (eff. Oct. 1, 2021)) filed by defendants, Northwestern Lake Forest Hospital (NLFH), Northwestern Memorial Healthcare (collectively Northwestern), and Becton, Dickinson and Company (BD), and for the following reasons, answers the certified questions in the affirmative.
¶ 3 I. BACKGROUND
¶ 4 A. Mosby
¶ 5 Plaintiff, Lucille Mosby, a registered nurse employed by Ingalls Memorial Hospital, filed a class-action suit individually and on behalf of others similarly situated, alleging that she used a medication dispensing system and its finger-scan device, distributed and marketed by BD, to provide patient care, i.e., to authenticate her identity and access controlled and restricted material. In an amended class- action complaint, Mosby alleged that BD violated section 15(a), (b), and (d) of the Biometric Information Privacy Act (Act) (740 ILCS 14/15(a), (b), (d) (West 2018)) by using the medical station scanning device to collect, use, and/or store her fingerscan data without complying with the Act's notice and consent provisions and by disclosing her purported biometric data to third parties without first obtaining her written consent.
During the pendency of the appellate court proceedings, the circuit court entered final approval of a class settlement agreement reached between Mosby and Ingalls Memorial Hospital and UCM Community Health & Hospital Division, Inc. (collectively, Ingalls). Therefore, Ingalls withdrew and is no longer a party to this appeal.
¶ 6 BD filed a motion to dismiss pursuant to section 2-619.1 of the Code of Civil Procedure (Code) (735 ILCS 5/2-619.1 (West 2018)). Relevant here, BD argued that the complaint should be dismissed pursuant to section 2-619(a)(9) (id. § 2-619(a)(9)) because (1) the biometric data that was collected, used, and/or stored restricted access to protected health information and medication and (2) the data was used for health care treatment and operations pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (45 C.F.R. § 164.501 (2018)) and was thereby specifically excluded from the scope of the Act. See 740 ILCS 14/10 (West 2018) ("Biometric identifiers do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under [HIPAA].").
¶ 7 The circuit court ruled that the exception found in section 10 of the Act was limited to patient information protected under HIPAA. See id. The circuit court opined that, if the legislature intended to exempt health care employees entirely, it would have expressly done so. Accordingly, the circuit court denied the motion to dismiss. With authorization of the circuit court, Mosby amended her pleadings, realleging her claims.
¶ 8 Thereafter, BD filed a joint motion to certify a question for interlocutory appeal under Illinois Supreme Court Rule 308 (eff. Oct. 1, 2019) and stay proceedings. The circuit court granted the motion to certify and stay the proceedings, and BD filed an application for leave to appeal pursuant to Rule 308, which the appellate court initially denied. Mosby v. Ingalls Memorial Hospital, No. 1-20-0822 (2020) (unpublished summary order under Illinois Supreme Court Rule 23(c)). Upon petition for leave to appeal, this court issued a supervisory order vacating the appellate court's decision and ordering it to allow the application for leave to appeal. Mosby v. Ingalls Memorial Hospital, No. 126590 (Ill. Jan. 11, 2021) (supervisory order).
¶ 9 B. Mazya
¶ 10 Plaintiff, Yana Mazya, a registered nurse at NLFH, and Tiki Taylor, a patient care technician, filed an amended class-action complaint alleging that Northwestern health care providers required her to scan her fingerprints for identification to access medication dispensing systems and gain authorized access to stored materials and medications for patients. Mazya alleged that she scanned her fingerprints multiple times a day to access the BD and Omnicell medical stations for health care treatment and operations. Mazya alleged Northwestern failed to provide certain notices and obtain consent in writing in violation of section 15(a), (b), and (d) of the Act (740 ILCS 14/15(a), (b), (d) (West 2018)).
Taylor was dismissed from the action.
Mazya filed the amended class-action complaint against Omnicell, Inc., and BD, as distributors of the medication dispensing systems, but both were dismissed from her action.
¶ 11 Northwestern filed a motion to dismiss pursuant to section 2-619.1 (735 ILCS 5/2-619.1 (West 2018)) of the Code. Northwestern argued that the complaint should be dismissed pursuant to section 2-619(a)(9) (id. § 2-619(a)(9)) because the legislature specifically excluded information collected for health care treatment, payment, or operations in the Act (740 ILCS 14/10 (West 2018)). Northwestern also argued that the complaint should be dismissed pursuant to section 2-615 (735 ILCS 5/2-615 (West 2018)) on the basis that information collected, used, or stored for health care treatment, payment, or operations under HIPAA was specifically excluded and, therefore, Mazya failed to state a claim upon which relief could be granted.
¶ 12 Northwestern argued that the use of health care workers' fingerprint scans was directly related to the dispensing of prescription drugs, as well as the provision, coordination, and management of health care. Northwestern further argued that the records created by the medication dispensing systems allowed it to ensure proper billing for medications and, therefore, the information it collected through the medication dispensing systems was also used for health care operations and payment under HIPAA.
¶ 13 The circuit court denied Northwestern's motion to dismiss, holding that the referenced exclusion in section 10 of the Act (740 ILCS 14/10 (West 2018)) is limited to information collected from patients and does not extend to information collected from health care workers. After an initial denial of Northwestern's Rule 308 motion, the circuit court granted Northwestern's motion to reconsider and, phrasing the question differently, the circuit court certified the second question listed above. The appellate court allowed Northwestern's appeal pursuant to Rule 308 and consolidated the case with Mosby's.
¶ 14 C. Appellate Court
¶ 15 The appellate court initially issued an opinion finding that the exclusion at issue did not apply to biometric information collected by a health care provider from its employees, but the appellate court granted the petition for rehearing filed by Northwestern and BD, the only remaining defendants in both appeals, to address additional arguments. 2022 IL App (1st) 200822, ¶ 5. Finding that the parties essentially sought the answer to the same question-whether the biometric information of health care workers is excluded from the Act's protections-the appellate court answered the question in the negative. Id. ¶ 71.
¶ 16 The appellate court found that the relevant provision of section 10 of the Act excluded from the Act's protections only patient biometric information. Id. ¶ 58. The appellate court rejected the contention that a reading of the exclusion to apply to only patient information would render "information captured from a patient in a health care setting" (740 ILCS 14/10 (West 2018)) and "information collected, used, or stored for health care treatment, payment, or operations under [HIPAA]" (id.) redundant. 2022 IL App (1st) 200822, ¶¶ 58-59. The appellate court concluded that defendants' arguments about redundancy overlooked the verbs used in the two categories, namely "capture" and "collect," which are different verbs with different meanings. Id. ¶ 59. The appellate court held that the first category referred to information captured from a patient in a health care setting, while the second category referred to information subsequently gathered and accumulated. Id. The appellate court concluded that "the two categories can be seen as protecting (1) information captured from the patient in a health care setting and (2) information that is already protected 'under [HIPAA].'" Id. ¶ 60 n.8 (quoting 740 ILCS 14/10 (West 2018)).
¶ 17 The appellate court declined to conclude that" 'under HIPAA'" means" 'as defined by HIPAA.'" Id. ¶ 64. The appellate court held that the primary meaning of" 'under'" when used as a preposition in the clause is" 'covered'" or" 'protected.'" Id. ¶ 63 (quoting Merriam-Webster Online Dictionary, https:// www.merriam-webster.com/dictionary/under (last visited May 9, 2022)). The appellate court thus held that the "biometric information of employees is simply not defined or protected 'under HIPAA.'" Id. ¶ 64. Accordingly, the appellate court held that "the plain language of the statute does not exclude employee information from the Act's protections because they are neither (1) patients nor (2) protected under HIPAA." Id.
¶ 18 The appellate court found that "if the legislature intended to exclude all health care workers from the Act's protections, it would have done so." Id.
"Where the legislators wanted to create blanket exclusions for certain sectors of the workforce, they expressly provided that the Act did not apply either to financial institutions subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 or to employees, contractors, or subcontractors of local government or the State as provided in section 25." Id. (citing 740 ILCS 14/25(c), (e) (West 2018)).
The appellate court concluded that "[n]o such express, blanket exclusion exists for health care workers and [declined to] rewrite the Act to provide one." Id. The appellate court held that its finding, that the nurses at issue are covered by the Act vis-a-vis their employers and the medication dispensing system marketing company, furthers the primary goal of the Act: to protect the secrecy interest of the individual in his or her biometric information, such as the fingerprint scans at issue here. Id. ¶ 67.
¶ 19 Presiding Justice Mikva dissented,
"convinced that the General Assembly did intend to exclude from the Act's protections the biometric information of health care workers-including finger-
scan information collected by those workers' employers-where that information is collected, used, or stored for health care treatment, payment, or operations, as those functions are defined by HIPAA." (Emphasis omitted.) Id. ¶ 74 (Mikva, P.J., dissenting).
¶ 20 Presiding Justice Mikva suggested that the majority's view ignored rules of statutory construction and overcomplicated a more straightforward reading of this exclusion. Id.
¶ 21 Presiding Justice Mikva opined that the first part of the exclusion in section 10 of the Act "excludes from the Act's coverage information from a particular source-patients in a health care setting-and the second part excludes information used for particular purposes-health care treatment, payment, or operations- regardless of the source of that information." Id. ¶ 75. Presiding Justice Mikva asserted that "[t]he plain language of the statute, and particularly the use of the words 'from' and 'for,' make this clear." Id.
¶ 22 In the dissent, Presiding Justice Mikva contended that the majority's interpretation of the exclusion ignored two fundamental rules of statutory construction: the last antecedent rule and the rule that statutes should be construed to avoid rendering a word or phrase superfluous. Id. ¶ 76. Presiding Justice Mikva further contended that application of these two basic rules makes clear that the "exclusion extends to biometric information collected from health care workers by their employers-where that information is collected, used, or stored for health care treatment, payment, or operations-and is not limited, as the majority concludes, to biometric information collected from patients." Id.
¶ 23 Applying the last antecedent rule of statutory construction, Presiding Justice Mikva asserted that the phrase" 'under [HIPAA]'" in section 10's exclusion applied to" 'health care treatment, payment, or operations,'" the phrase that immediately precedes it, rather than to the more remote phrase" 'information collected, used, or stored.'" Id. ¶ 78 (quoting 740 ILCS 14/10 (West 2018)). Presiding Justice Mikva asserted that, even if the rule were strictly applied only to the nearest word "operations," information collected, used, or stored for health care treatment or payment would still fall within the exclusion and, thus, the exclusion would still apply where the biometric information of health care workers is used for health care treatment. Id. ¶ 82. Presiding Justice Mikva noted that health care " 'operations,'" " 'treatment,'" and" 'payment'" are terms of art carefully defined in HIPAA's implementing regulations. Id.; see 45 C.F.R. § 164.501 (2016).
¶ 24 Presiding Justice Mikva asserted that the majority's construction resulted in redundance because it failed to consider that the word "information" is deliberately used twice in the exclusion and the majority instead improperly concluded that all "information" is patient information. Id. ¶ 84. Presiding Justice Mikva suggested that "[u]nder this reading, there is simply no reason to use the word 'information' twice in the disjunctive, suggesting that the exclusion is referencing two different kinds of information." Id. Presiding Justice Mikva concluded that "[t]he last antecedent rule and the rule against treating language in a statute as superfluous both dictate that 'under' HIPAA refers to 'health care treatment, payment, and operations.'" Id. ¶ 86. Presiding Justice Mikva continued: "None of these activities are 'protected' by HIPAA. Rather, they are activities that are defined by HIPAA and that, when engaged in by covered entities, make certain HIPAA regulations applicable." (Emphasis in original.) Id.
¶ 25 Presiding Justice Mikva stated that, despite the majority's suggestion, defendants were not arguing that the legislature intended to exempt the health care industry as a whole. Id. ¶ 87. Rather, the legislature created a narrow exclusion "to allow the health care industry to use biometric information for treatment, payment, and operations, as those terms are defined by HIPAA." Id. Presiding Justice Mikva noted that if the legislature intended to exclude only" 'patient information protected by HIPAA,' it certainly could have said just that." Id. Accordingly, Presiding Justice Mikva would have answered "yes" to the certified questions. Id. ¶ 88.
¶ 26 This court granted the defendants' petition for leave to appeal. Ill. S.Ct. R. 315 (eff. Oct. 1, 2021). We also granted motions by the Illinois Chamber of Commerce and the Chamber of Commerce of the United States of America; Illinois Health and Hospital Association; Advocate Health and Hospitals Corporation, Adventist Midwest Health, Good Samaritan Hospital-Mt. Vernon, Loyola University Health System, Memorial Health System, Northshore University Healthsystem, Rush University System for Health, and St. Mary's Hospital-Centralia; and Advanced Medical Technology Association to file amicus curiae briefs in support of defendants' position. Ill. S.Ct. R. 345 (eff. Sept. 20, 2010). We granted the American Nurses Association's motion to file an amicus curiae brief in support of plaintiffs' position. Id. For the reasons that follow, we answer the certified questions in the affirmative, reverse the judgment of the appellate court, and remand the matter to the circuit court for further proceedings consistent with this opinion.
¶ 27 II. ANALYSIS
¶ 28 Illinois Supreme Court Rule 308(a) (eff. Oct. 1, 2019) provides in relevant part:
"When the trial court, in making an interlocutory order not otherwise appealable, finds that the order involves a question of law as to which there is substantial ground for difference of opinion and that an immediate appeal from the order may materially advance the ultimate termination of the litigation, the court shall so state in writing, identifying the question of law involved. Such a statement may be made at the time of the entry of the order or thereafter on the court's own motion or on motion of any party. The [a]ppellate [c]ourt may thereupon in its discretion allow an appeal from the order."
¶ 29 "By definition, certified questions are questions of law subject to de novo review." Rozsavolgyi v. City of Aurora, 2017 IL 121048, ¶ 21. "Questions of statutory construction are [also] questions of law and reviewed de novo." Raab v. Frank, 2019 IL 124641, ¶ 18. Moreover, "[u]nder either section [2-615 or 2-619], our standard of review is de novo." Solaia Technology, LLC v. Specialty Publishing Co., 221 Ill.2d 558, 579 (2006); see also Cahokia Unit School District No. 187 v. Pritzker, 2021 IL 126212, ¶ 24 ("A section 2-615 or section 2-619 motion to dismiss admits as true all well-pleaded facts and all reasonable inferences from those facts.").
¶ 30 The certified question in this case asks us to construe the language of the Act to determine whether the language following "or" in section 10's definitions section, which excludes as "[b]iometric identifiers" "information collected, used, or stored for health care treatment, payment, or operations under [HIPAA]," refers exclusively to a patient's biometric information or includes a health care worker's biometric information used to access patient medications and provide patient care. "The fundamental rule of statutory construction is to ascertain and give effect to the legislature's intent." In re E.B., 231 Ill.2d 459, 466 (2008). "The language of the statute is the best indication of legislative intent, and we give that language its plain and ordinary meaning." Id. "We construe the statute as a whole and cannot view words or phrases in isolation but, rather, must consider them in light of other relevant provisions of the statute." Id.
¶ 31 When the statutory language is plain and unambiguous, a court may not "depart from a statute's plain language by reading into the law exceptions, limitations, or conditions that the legislature did not express." Schultz v. Illinois Farmers Insurance Co., 237 Ill.2d 391, 408 (2010). "Nevertheless, in construing a statute, the court may consider the reason for the law, the problems sought to be remedied, the purposes to be achieved, and the consequences of construing the statute one way or another." McDonald v. Symphony Bronzeville Park, LLC, 2022 IL 126511, ¶ 18.
¶ 32 The Act was enacted in 2008 to regulate "the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information." 740 ILCS 14/5(g) (West 2018). The Act defines" '[b]iometric identifier'" to mean "a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry." Id. § 10." 'Biometric information'" means "any information, regardless of how it is captured, converted, stored, or shared, based on an individuals' biometric identifier used to identify an individual." Id.
¶ 33 Among other things, section 15(a) of the Act requires that private entities establish a retention schedule and guidelines for permanently destroying biometric data when the purpose for collecting it is satisfied, or within three years of the individual's last interaction with the private entity. Id. § 15(a). Section 15(b) requires the entity, prior to obtaining a person's biometric identifier or biometric information, to notify the person and receive a written release. Id. § 15(b). Section 15(d) requires the entity, prior to disseminating a person's biometric identifier or biometric information, to acquire consent of the subject of the biometric identifier or biometric information, unless other circumstances not relevant here apply. Id. § 15(d).
¶ 34 The Act defines" '[p]rivate entity'" broadly to include "any individual, partnership, corporation, limited liability company, association, or other group, however organized," subject to exceptions not relevant here. Id. § 10. Section 20 provides a private right of action for persons aggrieved by a violation of the Act. Id. § 20. Section 25(b) of the Act provides that nothing in the Act shall be construed to conflict with HIPAA and the rules promulgated under it. Id. § 25(b).
¶ 35 Section 10 of the Act excepts certain information from the "biometric identifier" designation. Id. § 10. The language relevant to this appeal states that "[b]iometric identifiers do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under [HIPAA]." Id.
¶ 36 Each word in a statute is to be "given a reasonable meaning and not rendered superfluous." Sylvester v. Industrial Comm'n, 197 Ill.2d 225, 232 (2001). "The word 'or' is disjunctive. As used in its ordinary sense, the word 'or' marks an alternative indicating the various parts of the sentence which it connects are to be taken separately. [Citation.] In other words, 'or' means 'or.'" Elementary School District 159 v. Schiller, 221 Ill.2d 130, 145 (2006). "Disjunctive therefore connotes two different alternatives." Id.
¶ 37 Accordingly, the phrase prior to the "or" and the phrase following the "or" connotes two different alternatives. The Illinois legislature used the disjunctive "or" to separate the Act's reference to "information captured from a patient in a health care setting" from "information collected, used, or stored for health care treatment, payment, or operations under [HIPAA]." 740 ILCS 14/10 (West 2018). Pursuant to its plain language, information is exempt from the Act if it satisfies either statutory criterion.
¶ 38 The plain language of the Act also includes repetition of the word "information" at the beginning of each separate clause. By using "information" twice, the legislature indicated that each of the two clauses separated by the "or" generally exempts a different specified category of information. The second clause does not include the word "patient."
¶ 39 Defendants argue that the appellate court construed the two sub-exclusions in a manner that makes them redundant of each other, in that the appellate court construed both sub-exclusions to mean patient information, ignoring the disjunctive "or" and the repetition of "information." The appellate court explained away the redundancy by stating that "[t]he first sub-exclusion or category is for information 'captured'" (2022 IL App (1st) 200822, ¶ 58 (quoting 740 ILCS 14/10 (West 2018))) and "the second sub-exclusion or category is for information that is 'collected, used or stored'" (id. ¶ 59 (quoting 740 ILCS 14/10 (West 2018))). However, defendants argue, and we agree, that the terms "capture" and "collect" are synonymous, and therefore, the majority's explanation for the two separate clauses does not remedy the problem of redundancy. See Merriam Webster's Collegiate Dictionary 184 (11th ed. 2020) (defining the verb "capture" as "to gain control of esp. by force" and "to gain or win esp. through effort"); id. at 243 (defining the verb "collect" as "to gain or regain control of").
¶ 40 Defendants argue there is simply no tenable interpretation of the Act's text that would limit the second clause to information collected from a patient. The "or" and second "information" mean that any information-not just patient information- collected, used, or stored in connection with health care treatment, payment, or operations under HIPAA is exempt from the Act. Defendants argue that, as noted by Presiding Justice Mikva's dissent, the two categories of information are different because under the first clause the excluded information originates from the patient, whereas under the second clause, the excluded information may originate from any source. Defendants note that, under their interpretation, the language "collected *** for health care treatment" as that term is defined under HIPAA most certainly covers information that is not covered under "information captured from a patient" and, therefore, avoids any redundancy. See 45 C.F.R. § 160.103 (2016) ("[h]ealth care means care, services, or supplies related to the health of an individual," including the "[s]ale or dispensing of a drug, device, equipment, or other item in accordance with a prescription"); id. § 164.501 ("[t]reatment" includes "the provision, coordination, or management of health care and related services by one or more health care providers").
¶ 41 We agree with defendants and Presiding Justice Mikva's dissent, that the first part of the provision excludes from the Act's coverage information from a particular source-a patient in a health care setting-and the second part excludes information used for a particular purpose-health care treatment, payment, or operations-regardless of the information's source. See 2022 IL App (1st) 200822, ¶ 75 (Mikva, P.J., dissenting). As noted in the dissent, "[t]he plain language of the statute, and particularly the use of the words 'from' and 'for,' make this clear." Id.
¶ 42 The appellate court ruled that "the two categories can be seen as protecting (1) information captured from the patient in a health care setting and (2) information that is already protected 'under [HIPAA].'" Id. ¶ 60 n.8 (majority opinion). As Presiding Justice Mikva explained, however, "[u]nder [the appellate court's] reading, there is simply no reason to use the word 'information' twice in the disjunctive." Id. ¶ 84 (Mikva, P.J., dissenting).
¶ 43 The parties also take issue with the legislature's use of the word "under" in describing "information collected, used, or stored for health care treatment, payment, or operations under [HIPAA]." (Emphasis added.) 740 ILCS 14/10 (West 2018). The appellate court concluded that" 'under'" is" 'below or beneath so as to be *** covered [or] protected *** by,'" the information covered or protected by HIPAA is that of patients, not employees, and thus, the second sub-exclusion excludes only patient data. 2022 IL App (1st) 200822, ¶ 63 (majority opinion) (quoting Merriam-Webster Online Dictionary, https://www.merriam- webster.com/dictionary/under (last visited May 9, 2022)).
¶ 44 Defendants contend that plaintiffs, like the appellate court, omit the full definition of "under" that it adopted, as provided in the dictionary they cite. When used as a preposition, the Merriam-Webster Online Dictionary defines "under" as "below or beneath so as to be overhung, surmounted, covered, protected, or concealed by" as in "under sunny skies," "under a stern exterior," and "under cover of darkness." Merriam-Webster Online Dictionary, https://www.merriam-webster.com/dictionary/under (last visited Nov. 13, 2023) [https://perma.cc/J35R-VJHA]; see also Merriam-Webster's Collegiate Dictionary 1363 (11th ed. 2020). Defendants argue that both the full definition and the examples given make clear that this usage of the term "under" is referring to a physical location or attribute and that such a construction makes no sense in the context of the health care exclusions reference to "under [HIPAA]," as HIPAA is not a physical location or attribute. Instead, defendants argue that the only appropriate definition of "under" in the context of the sub-exclusion is defined in the Merriam-Webster Online Dictionary as "subject to the authority, control, guidance, or instruction of" as in "served under the general," "under the terms of the contract," and "a program that runs under any operating system." Merriam-Webster Online Dictionary, https://www.merriam-webster.com/dictionary/under (last visited Nov. 13, 2023) [https://perma.cc/J35R-VJHA]; see also Merriam-Webster's Collegiate Dictionary 1363 (11th ed. 2020). Under this definition, defendants argue, HIPAA provides the guidance needed to determine the meaning of "health care treatment, payment, or operations."
¶ 45 To support their positions, the parties also cite canons of statutory construction. Below, defendants argued that the second sub-exclusion is not limited to information captured from a patient because a clause following a disjunctive is considered inapplicable to the subject matter of the preceding clause. In other words, defendants argued that application of the qualifier "under [HIPAA]" to the first sub-exclusion involving patient information, despite the following disjunctive "or," is nonsensical. See Facebook, Inc. v. Duguid, 592 U.S.___,___ 141 S.Ct. 1163, 1169 (2021) (when interpreting a concise list of nouns followed by a modifying clause, under conventional rules of grammar, a modifier at the end of the list applies to the straightforward, parallel construction that involves all nouns in the series (citing Antonin Scalia &Bryan A. Garner, Reading Law: The Interpretation of Legal Texts 147 (2012))). The series-qualifier canon would suggest that "under [HIPPA]" applies to all three nouns in "health care treatment, payment, or operations" found in the second sub-exclusion. Plaintiffs and the majority below suggest, however, that this canon also applies to the first subexclusion involving patient information.
¶ 46 The dissent cited the nearest-reasonable-referent canon, also known as the last antecedent rule, providing that, "when the syntax in a legal instrument involves something other than a parallel series of nouns or verbs, a prepositive or postpositive modifier normally applies only to the nearest reasonable referent." Black's Law Dictionary 1240 (11th ed. 2019); see also In re E.B., 231 Ill.2d at 467 ("The last antecedent doctrine, a long-recognized grammatical canon of statutory construction, provides that relative or qualifying words, phrases, or clauses are applied to the words or phrases immediately preceding them and are not construed as extending to or including other words, phrases, or clauses more remote ***.").
¶ 47 Here, the qualifying phrase "under [HIPAA]" is immediately preceded by the words "health care treatment, payment, or operations." See 740 ILCS 14/10 (West 2018). This canon would suggest, then, that "under [HIPAA]" in section 10's exclusion applies to "health care treatment, payment, or operations," rather than the more remote phrase "information collected, used, or stored" in the first sub- exclusion. See id. This cannon may also suggest that "under [HIPAA]" applies only to the most recent "operations" in the list of parallel nouns.
¶ 48 These canons, however, are limited by context. See Facebook, Inc., 592 U.S. at___, 141 S.Ct. at 1173-74 (Alito, J., concurring) (series-qualifier canon is limited and is highly sensitive to context); In re E.B., 231 Ill.2d at 467 (application of last antecedent is limited by "the intent of the legislature, as disclosed by the context and reading of the entire statute"). "[T]reatment, payment, and operations" is a phrase the Illinois legislature borrowed from HIPAA regulations. See, e.g., 45 C.F.R. § 164.506 (2016) (titled "[u]ses and disclosures to carry out treatment, payment, or health care operations"); id. § 164.502(a)(ii) (referencing "treatment, payment, or health care operations"); id. § 164.508 (same); id. § 164.520 (same); id. § 164.522 (same); id. § 170.210 (referencing "treatment, payment, and health care operations"); id. § 170.315 (same).
¶ 49 "[H]ealth care treatment, payment, or operations" are terms defined by HIPAA regulations. See 45 C.F.R. § 164.501 (2016) (titled "Definitions"). "Health care" includes "care, services, or supplies related to the health of an individual," including the "[s]ale or dispensing of a drug, device, equipment, or other item in accordance with a prescription." Id. § 160.103.
¶ 50" 'Treatment' means the provision, coordination, or management of health care and related services by one or more health care providers," which includes "the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a patient; or the referral of a patient for health care from one health care provider to another." Id. § 164.501.
¶ 51 "Payment" includes "activities undertaken by *** [a] health care provider or health plan to obtain or provide reimbursement for the provision of health care." Id. "Health care operations" means, among other things, "the following activities of the covered entity to the extent that the activities are related to covered functions:" conducting quality assessment and improvement activities, including, among other things, patient safety activities and protocol development; reviewing the competence or qualifications of health care professionals; and conducting or arranging for medical review and auditing functions, including fraud and abuse detection and compliance programs. Id.
¶ 52 Therefore, the legislature's decision to use the phrase "health care treatment, payment, and operations" and to immediately follow it with the prepositional phrase "under [HIPAA]" makes clear that the legislature was directing readers to HIPAA to discern the meaning of those terms. HIPAA's definitions of these terms relate to activities performed by the health care provider-not by the patient.
¶ 53 As noted by the appellate court dissent," '[t]reatment,' 'payment,' and 'operations,' are 'under' HIPAA because a particular meaning is ascribed to each of these terms by HIPAA's implementing regulations." 2022 IL App (1st) 200822, ¶ 81 (Mikva, P.J., dissenting). "Under the provisions of HIPAA, those three terms have definite and well-known meanings that our General Assembly saw no reason to duplicate or reinvent when it drafted the legislation that is the subject of this appeal." (Emphasis in original.) Id. "Incorporating by reference established definitions in this manner promotes clarity, consistency, and familiarity in the law, a 'familiar legislative process' long recognized by" this court. Id. "The General Assembly has in fact borrowed these same definitions on other occasions, and it has used the phrase 'under HIPAA' to do so." Id.; see 210 ILCS 25/2-134, 2-136, 2-137 (West 2018) (providing, for purposes of the Illinois Clinical Laboratory and Blood Bank Act (210 ILCS 25/1-101 et seq. (West 2018)), that each of these terms-treatment, payment, and health care operations-"has the meaning ascribed to it under HIPAA, as specified in 45 CFR 164.501").
¶ 54 Pursuant to its plain language, the Act excludes from its protections the biometric information of health care workers where that information is collected, used, or stored for health care treatment, payment, or operations, as those functions are defined by HIPAA. A health care worker's biometric information, used to permit access to medication dispensing stations for patient care, falls under "information collected, used, or stored for health care treatment, payment, or operations under [HIPAA]" and is exempt from the Act's protections pursuant to section 10 of the Act. See 740 ILCS 14/10 (West 2018).
¶ 55 Plaintiffs argue that, if the legislature intended to exempt HIPAA-covered entities (and their suppliers) from compliance or exclude their workers from the Act's protections when biometrics are collected for "operations," it would have expressly done so in section 25, as opposed to burying it in the middle of a definition. See id. § 25 (categorical exclusions for, inter alia, financial institutions and local government or State employees and contractors). Plaintiffs argue that the legislature did not intend to leave health care employees exposed to a heightened risk of biometric data compromise, with no statutory protection and no avenue for redress when their biometric data is abused.
¶ 56 Defendants counter that plaintiffs' assertions that defendants are seeking a broad exemption of the entire health care industry that would cover, for example, a landscaper mowing the lawn, simply ignore that HIPAA includes carefully crafted definitions for each of these terms that place limits on the scope of the exclusion. Defendants argue that plaintiffs' argument ignores the context of this appeal, which concerns automated dispensing cabinets used by health care providers, the use of which fall within HIPAA's definitions of health care treatment, payment, and operations. Defendants argue that the legislature's placement of the exclusion within the definition of "biometric identifier," rather than including it within section 25 of the Act, makes sense because the exclusion is not a broad exemption of the entire health care industry, like the ones found in section 25.
¶ 57 We are not construing the language at issue as a broad, categorical exclusion of biometric identifiers taken from health care workers. Here, the nurses' biometric information, as alleged in the complaints, was collected, used, and stored to access medications and medical supplies for patient health care treatment and is excluded from coverage under the Act because it is "information collected, used, or stored for health care treatment, payment, or operations under [HIPAA]." Accordingly, we hereby reverse the appellate court and answer the certified questions in the affirmative.
¶ 58 III. CONCLUSION
¶ 59 For the foregoing reasons, we answer the certified questions in the affirmative, reverse the judgment of the appellate court, and remand the cause to the circuit court for further proceedings.
¶ 60 Certified questions answered.
¶ 61 Judgments reversed.
¶ 62 Cause remanded.