An Illinois appellate court has revived two class-action lawsuits filed by healthcare workers who allege their employers violated the state’s Biometric Information Privacy Act (BIPA) through the use of hand-scanning time clocks. The lawsuits, previously dismissed by a Williamson County judge, were reinstated on April 9, 2025, after the appellate panel found inadequate evidence to support the claim that the devices were exempt under federal healthcare privacy laws.
The healthcare management company behind the timekeeping systems had argued that the devices fell under the Health Insurance Portability and Accountability Act (HIPAA) exemption to BIPA. However, the appellate court determined that the affidavit provided by the company’s CEO failed to substantiate that claim. The court concluded that further factual analysis was needed and remanded the cases to the circuit court for continued proceedings.
BIPA, enacted in 2008, is among the most stringent biometric privacy laws in the United States. It requires private entities to obtain informed, written consent before collecting or using biometric identifiers such as fingerprints, facial scans, or hand geometry. It also mandates clear disclosure of data handling practices and imposes strict confidentiality requirements. While BIPA does allow for limited exemptions, including those involving healthcare treatment or operations governed by HIPAA, the burden of proof lies with the employer to demonstrate that the exemption applies.
In this case, the employers asserted that the hand-scan timekeeping systems qualified as healthcare-related under HIPAA, but the court found that the evidence presented was insufficient. The decision signals that courts will require clear and specific documentation to support such exemptions, especially when biometric data is used in administrative functions like employee time tracking.
The ruling has potential implications for employers in the healthcare sector and beyond. Under BIPA, violations can result in statutory damages of up to $1,000 per incident for negligence, and up to $5,000 for intentional or reckless conduct. As biometric technologies become more common in workplace systems, compliance with BIPA has become a growing concern for businesses operating in Illinois.
The state has seen a marked increase in BIPA litigation in recent years, with over 1,500 cases filed. Recent decisions by the Illinois Supreme Court have clarified the law’s scope, including rulings that establish a five-year statute of limitations and confirm that each individual data collection event may constitute a separate violation. These interpretations have expanded liability exposure for non-compliant entities.
The reinstated class-action suits will now proceed in circuit court, where additional evidence will be evaluated to determine whether the employers’ use of biometric timekeeping systems violated BIPA or met the criteria for HIPAA exemption. The outcome could help clarify the limits of healthcare-related exemptions and provide further guidance on how biometric privacy laws intersect with employment practices.
Source: Bloomberg Law
—
April 11, 2025 – by Cass Kennedy
