The Illinois Genetic Information Privacy Act, (GIPA)¹ has become one of the plaintiff class action bar’s favorite causes of action. GIPA regulates the collection, use, disclosure, and storage of genetic information. Hundreds of cases have been filed in state and federal courts in Illinois as well as in other states. While GIPA is not extraterritorial, even out of state employers with Illinois based employees are likely subject to GIPA. Like its cousin the Illinois Biometric Information Privacy Act (BIPA)², which regulates biometric information, GIPA provides for a private right of action and for even greater statutory damages for a violation of the Act. GIPA provides that a plaintiff may recover $2,500 or actual damages for a negligent violation of the Act, and $15,000 for an intentional or reckless violation of the Act.³ In addition, GIPA provides for a recovery of attorney’s fees and costs.⁴ GIPA’s provision of statutory damages relieves the plaintiff class action bar from proving damages. In the context of a class action the statutory damages can quickly add up. Ford Motor Company recently agreed to settle a GIPA class action filed against it for $17.5 million.⁵

The majority of recent GIPA class actions filed are against employers and allege that they require their employees or prospective employees to undergo an employment physical examination as a condition of employment, in which the employee or prospective employee is required to disclose their family medical history. Most courts have held that family medical information is genetic information protected by GIPA.⁶ Section 25(c)(1) of GIPA prohibits employers from soliciting, requesting, or requiring the genetic information of a person as a condition of employment or preemployment application.⁷

Many employers contract with third-party medical providers to conduct pre-employment and employment physical exams on their behalf. Recently, Judge Manish S. Shah of the Northern District of Illinois issued a decision on a motion for summary judgment in a GIPA class action suit filed against an employer involving employment physical exams conducted by a  third-party healthcare provider (the Henry decision)⁸. While Judge Shah granted summary judgment for the defendant, he held that if an employer does not affirmatively act to advise a  third-party healthcare provider with whom it contracts to conduct employment physical exams, not to ask employees questions about their family medical history in the exams, the employer might be held liable under GIPA if the third-party healthcare provider asks the employee family medical history questions. Judge Shah held that to avoid liability under GIPA, an employer must take affirmative steps to instruct third-party medical providers not to ask employees about their family medical history. Judge Shah reasoned that in conducting a physical exam:

It is reasonable to assume that a health care provider would ask about family medical history. See Collins, 2025 WL 552465, at *2 n.1 (“This Court tends to agree ... that medical history questions are a common feature of physical exams.”); 29 C.F.R. § 1635.8(a). To treat genetic information in a manner consistent with federal regulations, employers complying with GIPA must take steps to ensure no genetic information is requested. Not telling [the third-party healthcare provider] to elicit genetic information is not enough; the statute requires an affirmative instruction not to elicit it.

[The employer] hired a health care provider to conduct a medical exam, and it is reasonable to assume that a health care provider would ask about family medical history. [The employer] is responsible for indirectly requesting genetic information from Henry during his physical examination.⁹

The plaintiff (Henry) was a staffing agency worker applying to work at the employer’s Illinois facility as a product technician. The employer required contract workers to undergo a medical exam which it called a “medical surveillance.” It contracted with a third-party healthcare provider to conduct the exams. The employer did not direct the third-party healthcare provider to ask family medical history questions in the exams. Nor did it tell the third-party provider not to ask such questions in the exam. The employer had a general medical questionnaire it used as part of the exams that specifically instructed the employee/applicant not to provide any genetic information, including family medical history information when responding to any requests for medical information made by the employer. The medical surveillance Herny was required to undergo included filling out portions of a questionnaire and taking certain tests and undergoing a physical exam. One section of the questionnaire (Section U) did ask about children with birth defects, stillbirths, and premature birth. Henry did not complete Section U of the questionnaire.

Henry alleged that during the physical exam a nurse (employed by the third-party healthcare provider) asked him questions about his family’s medical history of cancer, hepatitis and heart issues. The nurse denied making these inquiries. The employer submitted evidence that it did not ask or request the third-party healthcare provider to ask family medical history questions as part of the exam and that its standard operating procedures for Henry’s position do not instruct the nurse to request family medical history information. The employer submitted evidence that the purpose of a medical surveillance was to prevent a worker with a baseline disease from being exposed to any materials, chemicals, or equipment that may cause them harm, and also to determine whether a worker could perform the essential functions of the assigned position. Even though he did not complete Section U of the medical questionnaire, Henry was allowed to work as a product technician for the employer. 
    
The employer made three arguments in support of its motion for summary judgment. First it argued that it did not request genetic information from Henry – the third-party healthcare provider did. Therefore, the employer argued that it could not be held liable for violating GIPA. As noted above, the court rejected this argument holding the employer did nothing to restrict the third-party healthcare provider conducting the exam from requesting family medical history information and that it had an affirmative obligation to advise the third-party healthcare provider not to do so. Silence was not enough.
    
Second, the employer argued that even if it did request genetic information from Henry, any disclosure was inadvertent and thus excused by the inadvertent disclosure exception under GIPA. Section 25(j) of GIPA provides that ““inadvertently requesting family medical history by an employer ... does not violate this Act.”¹⁰ The employer relied on the regulations for the federal Genetic Information Nondiscrimination Act of 2008 (GINA), upon which GIPA is based, that provide a request is inadvertent if it directs the individual “not to provide genetic information” but still results in genetic information being disclosed in response.¹¹ The employer pointed to the warning contained in the questionnaire provided to Henry as part of the exam that warned him not to disclose genetic information. Judge Shah held that the warning on the questionnaire was not enough to make any verbal request during the physical examination inadvertent as a matter of law. He found that “[I]t is plausible that Henry would view these as separate requests [the questionnaire and the verbal request of the nurse during the exam] and not associate the warning on the medical questionnaire with the verbal request for family medical history.”¹² 
    
The third argument the employer made was that even if a request for genetic information was made to Henry, it was not a condition of his employment, as he was allowed to continue working for the employer after the exam. Section 25(c)(1) of GIPA prohibits employers from soliciting, requesting, or requiring the genetic information of a person as a condition of employment or preemployment application.¹³ The employer argued that there was no dispute that the Henry did not complete Section U of the medical questionnaire, the only part that arguably requested genetic information. Judge Shah held that:

Even if the disclaimer [on the questionnaire warning not to provide genetic information] would not be enough to make any written disclosure inadvertent, there is no dispute that the request for genetic information on the written questionnaire was not a condition of Henry's employment, for the simple fact that Henry did not fill out that section and it did not affect his employment with [the employer]. There is no dispute that Henry did not fill out the only section arguably seeking genetic information. [90] ¶ 28. There is also no dispute that after his medical surveillance, [the employer] did not change Henry's work assignment or his contractor status. [90] ¶¶ 36–37. No reasonable jury could find that the request for genetic information in Section U was a condition of Henry's employment.¹⁴ 

As to the verbal request allegedly made to Henry by the nurse during the exam, Judge Shah held that the testimony that Henry could not decline to complete his medical surveillance does not create a genuine dispute over whether the verbal request was a condition of his employment. Judge Shah found it was undisputed that the employer did not know what verbal questions Henry was asked or what the results or details of the medical surveillance were until this litigation. He found that because the employer’s policy was that an employee or applicant had to complete the medical surveillance to be employed and Henry continued his employment after the medical surveillance, there was no genuine dispute that the employer did not condition Henry’s employment on a request for genetic information. Therefore, Judge Shah granted summary judgment in favor of the employer. 
    
The key takeaway from the Henry decision is that employers using third-party healthcare providers to perform pre-employment or employment physical exams, should include a provision in their contracts with such providers, stating that the provider is not to ask any family medical history questions or otherwise request genetic information when conducting exams. Ideally the third-party provider would execute a document, agreeing it will not do so and agree to indemnify the employer if it does. The Henry decision demonstrates that silence may not be enough to shield the employer from liability under GIPA. While at this point, the Henry decision is not binding authority on any other court, it should serve as a warning that employers should affirmatively act to advise  third-party healthcare providers that are conducting employment physical examinations on their behalf, that they are not to ask employees or applicants family medical history questions or any other question that would require the employee or applicant to disclose genetic information.

^{[1] 410 ILCS 513/1 et seq. (2026)
[2] Illinois Biometric Information Privacy Act (“BIPA”), 740 ILCS 14/1 et seq. (2026). 
[3] 410 ILCS 513/40 (a)(1) & (2) (2026). 
[4] 410 ILCS 513/40 (a)(3) (2026). 
[5] Page et al, v. Ford Motor Company, No. 2024LA000148 (Sangamon County, IL) final approval 1/29/25.
[6] See e.g. McKnight v, United Airlines, No. 23 CV 16118, 2024 WL 3426807 at *2-3 (N.D. Ill. Sept. 16, 2024). 
[7] 410 ILCS 513/25(c)(1).
[8] Henry v. AbbVie, No. 23 CV 16830, 2026 WL 788630 (N.D. Ill., Mar. 20, 2026)
[9] Id. 2026 WL 788630 at *5.  
[10] 410 ILCS 513/25(j) (2026). 
[11] 29 C.F.R. § 1635.8(b)(1)(i)(A).
[12] Henry, 2026 WL 788630 at *6. 
[13] 410 ILCS 513/25(c)(1).
[14] Henry, 2026 WL 788630 at *6.}

This publication is intended for general information purposes only and does not and is not intended to constitute legal advice. The reader should consult with legal counsel to determine how laws or decisions discussed herein apply to the reader's specific circumstances.