Does Illinois BIPA apply to health care providers?

Illinois BIPA is the strictest biometric law in the country, so health care providers reasonably ask whether it reaches the fingerprint and face scans woven through hospital operations. The answer is a qualified yes. BIPA applies to health care employers, but Section 10 carves out an important category of data, and a 2023 Illinois Supreme Court ruling read that carve-out more broadly than plaintiffs wanted. The line runs through the purpose of the data, not the identity of the employer.

What does BIPA's health care exemption actually say?

Section 10 of the Act defines "biometric identifier" and then removes several things from that definition. Two clauses matter for health care. First, biometric identifiers do not include "information captured from a patient in a health care setting." Second, they do not include "information collected, used, or stored for health care treatment, payment, or operations under" HIPAA. A separate clause excludes X-rays, MRIs, and similar medical imaging. Because "biometric information" is defined by reference to biometric identifiers, data derived from any excluded item is excluded too. The full Illinois BIPA guide covers the notice, written-release, and retention duties that apply to everything the Act does reach.

Does the exemption cover health care workers, or only patients?

This was the fight in Mosby v. Ingalls Memorial Hospital, 2023 IL 129081. Nurses sued after scanning their fingerprints to access medication dispensing systems while providing patient care, and the hospitals argued the data fell within the second clause. The Illinois Supreme Court agreed. It held that the phrase after the word "or" excludes information used for a particular purpose, health care treatment, payment, or operations as HIPAA defines those terms, regardless of whether the information came from a patient or a worker. So a nurse's finger-scan used to open a medication cabinet for patient care is excluded from BIPA. The court was careful to say this is not a blanket exemption for the whole industry.

When are health care employers still covered by BIPA?

The exemption is about purpose, so it stops where the patient-care purpose stops. Biometric data a hospital collects for reasons unrelated to treatment, payment, or operations, such as a fingerprint clock used purely for general payroll, is not obviously covered by the Section 10 carve-out and should be treated as within the Act. That means written notice before collection, a written release, a public retention schedule, and destruction within three years of the person's last interaction. The stakes are high because BIPA carries a private right of action and, historically, per-violation exposure. Where you sit among the other state regimes is set out in biometric privacy laws by state.

Next step

If your organization scans fingerprints or faces and you are not sure which uses fall inside the Section 10 carve-out, the free 2-minute Obligation Scan flags where BIPA still applies and the notice, consent, and retention steps each use requires. The US state privacy laws hub shows how biometric rules sit alongside the comprehensive state laws.