Court Opinion

ID: 6317807
Source: CourtListenerOpinion
Date Created: 2022-02-25 22:02:46.454132+00
Date Added: 2024-06-11T09:01:33.080386
License: Public Domain

2022 IL App (1st) 200822

                                                                               SIXTH DIVISION
                                                                    Filing Date February 25, 2022

                              Nos. 1-20-0822 and 1-21-0895, cons.
______________________________________________________________________________
                                     IN THE
                         APPELLATE COURT OF ILLINOIS
                            FIRST JUDICIAL DISTRICT
 ______________________________________________________________________________

LUCILLE MOSBY, Individually, and on Behalf of All         )       Appeal from the
Others Similarly Situated,                                )       Circuit Court of
                                                          )       Cook County.
Plaintiff-Appellee,                                       )
                                                          )       No. 18 CH 05031
                  v.                                      )
THE INGALLS MEMORIAL HOSPITAL, UCM                        )       The Honorable
COMMUNITY HEALTH & HOSPITAL DIVISION,                     )       Pamela McLean Meyerson,
INC., and BECTON, DICKINSON AND COMPANY,                  )       Judge, Presiding.
                                                          )
       Defendants-Appellants).

 YANA MAZYA, Individually, and on Behalf of All               )     Appeal from the
 Others Similarly Situated,                                   )     Circuit Court of
                                                              )     Cook County.
        Plaintiff-Appellee,                                   )
                                                              )     No. 18 CH 71601
                   v.                                         )
 NORTHWESTERN LAKE FOREST HOSPITAL,                           )     The Honorable
 NORTHWESTERN MEMORIAL HEALTHCARE,                            )     Alison C. Conlon,
 OMNICELL, INC., and BECTON, DICKINSON AND                    )     Judge, Presiding.
 COMPANY,                                                     )

        Defendants

 (Northwestern Lake Forest Hospital and Northwestern
 Memorial Healthcare, Defendants-Appellants).
     Nos. 1-20-0822 and 1-21-0895, cons.

                JUSTICE ODEN JOHNSON delivered the judgment of the court, with opinion.
                Justices Harris and Mikva concurred in the judgment and opinion.

                                                OPINION

¶1          Plaintiff Lucille Mosby filed a class-action suit individually and on behalf of others

        similarly situated against defendants Ingalls Memorial Hospital and UCM Community Health

        & Hospital Division, Inc. (collectively Ingalls), and Becton, Dickinson and Company (BD)

        (collectively group defendants one). Similarly, plaintiff Yana Mazya filed a class-action suit

        individually and on behalf of others similarly situated against Northwestern Lake Forest

        Hospital and Northwestern Memorial Healthcare (collectively group defendants two). During

        the course of the litigation, group defendants one filed an interlocutory appeal pursuant to

        Illinois Supreme Court Rule 308 (eff. Oct. 1, 2019) to have this court answer this certified

        question:

               “Whether the exclusion in Section 10 of BIPA for “information collected, used, or

            stored for health care treatment, payment, or operations under the federal Health Insurance

            Portability and Accountability Act of 1996” applies to biometric information of health care

            workers (as opposed to patients) collected, used or stored for health care treatment,

            payment or operations under HIPAA?”

¶2          Subsequently, group defendants two also filed an interlocutory appeal pursuant to Rule 308

        concerning the same issue:

               “Does finger-scan information collected by a health care provider from its employees

            fall within the Biometric Information Privacy Act’s exclusion for ‘information collected,

            used, or stored for health care treatment, payment or operations under the federal Health

            Insurance Portability and Accountability Act of 1996,’ 740 ILCS 14/10, when the

                                                    -2-
     Nos. 1-20-0822 and 1-21-0895, cons.

            employee’s finger-scan information is used for purposes related to ‘healthcare,’

            ‘treatment,’ ‘payment,’ and/or ‘operations’ as those terms are defined by the HIPAA statute

            and regulations?”

     Both group defendants’ petitions for leave to appeal were permitted, as discussed in detail below.

     However, at this time, the only question submitted for this court’s review is the question submitted

     by group defendants two, and we answer the question in the negative.

¶3                                          I. BACKGROUND

¶4                                               A. Mosby

¶5          On April 18, 2018, Mosby filed a class-action complaint against Ingalls and BD seeking

        redress for each defendant’s violations pursuant to section 15(a)-(d) of the Biometric

        Information Privacy Act (Act) (740 ILCS 14/15(a)-(d) (West 2018)). Mosby worked as a

        registered pediatrics nurse at Ingalls Memorial Hospital. As a condition of Mosby’s

        employment, she was required to scan her fingerprint to authenticate her identity and gain

        access to a medication dispensing system. Mosby alleged that defendants’ behavior exposed

        employees like herself to serious irreversible privacy risks. Mosby alleged that defendants

        violated the Act by (1) not informing her in writing of the specific purpose and the length of

        time for which her fingerprints were being collected, stored, and used; (2) failing to provide a

        publicly available retention schedule and guidelines for permanently destroying Mosby’s

        fingerprints; (3) failing to obtain a written release from Mosby to collect, store, disseminate,

        or otherwise use her fingerprint; and (4) failing to obtain consent before disclosing Mosby’s

        fingerprints to third-party vendors that host the data.

¶6          On May 14, 2019, plaintiff filed an amended class-action complaint that was substantially

        similar to the original.

                                                     -3-
     Nos. 1-20-0822 and 1-21-0895, cons.

¶7          On June 5, 2019, defendants filed a motion to dismiss pursuant to section 2-619.1 (735

        ILCS 5/2-619.1 (West 2018)) of the Code of Civil Procedure (Code) or to strike the amended

        complaint. The motion argued that the complaint should be dismissed pursuant to section 2-

        619(a)(9) (id. § 2-619(a)(9)) because (1) the biometric data that was collected, used, and/or

        stored restricted access to protected health information and medication and (2) the data was

        used for healthcare treatment and operations pursuant to the Health Insurance Portability and

        Accountability Act of 1996 (HIPAA) (45 C.F.R. § 164.501 (2018)) and was thereby

        specifically excluded from the scope of the Act. Defendants argued that, pursuant to section 2-

        615 (735 ILCS 5/2-615 (West 2018)), Mosby failed to allege any well-pleaded facts regarding

        any disclosures of her fingerprints.

¶8          On January 13, 2020, the circuit court ruled that the exception was limited as to the

        information protected under HIPAA. To hold otherwise, the court noted, would result in a

        broad exception for all employees involved in operations that impact patients protected by

        HIPAA. The circuit court opined that, if the legislature intended to exempt employees entirely,

        they would have expressly done so. The court denied defendants’ motion to dismiss based on

        this issue. The circuit court dismissed BD from the complaint in its entirety, without prejudice,

        and found that Mosby failed to state a claim as to how defendants disseminated her biometric

        information. With authorization of the circuit court, Mosby amended her pleadings on

        February 24, 2020, which realleged all of the claims contained in the previously dismissed

        claim.

¶9          On March 16, 2020, defendants filed a joint motion to certify a question for interlocutory

        appeal under Illinois Supreme Court Rule 308 (eff. Oct. 1, 2019) and stay proceedings.

        Defendants argued that the question of whether employee information was also exempt under

                                                     -4-
       Nos. 1-20-0822 and 1-21-0895, cons.

          the Act was a question of first impression and has never been heard before this court.

          Defendants argued that the question was one of statutory construction and there existed a

          substantial ground for a difference of opinion, which made it appropriate to bring under Rule

          308. Defendants maintained that raising the question would be beneficial in a variety of ways,

          such as: (1) it would advance the outcome of the case with prejudice if the Act was interpreted

          in their favor, (2) judicial economy would be served, and (3) the need for a uniform

          construction and application of the law would be served. Defendants also requested a stay in

          the circuit court proceedings because the determination could lead to a dismissal and Mosby

          would not be prejudiced.

¶ 10          On April 20, 2020, Mosby filed a motion in opposition to defendants’ joint motion to

          certify the question for interlocutory appeal, arguing that substantial grounds for difference of

          opinion did not exist. Mosby maintained that to hold otherwise would mean that the General

          Assembly intended to place anyone employed in the healthcare industry into an “unregulated

          biometric abyss,” by having no biometric protections. Mosby argued that defendants did not

          demonstrate that they faced any hardship or inequity to justify a stay that would outweigh the

          prejudice she would suffer. Mosby maintained that the prejudice she would suffer if a stay was

          granted was the denial of pursuing her claim in an expedient manner and, if successful, the

          collection of damages. Mosby argued that defendants’ conduct was ongoing and continuous

          and every day that passed would compound the injuries that they were inflicting.

¶ 11          On May 4, 2020, defendants filed a joint reply arguing that the proposed certified question

          was tailored and limited to those circumstances where the biometric data collected from

          healthcare workers were used for healthcare treatment, payment, or operations under HIPAA.

          Defendants further argued that the circuit court did not entirely reject its argument and found

                                                       -5-
       Nos. 1-20-0822 and 1-21-0895, cons.

           it plausible but ultimately concluded that the General Assembly would have been more explicit

           if the legislative intent was to exclude healthcare employees’ biometric data.

¶ 12           On June 18, 2020, the circuit court granted defendants’ motion to certify and stay the

           proceedings. The circuit court ruled that the issue posed by defendants presented a question of

           law where there was substantial ground for difference of opinion and could ultimately

           determine whether or not the case should be dismissed.

¶ 13           On July 17, 2020, defendants filed an application for leave to appeal pursuant to Rule 308,

           which we denied on August 24, 2020. Defendants filed a petition for leave to appeal with the

           Illinois Supreme Court, on October 30, 2020. On March 3, 2021, the Illinois Supreme Court

           issued a mandate vacating this court’s decision and ordered this court to hear the certified

           question on appeal. On June 11, 2021, Ingalls filed an unopposed motion for extension of time

           to file an opening brief, where they informed the circuit court that the parties reached a

           settlement in principle. 1

¶ 14                                                  B. Mazya

¶ 15           On April 10, 2019, Yana Mazya and Tiki Taylor filed an amended class-action complaint2

           against Northwestern Lake Forest Hospital, Northwestern Memorial Healthcare, Northwestern

           Memorial Hospital (collectively Northwestern), Omnicell Inc., and BD seeking redress for

           each defendant’s violations pursuant to section 15(a)-(d) of the Act (740 ILCS 14/15(a)-(d)

           (West 2018)). Mazya was employed as a registered nurse at Northwestern Memorial Lake

           Forest Hospital, while Taylor worked as a patient care technician at Northwestern Memorial

               1
                This agreement was between Ingalls and Mosby, not BD.
               2
                The initial complaint that was filed is not provided in the record, which was of no consequence
       here, because Northwestern Memorial Hospital Taylor and Northwestern Memorial Hospital were not
       originally parties.

                                                          -6-
       Nos. 1-20-0822 and 1-21-0895, cons.

           Hospital; both were required to scan their fingerprints to gain access to the medication

           dispensing system as a condition of their employment. Mazya and Taylor alleged Northwestern

           disregarded their statutorily protected privacy rights when they unlawfully collected, stored,

           used, and disseminated their biometric data in violation of the Act. Mazya and Taylor

           specifically alleged that defendants were in violation of the Act because it failed to (1) inform

           them in writing of the specific purpose and length of time for which their fingerprints were

           being collected, stored, and used; (2) receive a written release to collect, store, or otherwise

           use their fingerprints; (3) provide a publicly available retention schedule and guidelines for

           permanently destroying their fingerprints; and (4) obtain consent from them to disclose,

           redisclose, or otherwise disseminate their fingerprints to a third party.

¶ 16           On July 2, 2019, Taylor was dismissed without prejudice from the complaint as her claims

           were preempted because she was a party to a collective bargaining agreement. 3

¶ 17           On January 17, 2020, Northwestern 4 filed a motion to dismiss pursuant to section 2-619.1

           (735 ILCS 5/2-619.1 (West 2018)) of the Code. Northwestern argued that the complaint should

           be dismissed pursuant to section 2-619(a)(9) (id. § 2-619(a)(9)) because the General Assembly

           specifically excluded information collected from healthcare treatment, payment, or operations

           in the Act. Northwestern further argued that the complaint should be dismissed pursuant to

           section 2-615 (id. § 2-615) for failure to state a claim because Northwestern did not store or

           possess her biometric information in violation of the Act when it was used for healthcare

           treatment, payment, or operations. Northwestern maintained that nothing in the Act was

               3
                  The dismissal occurred after Northwestern removed this case to the Northern District of Illinois
       under case number 19 C 3191 (Mazya v. Northwestern Lake Forest Hospital, No. 19-CV-3191 (N.D. Ill.
       June 19, 2019)); the case was subsequently returned to the circuit court.
                4
                  Defendants Omnicell Inc. and BD were dismissed from this complaint; however, the record does
       not reflect exactly when that occurred. We will address these defendants collectively as Northwestern for
       the remainder of this opinion.

                                                           -7-
       Nos. 1-20-0822 and 1-21-0895, cons.

          intended to interfere with HIPAA and that applying it to their medication dispensing systems

          would conflict with guidance previously given by the Department of Health and Human

          Services (HHS), which encouraged the use of biometrics in health. Northwestern argued that

          Mazya knew her information was being collected and had the power to withhold consent, citing

          Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, ¶ 34, as support. Northwestern

          further argued that Mazya failed to provide factual allegations supporting her conclusory

          assertions that Northwestern’s conduct was intentional or reckless. Lastly, Northwestern

          requested that Northwestern Memorial Hospital be dismissed from the proceedings, since

          Taylor was dismissed. 5

¶ 18          On March 13, 2020, Mazya filed a response to Northwestern’s motion to dismiss, arguing

          that her claims were actionable because they did not fall under any exemption under the Act

          and the failure to comply with distinct requirements of the Act was all that she needed to

          demonstrate. Mazya maintained that the Act’s explicit reference to biometric data taken from

          a patient shows the intent of the General Assembly to exclude patient biometrics from the Act’s

          protection because they were already protected by HIPAA. Mazya further maintained that if

          the General Assembly wanted to provide a sweeping categorical exemption for hospitals it

          would have done so as evidenced by the exclusion of financial institutions reflected in section

          25(c) of the Act (740 ILCS 14/25(c) (West 2018)).

¶ 19          Northwestern filed a reply on April 3, 2020, arguing that Mazya’s interpretation of the Act

          ignored the disjunctive “or” provided in section 10 of the Act, which connotes two different

          alternatives, and thus the exemption included employee information. Northwestern maintained

              5
              The record reflects that on March 10, 2020, Mazya moved to voluntarily dismiss Northwestern
       Memorial Hospital from this action; however, the record does not reflect when the motion was granted.

                                                         -8-
       Nos. 1-20-0822 and 1-21-0895, cons.

          that Mazya failed to rebut their argument that she failed to state a claim because her claims

          were not supported by the language of the statute and were solely policy-based. Northwestern

          further maintained that it would be good policy to interpret the statute their way given that the

          usage of biometric information has been encouraged by the government.

¶ 20          On November 2, 2020, the circuit court denied Northwestern’s section 2-619.1 motion.

          The circuit court found Northwestern’s section 2-619 argument unpersuasive because the

          burden for compliance with the Act falls on the collector of the data, not the provider. Put

          another way, Mazya did not waive her consent by continuing to offer her biometric data to

          Northwestern as a condition of her duties as a nurse. The circuit court found that accepting

          Northwestern’s interpretation of the Act would amount to medical professionals having no

          protections for their biometric information. In regard to Northwestern’s section 2-615

          arguments, the circuit court found that, to have a viable claim, (1) the claimant need not lack

          knowledge of the violation, as the violation itself was enough to support the statutory cause of

          action, and (2) the claimant was not required to plead an intentional or reckless violation of the

          Act, at that stage of the proceedings.

¶ 21          On November 30, 2020, Northwestern filed a corrected motion for Rule 308 certification

          and to stay the proceedings. Northwestern argued that there were substantial grounds for

          difference of opinion given the disjunctive “or” in section 10. Northwestern further argued that

          the proceedings should be stayed pending this court’s decision because our answer to the

          question could expedite the resolution of the underlying case.

¶ 22          On December 11, 2020, Mazya filed a motion to strike Northwestern’s motion for

          certification and stay. Mazya argued that Northwestern was trying to certify the same question

          that this court denied in Mosby v. Ingalls Memorial Hospital, No. 1-20-0822, which led to the

                                                       -9-
       Nos. 1-20-0822 and 1-21-0895, cons.

          circuit court’s denial of the defendant’s section 2-619.1 motion; therefore, the motion to certify

          was frivolous and did not warrant interlocutory review.

¶ 23          Later, on January 13, 2021, Mazya filed a response in opposition to Northwestern’s motion

          for Rule 308 certification and stay, reiterating her previous arguments and noting that

          Northwestern had not lodged any new arguments or law on the matter.

¶ 24          On February 9, 2021, Northwestern filed a reply in further support of their Rule 308

          motion, informing the circuit court that the Illinois Supreme Court directed this court to vacate

          its August 24, 2020, order and accept the Rule 308 appeal (Mosby v. Ingalls Memorial

          Hospital, No. 126590 (Ill. Jan. 27, 2021) (supervisory order)).

¶ 25          On February 9, 2021, the circuit court denied Northwestern’s Rule 308 motion but stayed

          the proceedings pending the decision in Mosby.

¶ 26          On June 15, 2021, Northwestern filed a motion to reconsider the denial of their Rule 308

          certification, arguing that the parties in Mosby reached a settlement in principle and that no

          one would be presenting any arguments on appeal on behalf of a hospital that uses medication

          dispensing systems secured by finger-scan technology. Mazya responded on June 22, 2021,

          that plaintiffs were not opposed to the appellate court hearing a certified question.

¶ 27          On July 23, 2021, the circuit court granted the motion to reconsider and stayed the

          proceedings, noting that the issue involves a question of law as to which there were substantial

          grounds for difference of opinion and that an immediate appeal could materially advance the

          ultimate termination of the litigation. Accordingly, the circuit court certified its question to this

          court.

                                                        -10-
       Nos. 1-20-0822 and 1-21-0895, cons.

¶ 28          On July 27, 2021, Northwestern filed an application for leave to appeal pursuant to Rule

          308 reiterating the arguments they made at the circuit court and requesting that the case be

          consolidated with Mosby. We granted the motion on August 13, 2021.

¶ 29          On August 5, 2021, an amicus curiae brief was filed on behalf of the Illinois Health and

          Hospital Association, Northwestern Memorial Healthcare, and Amita Health (collectively the

          amici), in support of defendants’ position. They reiterated defendants’ arguments and also

          argued that interpreting section 10 in favor of plaintiffs regarding the medical supply

          dispensing systems at issue could result in undesirable consequences for healthcare providers.

          The amici argued that plaintiffs’ interpretation could be financially burdensome and result in

          a lower quality of care for patients.

¶ 30                                              II. ANALYSIS

¶ 31          On appeal, Northwestern contends that this court should answer the certified question in

          the affirmative because the plain language of section 10 demonstrates that employee biometric

          information used in medication dispensing systems is excluded from protections of the Act.

¶ 32                                              A. Jurisdiction

¶ 33          We have jurisdiction to review the certified question pursuant to Illinois Supreme Court

          Rule 308 (eff. Oct. 1, 2019). In general, courts of appeal have jurisdiction to review only final

          judgments entered in the circuit court unless there is a specific statutory exception or rule of

          the supreme court. In re Estate of Luccio, 2012 IL App (1st) 121153, ¶ 17. Rule 308 is one

          such exception that allows for the permissive appeal of an interlocutory order certified by the

          circuit court, as involving a question of law, as to which there is substantial ground for

          difference of opinion and where an immediate appeal may materially advance the ultimate

                                                        -11-
       Nos. 1-20-0822 and 1-21-0895, cons.

          termination of the litigation. Id. Therefore, we are limited to answering the specific question

          certified by the circuit court. Moore v. Chicago Park District, 2012 IL 112788, ¶ 9.

¶ 34                                        B. Standard of Review

¶ 35          When reviewing a certified question of law pursuant to Illinois Supreme Court Rule 308

          (eff. Oct. 1, 2019), we apply a de novo standard of review. O’Halloran v. Luce, 2013 IL App

          (1st) 113735, ¶ 31. De novo review is also appropriate because this resolution turns on a

          question of statutory construction. Eighner v. Tiernan, 2020 IL App (1st) 191369, ¶ 8. “The

          primary rule of statutory construction is to give effect to the intent of the legislature.” Ultsch

          v. Illinois Municipal Retirement Fund, 226 Ill. 2d 169, 181 (2007). The statutory language

          itself is the best evidence of legislative intent, which must be given its plain and ordinary

          meaning. Id. The statute should be read as a whole. Id. “Where the meaning of a statute is

          unclear from a reading of its language, courts may look beyond the statutory language and

          consider the purpose of the law, the evils it was intended to remedy, and the legislative history

          of the statute.” Id.

¶ 36                                           1. Plain Language

¶ 37          The Act on which the certified question is based defines “biometric information” as “any

          information, regardless of how it is captured, converted, stored, or shared, based on an

          individual’s biometric identifier used to identify an individual.” 740 ILCS 14/10 (West 2018).

          The Act defines “biometric identifiers” as “a retina or iris scan, fingerprint, voiceprint, or scan

          of hand or face geometry.” Id. The parties do not dispute that the fingerprint scan of plaintiff

          and other similarly situated hospital employees is a biometric identifier and, when stored, this

          fingerprint constitutes biometric information as outlined in the Act.

                                                       -12-
       Nos. 1-20-0822 and 1-21-0895, cons.

¶ 38          Section 10 of the Act provides exclusions to the protections of the Act; specifically at issue

          is the following language:

              “Biometric identifiers do not include information captured from a patient in a health care

              setting or information collected, used, or stored for health care treatment, payment, or

              operations under the federal Health Insurance Portability and Accountability Act of 1996.”

              Id.

       While section 25(c) and (e) expressly provides that the Act will not apply to certain entities and

          persons:

                      “(c) Nothing in this Act shall be deemed to apply in any manner to a financial

              institution or an affiliate of a financial institution that is subject to Title V of the federal

              Gramm-Leach-Bliley Act of 1999 [(15 U.S.C. § 6803 (2018))] and the rules promulgated

              thereunder.

                      ***

                      (e) Nothing in this Act shall be construed to apply to a contractor, subcontractor,

              or agent of a State agency or local unit of government when working for that State

              agency or local unit of government.” Id. § 25(c), (e).

¶ 39          Northwestern and the amici contend that the hospital workers’ use of medication

          dispensing systems falls within the Act’s definitional carveouts for health-related information.

          Northwestern and the amici maintain that the medication dispensing system that is at issue in

          this case is permitted to collect information for “healthcare treatment, payment, or operations”

          as defined by HIPAA. 45 C.F.R. § 164.501(2) (2018). This includes the fingerprint scan of its

          employees who facilitate the dispensing and administration of medications proscribed by

          patients. Northwestern and the amici assert that the collection, use, and storage of healthcare

                                                        -13-
       Nos. 1-20-0822 and 1-21-0895, cons.

          workers’ biometric information is for “health care” and “treatment” that Northwestern provides

          to its patients and those terms are defined by HIPAA. Id. Northwestern and the amici contend

          that this medication dispensing system also acts to provide an audit trail, which includes

          diversion, fraud, and abuse detection. Northwestern and the amici assert that this system

          additionally aids in patient safety, quality of care, and accurate billing. Northwestern and the

          amici contend that the biometric information is collected through the medication dispensing

          system and is also used for “health care operations” and “payment.”

¶ 40          Northwestern and the amici contend that the circuit court erred in finding that the carveouts

          for health-related information apply only to information taken from a patient because the plain

          language of the Act does not read to limit patient biometric data. Northwestern and the amici

          maintain that biometric identifiers as defined by the Act included an “or” exception as they

          pertain to health care information. Northwestern and the amici assert that “or” is disjunctive

          and connotes two different alternatives. Northwestern and the amici assert that this “or”

          indicates that a different category of exemptions is allowed and that this is not limited to patient

          data. Northwestern and the amici maintain that, to fall within the exception of the Act, the

          biometric information obtained must either (1) be obtained in a healthcare setting or (2) be

          collected, used, or stored in connection with healthcare treatment, payment, and operations

          under HIPAA.

¶ 41          Plaintiffs contend that the circuit court did not err in holding that Northwestern is not

          exempt from the Act and that it excludes only patient biometric data from its protections

          because patient data is already protected by HIPAA. Plaintiffs assert that this would in effect

          leave thousands of hospital workers unprotected from the risks that the Act was designed to

          protect against. Plaintiffs assert that Northwestern’s interpretation of how “or” creates two

                                                       -14-
       Nos. 1-20-0822 and 1-21-0895, cons.

          clauses would make sense if the “under HIPAA” language was not present because patient

          information is the only information governed by HIPAA.

¶ 42          Northwestern’s reply brief asserts that the storage of healthcare workers’ biometric

          information, obtained when accessing a medication dispensing system, is for the ”health care”

          and “treatment” of patients as those terms are defined by HIPAA; therefore, the “under

          HIPAA” language does not exclude this type of information.

¶ 43          We find that the language of the statute is clear and simple disagreement between the

          parties will not create ambiguity in the statute. Kaider v. Hamos, 2012 IL App (1st) 111109,

          ¶ 11. What is excluded from the protections of section 10 are (1) information from the patient

          in a healthcare setting and (2) information that is already protected “under the federal Health

          Insurance Portability and Accountability Act of 1996.” 740 ILCS 14/10 (West 2018). Even

          taking into consideration the disjunctive “or,” section 10 still has the same effect of excluding

          those two classifications of information. Indeed, the disjunctive “or” means that patient

          information and information under HIPAA are alternatives that are to be considered separately.

          Goldberg v. Brooks, 409 Ill. App. 3d 106, 111 (2011).

¶ 44          At oral argument, Northwestern argued that this court should not consider the terminology

          “under HIPAA” and instead we should consider this as “defined by HIPAA.” However, “under

          HIPAA” is what the Act expressly states, and that cannot be ignored. We are simply unable to

          rewrite the statute. Zahn v. North American Power & Gas, LLC, 2016 IL 120526, ¶ 15. Either

          way, the biometric information of employees is simply not defined or protected “under

          HIPAA.” Accordingly, the plain language of the statute does not exclude employee

          information from the Act’s protections because they are neither (1) patients nor (2) protected

          under HIPAA. We further find that, if the legislature intended to create a wide-ranging

                                                      -15-
       Nos. 1-20-0822 and 1-21-0895, cons.

          exemption for hospitals, it would have done so, since the Act does contain a separate blanket

          exclusion. This is demonstrated in the Act when the legislature expressly provided that the Act

          was not to apply to financial institutions subject to Title V of the federal Gramm-Leach-Bliley

          Act of 1999 and employees, contractors, or subcontractors of local government or the State as

          provided in section 25. 740 ILCS 14/25 (West 2018).

¶ 45             Northwestern’s inclusion of employee’s biometric information under the exclusion

          goes beyond the plain language of the Act. We are unable to rewrite the statute to add

          provisions or limitations that the legislature did not include. Zahn, 2016 IL 120526, ¶ 15. No

          rule of construction permits this court to declare that the legislature did not mean what the plain

          language of the statute imports. Id. There is simply no provision or reference to the protection

          of employee biometric data in the Act or in HIPAA. Thus, we will not add employee biometric

          data as information to be excluded by the Act because it would be contrary to the plain

          language of the Act. Based thereon, we need not consider other sources in order to find the

          statutory meaning. Kaider, 2012 IL App (1st) 111109, ¶ 11.

¶ 46                                          III. CONCLUSION

¶ 47          Consistent with the plain language of the Act, we find that the legislature did not exclude

          employee biometric information from its protections, and we answer the certified question in

          the negative. We remand this cause for further proceedings consistent with this opinion.

¶ 48          Certified question answered; cause remanded.

                                                       -16-
Nos. 1-20-0822 and 1-21-0895, cons.

                                      No. 1-20-0822

 Cite as:                     Mosby v. Ingalls Memorial Hospital, 2022 IL App (1st) 200822

 Decision Under Review:       Appeal from the Circuit Court of Cook County, Nos. 18-CH-
                              05031, 18-CH-07161; the Hon. Pamela McLean Meyerson and
                              the Hon. Alison C. Conlon, Judges, presiding.

 Attorneys                    Joseph A. Strubbe, Frederic T. Knape, and Zachary J. Watters,
 for                          of Vedder Price P.C., and Gary M. Miller, Matthew C. Wolfe,
 Appellant:                   and Elisabeth A. Hutchinson, of Shook, Hardy & Bacon L.L.P.,
                              both of Chicago, for appellants Ingalls Memorial Hospital, UCM
                              Community Health & Hospital Division, Inc., and Becton,
                              Dickinson and Company.

                              Joel Griswold and Bonnie Keane DelGobbo, of Baker &
                              Hostetler LLP, of Chicago, for other appellants.

 Attorneys                    James B. Zouras, Ryan F. Stephan, Andrew C. Ficzko, Catherine
 for                          T. Mitchell, and Paige L. Smith, of Stephan Zouras, LLP, of
 Appellee:                    Chicago, for appellees.

 Amici Curiae:                Michael A. Woods, of Naperville, and Richard H. Tilghman, of
                              Nixon Peabody LLP, and Bonnie Keane DelGobbo and Joel
                              Griswold, of Baker & Hostetler LLP, both of Chicago, for amici
                              curiae Illinois Health and Hospital Association et al.

                                           -17-