Illinois adds three important layers to HIPAA: a breach law with a fast attorney general deadline for HIPAA entities, the Biometric Information Privacy Act (BIPA), which lets people sue, and strict confidentiality rules for mental health records.
AT A GLANCE
| Laws | Personal Information Protection Act, 815 ILCS 530; Biometric Information Privacy Act, 740 ILCS 14; Mental Health and Developmental Disabilities Confidentiality Act, 740 ILCS 110 |
|---|---|
| Data covered | Includes medical history, condition, treatment and diagnosis, and health insurance information |
| Notice to individuals | In the most expedient time possible and without unreasonable delay |
| Attorney general | Required for more than 500 Illinois residents, no later than when individuals are notified. HIPAA entities that report a breach to HHS must also notify the Illinois attorney general within 5 business days |
| BIPA | Written consent and a published retention policy are required before collecting fingerprints, face scans or other biometrics. People can sue for $1,000 per negligent violation or $5,000 per reckless or intentional violation |
| Mental health records | Records and even the fact that someone is a patient are confidential, and patients can sue directly for violations |
02
HOW WE HELP
HIPAA risk assessment
The documented risk analysis HIPAA requires, the foundation for every state law too.
Learn more →Incident response planning
Know who to notify, and by when, before a breach happens.
Learn more →HIPAA compliance program
Policies and procedures that cover both HIPAA and your state requirements.
Learn more →FAQ
Yes. If you report a breach to HHS, you must also notify the Illinois attorney general within 5 business days.
It can. Biometrics collected for treatment, payment or health care operations may be excluded, but uses like fingerprint time clocks for staff payroll likely are not. Get written consent and publish a retention policy.
$1,000 per negligent violation and $5,000 per reckless or intentional violation, plus attorney fees.
Sources: Constangy: Illinois summary · King and Spalding: BIPA reform · Morgan Lewis: Mosby v. Ingalls. This page is general information about the law as of November 2026, not legal advice. Statutes change, so confirm current requirements with your attorney.
Start with the free HIPAA risk assessment, or ask us about BIPA and biometrics.
