The Illinois Legislature enacted the Illinois Genetic Information Privacy Act (GIPA) (see 410 ILCS 513, et seq.) to protect individuals from having their genetic information disclosed and/or used against them in a discriminatory manner relating to employment. While there has been some litigation involving GIPA since its enactment, said litigation has predominantly dealt with the sale and transfer of genetic information without consent. Recently, however, over ten class action lawsuits have been filed in Cook County alleging that employers violated GIPA by soliciting, requesting, inquiring and/or requiring prospective and current employees to disclose their family medical history including during physicals and/or interviews as part of the hiring process, and that such an action violates GIPA on its face. These recent GIPA lawsuits are based on similar allegations and should be considered by Illinois businesses to ensure compliance with GIPA. Factories, hospitals, and logistics companies have been some of the targets of this new wave of lawsuits.
The lawsuits
In each of the newly filed lawsuits, plaintiffs (for themselves and a putative class) allege that during the hiring process, each defendant employer required pre-employment physicals with a company physician and/or pre-employment health interviews with a company employee. Plaintiffs contend that through the company physician and/or employee, the employers solicited, requested, inquired and/or required plaintiffs to disclose their family medical history (including medical conditions and diagnoses for their family members). Plaintiffs allege that disclosing their family medical history was a condition of employment and/or part of the hiring process. In each of these lawsuits, the plaintiffs were in fact hired by the employer defendants. Plaintiffs allege that regardless of whether they have actual damages, the defendant employers violated GIPA and as such, are liable. Plaintiffs seek: (1) statutory damages or actual damages, whichever is greater, for each intentional and/or reckless violation of GIPA; (2) in the alternative, statutory or actual damages, whichever is greater, for each negligent violation of GIPA; and (3) reasonable attorneys’ fees and costs and other litigation expenses.
GIPA was enacted in 1998. GIPA was amended in 2008 to increase its protections and align it (at least in part) with the Federal Genetic Information Nondiscrimination Act of 2008 (GINA). In that regard, GIPA adopts the GINA/HIPAA definition of protected “genetic information,” which includes: (1) an individual’s genetic tests, (2) genetic tests of family members of an individual, and (3) the manifestation of a disease or disorder in family members of such individual. See 410 ILCS 513/10 (emphasis added); see also 45 C.F.R. 160.13. A family member includes: (1) the spouse of the individual, (2) a dependent child of the individual, (3) any other person qualifying as a covered dependent under a managed care plan, and (4) all other individuals related by blood or law to the individual. See 410 ILCS 513/10.
Pursuant to GIPA, an employer shall not directly or indirectly:
- solicit, request, require, or purchase genetic information of a person or a family member of the person . . . as a condition of employment and/or preemployment application;
- affect the terms, conditions, or privileges of employment and/or preemployment application, or terminate the employment, of any person because of genetic information with respect to the employee or family member;
- limit, segregate, or classify employees in any way that would deprive or tend to deprive any employee of employment opportunities or otherwise adversely affect the status of the employee as an employee because of genetic information with respect to the employee or a family member, or information about a request for or the receipt of genetic testing or genetic information by such employee or family member of such employee; and
- retaliate through discharge or in any other manner against any person alleging a violation of GIPA or participating in any manner in a proceeding under this GIPA.
See 15 ILCS 513/25(c)(1)-(4).
Based on this language, the recent Illinois lawsuits contend that the employers are in violation of GIPA because each “solicits, requests and/or requires an employee to disclose their family medical history” (which assumes that said family medical history includes “the manifestation of a disease or disorder”) as part of the hiring process.
Employer considerations
Because these cases are in their infancy, there are numerous potential defenses that may be available but that have not been tested. For example, one facial defense is that plaintiffs must allege (and later prove) that the employer misused the family medical history (e.g. by an adverse employment action, discrimination, etc.)—i.e., merely inquiring as to an employee’s family medical history, without misusing same, should be insufficient to support a GIPA claim (discussed further, infra).
Relatedly, employers can argue that GIPA is by its nature, a nondiscrimination statute (not a strict liability statute) and as such, the employer must misuse the requested genetic information for plaintiffs to have a viable claim under GIPA.
Second, a second facial defense is that family medical history must include “the manifestation of a disease or disorder in family members.” See 410 ILCS 513/10; see also 45 C.F.R. 160.13. Based on the plain language and the legislative intent of GIPA, employers may argue that merely requesting family medical history during the hiring process may not be violative of GIPA unless there is some discriminatory intent (e.g., as a condition of employment or to affect the terms of employment) relating to a manifestation of a disease or disorder.
Third, GIPA outlines a few exceptions to the request of genetic information, including the following: (1) an employer may use genetic information or genetic testing in furtherance of a workplace wellness program benefiting employees under certain scenarios; (2) GIPA does not prohibit genetic testing of an employee who requests a genetic test and who provides written authorization for the purpose of initiating a workers’ compensation claim under the Workers’ Compensation Act; (3) GIPA does not prohibit genetic testing by an employer that conducts DNA analysis for law enforcement purposes as a forensic laboratory; and (4) GIPA does not prohibit genetic testing by an employer used for genetic monitoring of the biological effects of toxic substances in the workplace (if they meet certain requirements).
These and other potential defenses will need to be tested in the courts.
GIPA, like other privacy statutes, also leaves many questions.
One question for Illinois employers to consider is whether an employee may pursue a claim even if he/she was not adversely affected. In order words, must a GIPA plaintiff have suffered actual damages?
GIPA creates a private right of action and any individual whose genetic information is the subject of the alleged wrongdoing is an “aggrieved” party under GIPA. See Bridges v. Blackstone Grp., Inc., No. 21-CV-1091-DWD, 2022 WL 2643968, at *3 (S.D. Ill. July 8, 2022). Pursuant to GIPA, “any person aggrieved by a violation of this Act shall have a right of action . . . against an offending party.” See 15 ILCS 513/40(a). Employers and defense counsel can expect that plaintiffs will argue that no actual damages are necessary like the Illinois Supreme Court’s decision for the Illinois Biometric Information Privacy Act (BIPA). See Rosenbach v. Six Flags Ent. Corp., 2019 IL 123186, ¶ 30, 129 N.E.3d 1197, 1205.
GIPA also does not include a statute of limitations. Thus, employers can expect that this issue also will be contested and litigated.
It is important for Illinois businesses to address and consider these questions. There are substantial penalties for violating GIPA. The aggrieved party may recover against the offending party (for each violation): (1) liquidated damages of $2,500 or actual damages (whichever is greater) for negligent violations of GIPA; (2) liquidated damages of $15,000 or actual damages (whichever is greater) for intentional[1] and/or reckless violations of GIPA; (3) reasonable attorney’s fees and costs, including expert witness fees and other litigation expenses; and (4) such other relief, including an injunction, as the court deems appropriate. See 410 ILCS 513/40.
While there are no published decisions in Illinois to date dealing with alleged violations of GIPA based on an employer requesting family medical history in the hiring process, there are a few cases based on similar allegations under GINA in various federal courts. See Equal Employment Opportunity Commission v. Horizontal Well Drillers, LLC, CIV-17-879-R (W.D. Okla.); Equal Employment Opportunity Commission v. Dolgencorp, 2:17-cv-01649-MHH (N.D. Ala.); Hawkins v. Jamaica Hospital Medical Center, 16-cv-4265-RRM (E.D.N.Y); Green v. Whataburger Restaurants, LLC, 5:17-CV-243-DAE (W.D. Tex.). In each of these class action cases the cause of action was based on an employer requesting family medical history as part of a medical evaluation in the hiring process. Of relevance here, in the Green case there was a motion to dismiss filed and granted because the alleged family medical history was merely information regarding an employee’s daughter’s surgery due to the “possibility of cancer.” The court held that this was not genetic information because it was not information regarding the “manifestation of a disease or disorder.”
Whether an organization is a healthcare provider, a factory, or any other Illinois employer subject to GIPA, it should review its policies and practices concerning what may be considered genetic testing and genetic information against GIPA’s requirements and consider any further steps to protect against potential company liability.
Nixon Peabody’s employment, healthcare, litigation, and privacy attorneys are studying these recent cases and are available to advise on best practices to avoid or defeat a GIPA claim.
- In the GINA context, to “request, require or purchase” genetic information necessarily involves intentional conduct, not benign conduct that produces an unlawful result as in a disparate impact claim. See EEOC v. Dolgencorp, LLC, 2022 WL 2959569, *18 (N.D. Ala. July 26, 2022).
[back to reference ]
