Hey hospitals, retirement homes and clinics! If you are using biometrics to control medication dispensing systems, then Illinois’ Biometric Information Privacy Act then (BIPA) has news for you.

The use of biometric, in this case, the collection of fingerprints in order to authenticate access to a medication dispensing system, is considered to be the collection of biometric identifiers. That is important because:

• If you collect biometric identifiers, you are subject to BIPA (and other biometric laws depending on where you are) and you need things like notice, consent and a retention schedule.
• If you are in Illinois, you can actually be sued by your employees for not having this. There has been a big uptick in lawsuits both in the context of employment and outside of it.

• • The Illinois Supreme Court actually ruled in February 2022 that the state’s Workers’ Compensation Act doesn’t preempt claims for statutory damages under Illinois’ biometric privacy law.
  • The manufacturer of biometrics-based time clock systems recently agreed to pay $15.3 million to settle a class action lawsuit after a judge ruled the company could hold just as much responsibility under BIPA as the workers’ actual employers.

• If you think HIPAA will save you, then you are wrong, according to the Illinois State Appeals Court. The exclusion under BIPA only pertains to private information that’s already shielded by HIPAA and the biometric information of hospital employees.