NOTICE 2025 IL App (5th) 240785-U NOTICE Decision filed 04/09/25. The This order was filed under text of this decision may be NO. 5-24-0785 Supreme Court Rule 23 and is changed or corrected prior to not precedent except in the the filing of a Petition for IN THE limited circumstances allowed Rehearing or the disposition of under Rule 23(e)(1). the same.

APPELLATE COURT OF ILLINOIS FIFTH DISTRICT ______________________________________________________________________________ ELIZABETH VERITY and JESSICA CHRISTIE, ) Appeal from the on Behalf of Themselves and All Other Persons ) Circuit Court of Similarly Situated, Known and Unknown, ) Williamson County. ) Plaintiffs-Appellants, ) ) v. ) No. 20-L-41 ) HERRIN REHABILITATION AND NURSING ) CENTER, LLC, d/b/a Integrity Healthcare of Herrin, ) Honorable ) Jeffrey A. Goffinet, Defendant-Appellee. ) Judge, presiding. ______________________________________________________________________________ JUSTICE CATES delivered the judgment of the court.

Justices Boie and Sholar concurred in the judgment.

ORDER ¶1 Held: The circuit court erred in dismissing the plaintiffs’ class action complaint where the defendant failed to meet its burden of establishing that an affirmative matter defeated the plaintiffs’ claims.

¶2 The plaintiffs, Elizabeth Verity and Jessica Christie, appeal the circuit court’s order dismissing their class action complaint. The plaintiffs claim that the circuit court incorrectly applied the “attached-papers” and “particularity” requirements of Illinois Supreme Court Rule 191(a) (eff. Jan. 4, 2013); the circuit court incorrectly held that certain timekeeping activities for employees fell within the Biometric Information Privacy Act’s (BIPA) 1 healthcare exemption; and

Biometric Information Privacy Act (BIPA) (740 ILCS 14/1 et seq. (West 2020)). the circuit court improperly dismissed the plaintiffs’ lawsuit as a result of its rulings. For the following reasons, we reverse and remand for further proceedings.

¶3 I. BACKGROUND ¶4 Both Verity and Christie were certified nursing assistants (CNA) and they worked for the defendant, Herrin Rehabilitation and Nursing Center, LLC. Verity was employed from approximately June of 2016 to January of 2017, and Christie was employed from approximately July of 2019 to November of 2019. During those time periods, the defendant required the plaintiffs, and other employees, to scan their hands using a biometric timeclock. Each employee was required to scan their hand when they started and ended their workday and when they started and finished their lunch breaks.

¶5 The plaintiffs filed a three-count class action complaint on April 6, 2020, which alleged that the defendant violated the Biometric Information Privacy Act (BIPA) (740 ILCS 14/1 et seq. (West 2020)) by unlawfully collecting hand geometry scans, using a biometric timeclock. The plaintiffs claimed that the hand geometry scans qualified as biometric identifiers 2 under BIPA and that the collection of these biometric identifiers violated BIPA because the collection of these biometric identifiers compromised the privacy and security of the biometric identifiers and biometric information 3 of the plaintiffs and other similarly situated employees. 4 ¶6 Specifically, in count I of the complaint, the plaintiffs alleged that the defendant violated section 15(b) of BIPA (740 ILCS 14/15(b) (West 2020)), where the plaintiffs had acquired and

BIPA defines “biometric identifier” as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” 740 ILCS 14/10 (West 2020).

BIPA defines “biometric information” as “any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual.”

740 ILCS 14/10 (West 2020).

Plaintiffs brought this cause of action on behalf of themselves and a class of other similarly situated employees. The term “plaintiffs” as used herein refers generally to the individual plaintiffs and the purported class unless otherwise specifically identified. retained biometric information from the plaintiffs’ hand geometry scans without first informing the plaintiffs and other similarly situated employees in writing that defendant was doing so. The defendant additionally failed to inform the plaintiffs of the purpose of the collection of personal identifying information and the length of time the biometric identifiers and biometric information would be stored. Count I further alleged that the defendant had not obtained plaintiffs’ consent or other form of release allowing defendant to collect the biometric identifiers and/or biometric information. In count II, the plaintiffs alleged violations of section 15(a) of BIPA (740 ILCS 14/15(a) (West 2020)), where the defendant possessed personal identifying information obtained from the plaintiffs’ hand geometry scans without creating and following a written policy, made available to the public, establishing a retention schedule and destruction guidelines. In count III, the plaintiffs alleged violations of section 15(d) of BIPA (740 ILCS 14/15(d) (West 2020)) where the defendant disclosed or otherwise disseminated the plaintiffs’ hand geometry scans and personal identifying information to defendant’s timekeeping vendor, without first obtaining plaintiffs’ consent for such disclosure or dissemination.

¶7 The defendant requested a stay in this proceeding pending the resolution of other BIPA cases pending in various courts throughout Illinois. The initial request for a stay was followed by subsequent motions for renewed stays. An agreed order was entered on October 25, 2021, whereby the defendant was ordered to file a responsive pleading to the plaintiffs’ class action complaint by November 30, 2021.

¶8 The defendant filed a motion to dismiss the class action lawsuit pursuant to section 2-619.1 of the Code of Civil Procedure (735 ILCS 5/2-619.1 (West 2020)) on November 30, 2021. The defendant argued, in its written motion, that the plaintiffs’ claims were untimely under a one-year statute of limitations; that the plaintiffs failed to plead facts to establish harm caused by a BIPA

violation; that the plaintiffs lacked standing; that the plaintiffs failed to allege specific facts regarding the disclosure of biometric information to an unidentified third party timekeeping vendor and that any such disclosure by defendant would be exempt from BIPA requirements because the disclosure would have been to effectuate a financial transaction; and that the plaintiffs’ exclusive remedy for workplace injury damages was through the Illinois Workers’ Compensation Act (820 ILCS 305/1 et seq. (West 2020)).

¶9 On January 5, 2022, the defendant filed a renewed motion to stay proceedings. The circuit court entered a stay in this action pending decisions by the Illinois Supreme Court in three BIPA cases: Cothron v. White Castle System, Inc., 2023 IL 128004, McDonald v. Symphony Bronzeville Park, LLC, 2022 IL 126511, and Tims v. Black Horse Carriers, Inc., 2023 IL 127801. The stay was lifted on February 28, 2023. The defendant subsequently sought to continue the stay of the proceedings based on pending litigation in another BIPA case, Mosby v. Ingalls Memorial Hospital, 2023 IL 129081, which the circuit court denied.

¶ 10 The circuit court allowed the defendant to file an amended section 2-619.1 motion to dismiss. See 735 ILCS 5/2-619.1 (West 2022). The defendant argued in its amended motion that the matter was barred by the BIPA healthcare exceptions regarding healthcare treatment, payment, and operations; the plaintiffs lacked standing; the allegations were insufficient as to possession and disclosure of the biometric data; that the plaintiffs failed to allege specific facts regarding the disclosure of biometric information to an unidentified third party timekeeping vendor and that any such disclosure by defendant would be exempt from BIPA requirements because the disclosure would have been to effectuate a financial transaction; the plaintiffs’ allegations did not support a claim that the defendant acted recklessly or that the defendant proximately caused the plaintiffs

actual harm; and the plaintiffs assumed the risk of disclosure. The circuit court denied the 2-619.1 motion to dismiss in a written order entered on November 2, 2023.

¶ 11 The defendant filed an answer and affirmative defenses on November 27, 2023. The defendant denied multiple allegations in the complaint including many of the background facts alleged by the plaintiffs regarding the data captured from the defendant’s biometric timeclock and the biometric identifiers and information disclosed to the defendant’s timekeeping vendor. The defendant additionally denied multiple other allegations in the complaint, such as the plaintiffs’ allegation that the defendant had achieved a labor management benefit from using a biometric timeclock.

¶ 12 Shortly after the defendant filed its answer and affirmative defenses, the Illinois Supreme Court issues an opinion in Mosby v. Ingalls Memorial Hospital, 2023 IL 129081. After the Mosby decision was issued, the defendant filed a supplemental motion to dismiss pursuant to section 2- 619(a)(9) of the Code of Civil Procedure (735 ILCS 5/2-619(a)(9) (West 2022)) and relied on Mosby, 2023 IL 129081. In Mosby, nurses’ biometric information obtained from a medication dispensing system used for patient care was excluded from coverage under BIPA. See Mosby, 2023 IL 129081. Mosby determined that “information collected, used, or stored for health care treatment, payment, or operations under [HIPAA 5]” was exempt from BIPA requirements. Mosby, 2023 IL 129081, ¶ 54. Based on Mosby, the defendant argued that the individual plaintiffs, and the proposed class, were healthcare workers and the data allegedly collected from the use of a timeclock was used by the defendant for healthcare operations and payments. Thus, according to

“HIPAA” refers to the federal Health Insurance Portability and Accountability Act of 1996. See 45 C.F.R. § 164.501 (2018). the defendant, the plaintiffs’ BIPA claims failed as the alleged biometric data fell within certain specific statutory exemptions.

¶ 13 In support of its supplemental motion to dismiss, the defendant attached an affidavit from Kelly Kelley, the chief executive officer (CEO) of Integrity Healthcare Communities. Kelley averred that her affidavit was based on her personal knowledge. Kelley’s affidavit also included the following statement: “In my role, I routinely review the records discussed in this Affidavit as part of my regular duties. Based on my experience, I can attest that the business records that I have reviewed for purposes of this Affidavit were made at or near the time of the event they record, and made and kept in the ordinary course of Herrin’s business of operating a skilled nursing facility.”

¶ 14 Kelley’s affidavit made numerous references to “punch data,” which she identified as the data generated from the plaintiffs and other workers when they scanned their hands on the timeclock. Kelley averred that the defendant used the “punch data” to prepare and audit its staffing requirements; to know which employees were on site; to prepare its required annual financial and statistical report; to prepare a portion of an annual report; to submit direct care staffing information; to prepare quarterly staffing reports; to investigate, resolve, and combat issues involving patient safety, facility sanitation, and fraud and abuse prevention; to identify each employee clocking in to prevent time fraud; to demonstrate compliance with Medicaid and Medicare regulations; to investigate allegations of possible drug diversion; to investigate complaints of patient treatment; to maintain certified nursing assistant (CNA) certification status; for use in business planning and other general administrative activities; and to confirm compliance with requirements that patients received medically-related social services. A 2019 financial statement was attached to the affidavit, but “punch data,” or other documents that referenced “punch data,” were not attached.

¶ 15 The plaintiffs responded to the defendant’s 2-619 motion to dismiss and argued that the defendant’s timekeeping activities were not exempt under BIPA. The plaintiffs additionally claimed that Kelley’s affidavit failed to comply with Illinois Supreme Court Rule 191(a) (eff. Jan.

4, 2013), as it included many conclusory allegations and lacked exhibits to support and/or verify those conclusory allegations. The plaintiffs further claimed that the only attachment, a 2019 financial report, was insufficient and noted that Verity was employed prior to 2019.

¶ 16 The plaintiffs, in their response, also argued that the “punch data” description provided in the affidavit was unclear. The “punch data” may refer to the biometric hand geometry scan identifiers or it could refer to the summary data used to determine the dates and times that the employees clocked into and out of work. The plaintiffs assumed that the “punch data” referenced was not the biometric data identified in the complaint and argued that the use of the summary data would not excuse the defendant from liability. Furthermore, the plaintiffs claimed that if the “punch data” were the biometric data identified in the complaint, the data was not used for healthcare “payment” or “operations” under HIPAA and no exemption applied.

¶ 17 The plaintiffs attached copies of emails to the response to the motion to dismiss which demonstrated that the parties had engaged in discovery. The defendant, however, had not produced any documents. Specifically, no “punch data” had been produced prior to the motion to dismiss hearing.

¶ 18 During the hearing on the defendant’s supplemental motion to dismiss, the defendant argued that an exclusion applied to BIPA which allowed the healthcare industry to use biometric information for treatment, payment, or operations as defined by HIPAA. The defendant claimed that it used the hand geometry scan data for purposes that fell within the operations and payment prongs of the HIPAA. Without the biometric data generated from the plaintiffs’ use of the

timeclocks, the defendant argued that it would not have been able to comply with reporting requirements. The data was also allegedly used for payment purposes, used to ensure compliance with regulations, and used for other activities such as obtaining reimbursements from Medicaid and Medicare programs.

¶ 19 The defendant further argued that Kelley’s affidavit was unrebutted, and that the affidavit was compliant with Rule 191(a) where Kelley’s affidavit was based on personal knowledge and experience. See Ill. S. Ct. R. 191(a) (eff. Jan. 4, 2013). The defendant argued that the financial statement referenced in the affidavit was attached and was sufficient to satisfy the “attached- papers” requirement of Rule 191(a). See Ill. S. Ct. R. 191(a) (eff. Jan. 4, 2013). The defendant also argued that Kelley had clearly stated facts on which she based her opinion.

¶ 20 In response, the plaintiffs argued that Kelley’s affidavit was not compliant with Rule 191(a) and, therefore, the burden never shifted to the plaintiffs to provide a counteraffidavit. See Ill. S.

Ct. R. 191(a) (eff. Jan. 4, 2013). The plaintiffs claimed the affidavit did not comply with the “attached-papers” requirement or the “particularity” requirement. Kelley had stated in her affidavit that she reviewed documents for the purpose of drafting her affidavit and referred to “punch data,” which she failed to attach.

¶ 21 The plaintiffs additionally argued that discovery was necessary to review the “punch data” and to make a determination if “punch data” was the same data as described in the complaint. The plaintiffs believed that Kelley’s described “punch data” was summary data, such as an Excel spreadsheet, and not a hand scan or a mathematical representation of a hand scan. If the “punch data” referred to by Kelley was summary data, then that data was not specific to the claims related to the hand geometry scans identified in the plaintiffs’ complaint.

¶ 22 The plaintiffs further argued that Kelley had not used the data identified in the complaint for anything defined as a “healthcare payment” and/or “operations,” and that HIPAA’s definition of “healthcare operations” did not encompass everything that occurs in a healthcare setting. Even if the circuit court accepted every fact in Kelley’s affidavit, including that Kelley had referred to biometric data which was used for healthcare payment and operations, the plaintiffs argued that the circuit court would not have specific enough information to grant the motion to dismiss because Kelley had not identified when the data was used for healthcare payment and operations. The plaintiffs requested that the circuit court deny the motion to dismiss because questions remained regarding the amount of data and when the data was used for healthcare payment and operations.

¶ 23 Nevertheless, the defendant sought dismissal of the complaint based on allegations of its use of “punch data” that it failed to provide to the court. The circuit court took the matter under advisement.

¶ 24 The circuit court entered a written order granting the defendant’s supplemental motion to dismiss with prejudice. The circuit court found that “any alleged biometric identifiers and biometric information generated from the use of Defendant’s timeclock fall under the Biometric Information Privacy Act’s (‘BIPA’) statutory exemption for ‘information collected, used, or stored for health care treatment, payment, or operations under [HIPAA],’ and are therefore not subject to the BIPA’s requirements. See 740 ILCS 14/10.”

¶ 25 The plaintiffs filed a motion to reconsider the circuit court’s order of dismissal. The circuit court denied the motion to reconsider. This appeal followed.

¶ 26 II. ANALYSIS ¶ 27 On appeal, the plaintiffs challenge the circuit court’s order granting the defendant’s section 2-619(a)(9) motion to dismiss where the defendant solely relied on Kelley’s affidavit. See 735 ILCS 5/2-619(a)(9) (West 2022). The plaintiffs argue that Kelley’s affidavit was insufficient, and

the circuit court incorrectly applied the “attached-papers” requirement and the “particularity” requirement of Illinois Supreme Court Rule 191(a) (eff. Jan. 4, 2013). The plaintiffs additionally argue that the circuit court improperly dismissed the action based on its finding that the defendant’s timekeeping activities for employees fell within BIPA’s healthcare exemption.

¶ 28 A section 2-619(a)(9) motion to dismiss asserts that a claim against the defendant is barred by an affirmative matter avoiding the legal effect of or defeating the claim while admitting the legal sufficiency of the complaint. Kuykendall v. Schneidewind, 2017 IL App (5th) 160013, ¶ 32.

“An ‘affirmative matter’ is a type of defense that negates a cause of action completely or refutes critical conclusions of law or conclusions of material fact that are unsupported by specific factual allegations contained in or inferred from the complaint.” Kuykendall, 2017 IL App (5th) 160013, ¶ 32. Initially, the defendant has the burden of establishing that an affirmative matter defeats the plaintiffs’ claim. Kuykendall, 2017 IL App (5th) 160013, ¶ 32. Then, the burden shifts to the plaintiffs, who must establish that the affirmative defense is “ ‘unfounded or requires the resolution of an essential element of material fact before it is proven.’ ” Epstein v. Chicago Board of Education, 178 Ill. 2d 370, 383 (1997) (quoting Kedzie &103rd Currency Exchange, Inc. v. Hodge, 156 Ill. 2d 112, 116 (1993)).

¶ 29 A section 2-619 motion to dismiss should only be granted if the plaintiffs cannot prove a set of facts that would support the cause of action. In re Estate of Boyar, 2013 IL 113655, ¶ 27. “If defendant’s evidence in support of a section 2-619(a)(9) motion does nothing more than refute the well-pleaded allegations of the complaint, the complaint trumps that evidence, and dismissal is improper.” Doe v. University of Chicago Medical Center, 2015 IL App (1st) 133735, ¶ 43. A summary judgment motion is the appropriate procedural tool to use when addressing the complaint’s factual allegations. Kuykendall, 2017 IL App (5th) 160013, ¶ 32. The standard of

review of a section 2-619 motion to dismiss is de novo. Krilich v. American National Bank & Trust Co. of Chicago, 334 Ill. App. 3d 563, 571 (2002).

¶ 30 The circuit court may consider affidavits when deciding a section 2-619(a)(9) motion to dismiss an affirmative matter, if such a matter is not apparent on the face of the complaint. Epstein, 178 Ill. 2d at 383. Under Illinois Supreme Court Rule 191(a), “affidavits submitted in connection with a motion for involuntary dismissal under section 2-619 of the Code of Civil Procedure *** shall be made on the personal knowledge of the affiants; shall set forth with particularity the facts upon which the claim, counterclaim, or defense is based; shall have attached thereto sworn or certified copies of all documents upon which the affiant relies; shall not consist of conclusions but of facts admissible in evidence; and shall affirmatively show that the affiant, if sworn as a witness, can testify competently thereto.” Ill. S. Ct. R. 191(a) (eff. Jan. 4, 2013).

¶ 31 The provisions of Supreme Court Rule 191(a) should be adhered to as written and construed according to the plain and ordinary meaning of its language. Robidoux v. Oliphant, 201 Ill. 2d 324, 347 (2002). “The requirement that documents be attached is not a mere ‘technicality’ and, if not adhered to, is fatal.” Selby v. O’Dea, 2020 IL App (1st) 181951, ¶ 136. Strict compliance with Supreme Court Rule 191(a) ensures that the circuit court is presented with valid evidentiary facts upon which to base a decision. Robidoux, 201 Ill. 2d at 336.

¶ 32 In Doe v. Coe, the defendants argued that the “attached-papers” requirement of Rule 191(a) did not mandate the attachment of documents where the affiants professed personal knowledge.

Doe v. Coe, 2017 IL App (2d) 160875, ¶ 11. The affiants in Coe specified the documents in support of their assertions and thereby relied on the documents within the meaning of Rule 191(a). Coe, 2017 IL App (2d) 160875, ¶ 11. The documents were, nevertheless, required to be attached as they would have allowed the circuit court the opportunity to review the bases for the assertions in the affidavits. Coe, 2017 IL App (2d) 160875, ¶ 11. Similarly, in Direct Auto Insurance Co. v. Betran, an affidavit which referenced documents failed to comply with the requirements of Rule 191(a) where the supporting documents were not attached. Direct Auto Insurance Co. v. Betran, 2013 IL App (1st) 121128, ¶ 64.

¶ 33 The plaintiffs’ complaint alleged multiple BIPA violations based on the use of a biometric timeclock which allegedly compromised the privacy and security of the biometric identifiers and information of the individual plaintiffs and other similarly situated employees. BIPA defines “biometric information” as “any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual.” 740 ILCS 14/10 (West 2020). BIPA defines “biometric identifier” as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” 740 ILCS 14/10 (West 2020).

¶ 34 The defendant argued that BIPA’s healthcare exemption barred the plaintiffs’ claims in the defendant’s section 2-619(a)(9) motion to dismiss. Under BIPA, biometric identifiers “do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996.” 740 ILCS 14/10 (West 2020). Under Mosby, a biometric identifier exemption applied where a healthcare worker’s biometric information was used to permit access to medication dispensing stations for patient care. Mosby, 2023 IL 129081, ¶ 54.

¶ 35 In support of the defendant’s 2-619(a)(9) motion to dismiss, the defendant provided a single affidavit from Kelley which claimed that the defendant used employees’ “punch data” for healthcare operations and payments and claimed that biometric identifier exemptions applied.

Kelley made specific and repeated references to “punch data,” which she defined as the data generated from the plaintiffs and other workers scanning their hands on the timeclock. The “punch data” description was vague. The review of a hand geometry scan would not likely produce the

information that Kelley referenced as “punch data,” used for multiple functions including the preparation of audits and reports, or to demonstrate compliance with regulations. Although Kelley averred that her affidavit was based on personal knowledge, Kelley also stated that she had reviewed business records for the purpose of drafting her affidavit. However, no “punch data” documents or other business records were attached to Kelley’s affidavit.

¶ 36 The plaintiffs additionally argue that the circuit court improperly dismissed the action based on its finding that the defendant’s timekeeping activities for employees fell within BIPA’s healthcare exemption. We note that the defendant filed an answer prior to filing the supplemental motion to dismiss and had denied multiple allegations in the complaint. For instance, the defendant denied that it received a labor management benefit from using the biometric timeclock. The defendant additionally denied background facts such as capturing or collecting the plaintiffs’ unique biometric identifiers and information and sharing those identifiers and information with its timekeeping vendor.

¶ 37 Kelley averred that the “punch data” was used for numerous purposes and the information was collected, used, or stored for healthcare treatment, payment, or operations. Yet, it is unknown if “punch data” is the same information that the plaintiffs referred to in the complaint as the unique biometric identifiers and information which was shared with the defendant’s timekeeping vendor where the “punch data” has not been produced.

¶ 38 Because Kelley relied on “punch data” in her affidavit, she was required under Rule 191(a) to have attached thereto sworn or certified copies of the “punch data” documents which she had reviewed and/or upon which she relied. See Ill. S. Ct. R. 191(a) (eff. Jan. 4, 2013). The only document attached was conclusory and did not reference “punch data.” Therefore, Kelley’s affidavit fails to comply with the requirements of Rule 191(a). See Ill. S. Ct. R. 191(a) (eff. Jan. 4,

2013). Without further particularity and compliance with the “attached-papers” requirement, the circuit court erred in granting the defendant’s 2-619(a)(9) motion to dismiss as the defendant failed to meet its burden of establishing that an affirmative matter defeated the plaintiffs’ claims.

¶ 39 III. CONCLUSION ¶ 40 For the foregoing reasons, we reverse the judgment of the circuit court of Williamson County and remand for further proceedings.

¶ 41 Reversed and remanded.