Illinois Healthcare Compliance.
Illinois has two statutes that put healthcare-adjacent practices in the country's most litigated privacy environment: BIPA for biometrics (fingerprint timeclocks, facial-recognition check-in, voiceprint authentication) and GIPA for genetic information. Both have private rights of action with statutory damages. A medical or dental practice in Illinois has to think about BIPA the moment it deploys any biometric system, regardless of how routine the use case looks.
At a glance
60days
Illinois Personal Information Protection Act (815 ILCS 530) requires notice to affected residents in the most expedient time possible and without unreasonable delay. HIPAA-covered entities and business associates that already notify HHS under 45 CFR 164.408 must also notify the Illinois Attorney General within 5 business days of that HHS notice (815 ILCS 530/50). General AG notice is required if >500 IL residents affected. BIPA biometric obligations operate as a separate, standing duty with statutory damages of $1,000 per negligent and $5,000 per intentional violation.
Illinois Attorney General
- Biometric Information Privacy Act (BIPA)740 ILCS 14
Requires written informed consent before collecting biometric identifiers (fingerprints, retina/iris scans, voiceprints, hand/face geometry). Statutory damages of $1,000 per negligent and $5,000 per intentional violation. Private right of action.
- Genetic Information Privacy Act (GIPA)410 ILCS 513
Restricts use and disclosure of genetic test results by employers, insurers, and others. Private right of action with statutory damages and attorneys' fees.
- Personal Information Protection Act (PIPA)815 ILCS 530
Breach-notification duty; covers medical and health insurance information; AG notice required when >500 residents affected.
- HIPAA Privacy, Security, and Breach Notification Rules45 CFR Parts 160 & 164
The federal baseline that all U.S. covered entities and business associates meet. HHS Office for Civil Rights (OCR) enforces.
How Illinois goes further than HIPAA.
The breach window in Illinois aligns with HIPAA’s 60-day individual-notice deadline. State-law overlays here are mostly about who else gets notified, what the personal- information definition covers, and whether any named statute (CMIA, BIPA, MHMDA, HB 300, 201 CMR 17.00, SHIELD) adds substantive duties. Notice flows through Illinois Attorney General in addition to HHS/OCR federally.
Related compliance guides
Turn this overlay into a defensible SRA.
Illinois's overlay layers on top of HIPAA's federal floor. The free SRA readiness check walks a small practice through discovery, threat model, controls, and gap analysis, then assembles the review-ready binder — policies, training logs, BAAs, and a breach playbook tuned to the 60-day clock and the Illinois Attorney General notification path.
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- ComplianceIllinois Healthcare Compliance: BIPA, GIPA + State Medical Records RulesIllinois BIPA (740 ILCS 14/) and GIPA (410 ILCS 513/) vs HIPAA for medical practices: where the state statutes bite harder, private right of action, and penalty math.
- ComplianceHIPAA Breach Notification: The 60-Day Window Step-by-StepFrom discovery you have 60 calendar days to notify individuals, HHS, and possibly media. Here is the procedure that actually protects the practice.
- RegulationCalifornia Confidentiality of Medical Information Act (CMIA, Cal. Civ. Code 56-56.37)California state law providing broader patient confidentiality protections than HIPAA for medical information held by providers, contractors, and certain employers.
- RegulationColorado Privacy Act (CPA, C.R.S. § 6-1-1301 et seq.)Colorado comprehensive consumer privacy law with consumer rights, controller/processor obligations, universal opt-out mechanism requirement, and an AG enforcement framework with HIPAA carve-outs.
- RegulationConnecticut Data Privacy Act (CTDPA, Public Act 22-15)Connecticut comprehensive consumer data privacy law with consumer rights, controller/processor obligations, and an AG enforcement framework — with substantial healthcare carve-outs.
- RegulationFlorida Information Protection Act (FIPA, Fla. Stat. § 501.171)Florida data breach notification and information security law requiring covered entities to maintain reasonable security and to notify affected individuals and the AG of breaches within 30 days.
- RegulationIllinois Biometric Information Privacy Act (BIPA, 740 ILCS 14)Illinois state law regulating the collection, retention, use, and destruction of biometric identifiers, with a private right of action and statutory damages per violation.
- RegulationMassachusetts 201 CMR 17.00 (Standards for the Protection of Personal Information)Massachusetts data security regulation requiring a written information security program (WISP) protecting personal information of MA residents, with specific technical requirements.
Last reviewed May 23, 2026.
This page is a research aid for compliance teams. It does not certify compliance with any state or federal law, provide legal advice, replace counsel, or guarantee an audit outcome. State statutes are amended frequently — verify citations and links against the cited primary sources before acting. The practice remains responsible for adopting and maintaining its compliance program.