Class Action Says Rush University Hospital Employee Fingerprint Scans Violate Illinois Privacy Law

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action claims Chicago’s Rush University Hospital has unlawfully collected, stored and disseminated employee fingerprint scans without consent.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 22-page lawsuit says that the private hospital has run afoul of the Illinois Biometric Information Privacy Act (BIPA) by capturing, storing and sharing workers’ fingerprint scans with at least one third-party vendor, by way of biometric-enabled medication dispensing systems, without informed consent.

The suit further alleges that the hospital has breached the BIPA by failing to inform employees of how long and for what purpose their biometric data would be saved and used, and by neglecting to publish guidelines that establish Rush’s data retention and destruction schedule.

As the case tells it, employees are required to have their fingerprints scanned in order to access the hospital’s automated medication dispensing systems, including the Pyxis MedStation machine, the Pyxis CIISafe, the Pyxis Anesthesia station and other connected devices. According to the complaint, the workers’ biometric data is stored in the system in order to authenticate their identities each time they use a Pyxis device.

The filing argues that the defendant’s alleged BIPA violations show a disregard for its employees’ protected privacy rights and expose them to “serious and irreversible privacy risks” should their biometric data be compromised.

“Rush [University Hospital] workers have a proprietary right to control their biometric information,” the lawsuit contends. “In failing to comply with the requirements of BIPA, [the defendant] intentionally interferes with each worker’s right of possession and control over their valuable, unique, and permanent biometric data.”

The plaintiff, an Illinois resident, was employed by the hospital as a respiratory therapist in the past few years, the suit says. Like other workers, the man was required to scan his fingerprint each time he accessed a Pyxis device, the case shares.

However, the plaintiff claims to have never consented to the collection, storage and dissemination of his biometric information, nor was he ever informed why or for how long the hospital would retain the data, or if it would be destroyed.

The lawsuit looks to represent any Illinois employee whose fingerprints or any other biometric information were obtained or disclosed by Rush University Hospital during the applicable statute of limitations period.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.