SCOPE
This Biometric Data Policy (the “Policy”) applies to the following entities: Memorial Health System, Memorial Medical Center, d/b/a Springfield Memorial Hospital, Decatur Memorial Hospital, Taylorville Memorial Hospital, The Abraham Lincoln Memorial Hospital, d/b/a Lincoln Memorial Hospital, The Passavant Memorial Area Hospital Association, d/b/a Jacksonville Memorial Hospital, Memorial Physician Services, d/b/a Memorial Medical Group, Memorial Home Services, NFP, d/b/a Memorial Home Care, (hereinafter all entities set forth above are collectively referred to as “MH”).
OBJECTIVE
MH may use biometric data (as defined below) for identity verification and pre-employment background screening purposes. This Policy sets forth MH’s policy for the collection, use, safeguarding, storage, retention and destruction of biometric data.
POLICY
Definitions
Biometric Identifier means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. Biometric identifiers do not include writing samples, written signatures, photographs, human biological samples used for valid scientific testing or screening, demographic data, tattoo descriptions, or physical descriptions such as height, weight, hair color, or eye color. Biometric identifiers do not include donated organs, tissues, or parts as defined in the Illinois Anatomical Gift Act or blood or serum stored on behalf of recipients or potential recipients of living or cadaveric transplants and obtained or stored by a federally designated organ procurement agency. Biometric identifiers do not include biological materials regulated under the Genetic Information Privacy Act. Biometric identifiers do not include information captured from a patient in a health care setting or information of a patient or employee collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996. Biometric identifiers do not include an X-ray, roentgen process, computed tomography, MRI, PET scan, mammography, or other image or film of the human anatomy used to diagnose, prognose, or treat an illness or other medical condition or to further validate scientific testing or screening.
Biometric Information means any information, regardless of how it is captured, converted, stored, or shared, based on an individuals’ biometric identifier used to identify any individual. Biometric information does not include information derived from items or procedures excluded under the definition of biometric identifiers.
Purpose for Collection of Biometric Data
MH on its own and/or through its vendors may collect, possess, store, use, and/or disclose biometric data solely for: (i) identity verification and authentication purposes; and (ii) pre-employment background screening purposes.
Authorization
Prior to collecting, possessing, storing, or using biometric data, MH will first:
- Inform the colleague in writing that MH and/or its vendors are collecting or storing the colleague or contractor’s biometric data;
- Inform the colleague in writing of the specific purpose and length of time for which the colleague biometric data is being collected, stored, and used; and
- Receive a written release signed by the colleague authorizing MH and its vendors or licensors to collect, store and use biometric data for the specific reasons set forth in the written release.
Disclosure
MH will not disclose, re-disclose or otherwise disseminate any biometric data unless:
- The colleague or contractor consents to the disclosure or dissemination;
- Disclosure or re-disclosure completes a financial transaction requested or authorized by the colleague or contractor;
- Disclosure or re-disclosure is required by State or federal law or municipal ordinance; or
- Disclosure is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction.
MH will not knowingly sell, lease, trade, or otherwise profit from a colleague or contractor’s biometric data.
Retention Schedule
MH will retain colleague or contractor biometric data, if it is retained at all, until the first of the following options occurs:
- The initial purpose for collecting or obtaining the biometric data has been satisfied, such as the termination of the colleague’s employment with MH, the colleague’s transfer to a role within MH for which the biometric data is not used, the termination of the contractual relationship with MH, or MH no longer using biometric data for the purposes described above; or
- Within 3 years of the colleague or contractor’s last interaction with MH.
Data Storage
MH shall maintain reasonable physical, administrative and technical safeguards to store, transmit, and protect from disclosure any biometric data collected, stored or retained. Such storage, transmission, and protection from disclosure shall be performed in a manner that is the same or more protective than the manner MH transmits, stores, and protects from disclosure other confidential and sensitive information, including personal information that can be used to uniquely identify an individual or an individual’s account or property, such as genetic markers, genetic testing confirmation, account numbers, PINs, driver’s license numbers and social security numbers.