In a significant ruling for government contractors and healthcare service providers operating within Illinois, an appellate court has upheld the dismissal of a class-action lawsuit filed under the state’s stringent Biometric Information Privacy Act (BIPA). The decision, handed down on September 4, 2026, reinforces the legal shield provided to entities acting as government contractors, specifically when those entities are required by state law to collect biometric data for background checks. The defendant, Help at Home, a prominent provider of home care services, successfully argued that its collection of employee fingerprints was not a violation of BIPA because the activity fell under a statutory exemption designed for government-mandated security protocols.
The case, which has been closely watched by legal experts and the healthcare industry, centers on the intersection of privacy rights and the regulatory obligations of agencies serving vulnerable populations. By affirming the lower court’s decision, the appellate panel has clarified the boundaries of BIPA, a law that has historically been interpreted broadly by Illinois courts, often to the detriment of the business community.
The Core of the Legal Dispute
The litigation began when former employees of Help at Home alleged that the company had violated BIPA by requiring them to scan their fingerprints for background checks without providing the necessary disclosures or obtaining written consent, as mandated by the Act. BIPA, enacted in 2008, requires private entities to follow a strict protocol before collecting, storing, or using biometric identifiers such as fingerprints, facial geometry, or iris scans. This protocol includes informing the subject in writing that the data is being collected, stating the specific purpose and length of time for which the data will be stored, and receiving a written release from the individual.
Help at Home moved to dismiss the complaint, asserting that it was exempt from BIPA’s requirements under Section 25(c) and Section 25(e) of the Act. The company argued that its status as a provider for the Illinois Department on Aging and the Illinois Department of Human Services effectively made it a government contractor. Furthermore, the company contended that the fingerprinting was not a discretionary business practice but a mandatory requirement under the Health Care Worker Background Check Act.
The appellate court agreed with this assessment. The panel found that because the biometric data was collected specifically to facilitate a background check required by the state for individuals working with elderly or disabled populations, the activity was shielded from BIPA’s private cause of action. The court noted that imposing BIPA’s requirements on a contractor fulfilling a state mandate would create a conflict between two separate legislative objectives: the protection of biometric privacy and the protection of vulnerable citizens through rigorous vetting of healthcare workers.
Historical Context and the Evolution of BIPA
To understand the weight of this decision, one must look at the history of the Biometric Information Privacy Act. When Illinois passed BIPA in 2008, it was the first state in the nation to create a comprehensive regulatory framework for biometric data. For nearly a decade, the law remained relatively obscure. However, following the 2019 Illinois Supreme Court decision in Rosenbach v. Six Flags Entertainment Corp., the floodgates for litigation opened. The Rosenbach court ruled that a plaintiff does not need to show actual harm or "adverse effects" to sue; a mere technical violation of the law’s notice and consent requirements is sufficient to seek liquidated damages.
Since that ruling, thousands of class-action lawsuits have been filed against companies ranging from tech giants like Facebook and Google to local trucking firms and fast-food franchises. The financial stakes are immense, as BIPA allows for statutory damages of $1,000 per "negligent" violation and $5,000 per "intentional or reckless" violation. In the context of a large workforce where employees clock in daily using a fingerprint scanner, these damages can quickly escalate into hundreds of millions or even billions of dollars.
The Help at Home decision represents a rare but growing trend of Illinois courts recognizing the limits of BIPA’s reach. While the law is intended to protect consumers and employees from the unauthorized use of their most personal data, the courts are increasingly wary of allowing BIPA to interfere with other established state mandates, particularly those involving public safety and government-funded social services.
Chronology of the Case
The legal journey for Help at Home began several years ago when the initial complaint was filed in the Cook County Circuit Court.
- 2023-2024: The plaintiffs filed a class-action complaint alleging that Help at Home failed to provide the "retention schedule" and "guidelines" required by BIPA Section 15(a) and failed to obtain the "written release" required by Section 15(b).
- Late 2024: Help at Home filed a motion to dismiss, citing its contractual relationship with the state of Illinois. The company argued that as an agent of the Department on Aging, it was performing a governmental function.
- Early 2025: The trial court granted the motion to dismiss. The judge ruled that the Health Care Worker Background Check Act took precedence in this specific context, and that Help at Home was acting as a government contractor exempt from the privacy statute.
- 2025-2026: The plaintiffs appealed the decision to the Illinois Appellate Court, arguing that the "government contractor" exemption should be interpreted narrowly and that Help at Home is a private, for-profit entity that should not be shielded from liability.
- September 4, 2026: The appellate panel affirmed the trial court’s dismissal, effectively ending the litigation unless the plaintiffs successfully petition the Illinois Supreme Court for a review.
Supporting Data and the Economic Landscape of BIPA
The ruling comes at a time when the economic impact of BIPA is under intense scrutiny. According to legal tracking data, Illinois remains the most active jurisdiction for biometric litigation in the world. Between 2018 and 2025, over 3,500 BIPA-related class actions were filed in Illinois state and federal courts.
The financial burden on the healthcare sector has been particularly heavy. Data from insurance industry analysts suggests that healthcare providers in Illinois have seen a 40% increase in premiums for employment practices liability insurance (EPLI) over the last five years, largely attributed to the risk of BIPA litigation. For home care providers like Help at Home, which operate on thin margins and rely heavily on state reimbursements, a multi-million dollar BIPA judgment could be catastrophic, potentially leading to a reduction in services for the elderly.
Furthermore, recent legislative changes in 2024—specifically Senate Bill 2979—have sought to mitigate the "per-scan" damage model. The amendment clarified that an entity that repeatedly collects the same biometric identifier from the same person in the same manner has committed only a single violation, rather than a violation every time a finger is scanned. This legislative shift likely influenced the appellate court’s perspective, signaling a broader state-wide movement toward a more balanced application of the law.
Statements and Reactions
While official statements from the parties involved have been measured, legal analysts and industry advocates have been quick to weigh in on the ruling’s implications.
A spokesperson for the Illinois HomeCare & Hospice Council expressed relief at the decision, stating: "Our members provide essential services to the state’s most vulnerable populations. They are required by law to conduct background checks to ensure the safety of those in their care. Penalizing these agencies for complying with state-mandated safety protocols would have been a grave injustice and a threat to the continuity of care in Illinois."
On the other side of the aisle, privacy advocates have expressed concern that the "government contractor" exemption is being stretched too far. "The intent of BIPA is to ensure that every individual has control over their biometric data," said a representative from a Chicago-based digital rights group. "By allowing private, for-profit companies to bypass these protections simply because they have a state contract, we are creating a two-tiered system of privacy rights for Illinois workers."
Legal counsel for Help at Home emphasized that the company takes privacy seriously but maintained that the lawsuit was an attempt to apply BIPA to a scenario the legislature never intended to cover. "This was about compliance with the Health Care Worker Background Check Act," the defense team noted. "Our client followed the state’s rules for vetting employees, and the court correctly identified that BIPA was not meant to punish that compliance."
Broader Impact and Industry Implications
The affirmation of the exemption for Help at Home sets a vital precedent for thousands of other entities in Illinois. Any organization that operates under a state contract and is required by law to collect biometrics for security or vetting purposes now has a clearer legal roadmap.
1. Healthcare and Social Services
Providers of Medicaid-funded services, nursing homes, and child welfare agencies are the most immediate beneficiaries. These organizations are often required by the Illinois Department of Public Health (IDPH) to use biometric-enabled systems for background checks and even for "Electronic Visit Verification" (EVV) to prevent fraud. This ruling suggests that as long as the collection is tied to these state mandates, the risk of BIPA litigation is significantly reduced.
2. The Definition of "Government Contractor"
The ruling provides a more robust definition of what constitutes a "government contractor" in the eyes of the court. It moves beyond the simple existence of a contract and looks at the function being performed. If the private entity is performing a task that the state would otherwise have to perform itself—and doing so under state-mandated protocols—the exemption is likely to hold.
3. Future Litigation Strategy
Plaintiffs’ attorneys will likely pivot their strategies in response to this ruling. We may see fewer cases targeting state-funded healthcare providers and more focus on purely private-sector industries, such as retail, hospitality, and manufacturing, where no state-mandated background check requirement exists to provide a shield.
4. Pressure for Further Legislative Clarity
While the courts are providing some clarity, the Help at Home case highlights the ongoing friction between BIPA and other Illinois statutes. There is growing pressure on the Illinois General Assembly to further refine the Act to explicitly list which state-mandated activities are exempt, rather than leaving it to the courts to decide on a case-by-case basis.
Conclusion: A Balancing Act
The Illinois appellate court’s decision in the Help at Home case represents a pragmatic approach to privacy law. By affirming the exemption for government contractors conducting mandated background checks, the court has acknowledged that BIPA does not exist in a vacuum. It must coexist with other laws designed to protect public safety and ensure the integrity of the state’s social service infrastructure.
For Help at Home, the ruling is a definitive victory that removes a significant legal and financial cloud. For the broader business community in Illinois, it is a signal that while BIPA remains a potent tool for privacy protection, it is not an absolute weapon that can be used to penalize companies for fulfilling their legal obligations to the state. As the legal landscape continues to evolve, this case will undoubtedly serve as a cornerstone for future arguments regarding the limits of biometric privacy and the scope of government-mandated data collection.
