Most Illinois employers have heard of BIPA by now. The biometric privacy lawsuits ran for years, they generated headlines, and the $1,000 to $5,000 per-violation damages schedule forced companies to take the statute seriously.
GIPA is different. It's older, far less litigated, and the damages are three times higher. And unlike BIPA, which required employers to adopt a new collection practice to create exposure, GIPA can be triggered by something as routine as the form an occupational medicine clinic hands a job applicant before a pre-employment physical.
Most employers generating GIPA exposure right now don't know it.
What GIPA actually is
The Illinois Genetic Information Privacy Act, 410 ILCS 513, prohibits employers from requesting, requiring, purchasing, or otherwise obtaining genetic information from employees or applicants in connection with any employment decision. That covers hiring, firing, promotion, compensation, and job assignments.
The statute sounds like it's targeting employers who want DNA test results before they'll make an offer. And it does cover that. But the definition of "genetic information" extends well beyond anything involving an actual genetic test.
Genetic information under GIPA includes information about the manifestation of a disease or disorder in an individual's family members. In plain English: family medical history. A form that asks whether an applicant's parents or siblings have ever been diagnosed with heart disease, cancer, or diabetes is collecting genetic information under the statute's definition.
That's where the exposure lives. Not in cutting-edge genetics. In the standard family history checklist that's been part of occupational medicine intake forms for decades.
The physical form that's already a violation
Pre-employment physicals are routine for employers in manufacturing, warehousing, construction, transportation, and healthcare. The logic is sound from a safety perspective. Certain jobs are physically demanding, certain conditions create occupational risk, and employers have a legitimate interest in knowing whether candidates can safely perform essential functions.
Occupational medicine clinics manage those physicals. And the intake forms those clinics use almost universally include a family history section. A standard form might ask:
- Has anyone in your immediate family been diagnosed with heart disease or stroke?
- Is there a family history of cancer, diabetes, or high blood pressure?
- Has any first-degree relative been treated for a chronic illness?
Those questions collect exactly what GIPA prohibits. And here's the part that trips up most employers: the employer doesn't have to use the answers to create a violation. They don't have to deny a job based on a family history of cancer. They don't have to make any decision that's influenced by the genetic information at all.
The act of requesting or requiring the information is the violation. It occurs the moment the form is handed to the applicant.
An employer can make a completely good-faith, non-discriminatory hire and still face a GIPA claim. The argument "we never looked at the family history answers" isn't a defense to the request that produced them.
The damages that make this different from BIPA
BIPA litigation is expensive. But when people say GIPA is the statute they should have been worried about too, the damages schedule is the reason.
BIPA: $1,000 per negligent violation, $5,000 per intentional or reckless violation, plus attorney's fees and costs.
GIPA: $2,500 per negligent violation, $15,000 per intentional or reckless violation, plus attorney's fees and costs.
Same structure. Three times the numbers.
Now run through the math on a real scenario. A DuPage County manufacturer with 300 employees has been running new hires through an occupational medicine clinic for the past five years. The clinic's standard form includes a family history section. Over those five years, say 250 applicants completed the form.
If a plaintiff's attorney files a class action and argues intentional violation, because the employer has been using a non-compliant form for years without correcting it, the damages exposure is $15,000 multiplied by 250 people. That's $3.75 million before any attorney's fees.
Class certification doesn't always happen. Settlements come in well below maximum statutory exposure. Courts may find particular defenses compelling. But that $3.75 million is the number a plaintiff's attorney is working from when they decide whether to file.
And that's a mid-size employer. A Chicagoland staffing firm placing hundreds of candidates a year, all of whom go through standard physicals, faces a much larger class.
Why the plaintiff's bar is paying attention now
GIPA existed for years without significant litigation. The statute was on the books, the private right of action was there, but the cases didn't materialize at scale.
Two things changed that dynamic. The first is the plaintiff-side bar that BIPA built.
Illinois BIPA litigation created a group of plaintiff's attorneys who specialize in state privacy class actions. They know how to build class cases around statutory violations, how to certify a class of employees who all received the same non-compliant form, and how to handle the damages-per-violation structure that doesn't require proof of individual harm. That's exactly the structure GIPA uses too. The attorneys who spent years on BIPA are now looking at GIPA with a trained eye.
The second is that GIPA, like BIPA, doesn't require proof that anyone was actually harmed. A plaintiff doesn't have to show that they were denied a job because of their family medical history. The violation is the request itself. That makes class certification more tractable. Every applicant who received a non-compliant physical form is potentially a class member, regardless of whether they were hired or what happened after.
Illinois courts have been the most active jurisdiction in the country for state privacy class actions. That's not a coincidence. The plaintiff's bar developed here because the statutes exist here, and the damages are high enough to make the cases worthwhile.
Which employers face the most exposure
Not every Illinois employer runs pre-employment physicals. But the ones who do tend to operate at scale, which is exactly what produces large class sizes.
Manufacturers in DuPage County, Lake County, and Will County. Warehouses and distribution centers. Construction contractors. Healthcare employers who require physicals for patient-facing roles. Transportation companies with DOT-adjacent physical requirements. Any employer who hires in volume and routes new hires through a standard occupational medicine program.
The form itself probably isn't one that the employer's HR team designed. It's the clinic's form. That matters less legally than most employers expect. Under GIPA, the prohibition extends to any person who requests, requires, causes to be obtained, or purchases genetic information in connection with employment. Directing a candidate to complete a clinic's intake process that includes family history questions brings the employer within that language.
Whether you designed the form or just used the clinic that uses the form, the request runs through your employment process. You're in scope.
The coverage problem
This is where GIPA moves from a compliance issue to an insurance problem, and where the situation for employers is genuinely unresolved.
BIPA created enough litigation that insurers eventually responded. Some carriers added explicit BIPA exclusions to limit exposure. Others built specific coverage endorsements for it. Brokers developed working knowledge of which forms respond to BIPA claims and which don't. There's now a body of case law and underwriting practice around it.
GIPA has almost none of that. There's essentially no published guidance from carriers on how standard commercial lines policies respond to GIPA claims. There's no GIPA-specific endorsement product on the market. Most brokers haven't had to develop fluency in GIPA coverage because the claims volume is newer.
The forms that might naturally respond are employment practices liability (EPLI) and privacy liability. EPLI covers wrongful employment acts, which typically includes failure to comply with state and federal employment laws. A GIPA violation involves both employment and privacy. Depending on how the policy form is drafted, EPLI could respond.
But there's a complication. Many EPLI policies have sublimits or exclusions for statutory penalties or for specific state privacy statutes. Carriers started adding those restrictions after BIPA generated claims they weren't pricing for. A policy written before the BIPA litigation wave hit may have more coverage than a policy written or renewed in the past few years, not less.
Privacy liability and cyber policies cover violations of privacy laws. GIPA is a state privacy statute. Whether a specific policy responds depends on how "privacy law" is defined in the form, whether there are exclusions for genetic information specifically, and whether the claims trigger matches the way a GIPA claim is structured. Those are fact-specific questions that require reading the actual policy language, not relying on a general summary from your broker.
The honest situation is this: most Illinois employers with GIPA exposure don't know whether their policies cover it, and most of their brokers haven't analyzed it specifically for GIPA. The statute doesn't appear in most commercial underwriting questionnaires. It isn't mentioned in most EPLI renewal reviews. And because there hasn't been the volume of filed cases that BIPA generated, it hasn't forced that conversation yet.
That's changing. And the companies that wait for the claims volume to arrive before reviewing their coverage will be in the same position BIPA defendants were when they opened their policies and found exclusions that had been sitting there for two years.
The historical exposure question
One thing employers want to know once they understand GIPA is how far back the exposure goes. That's a question for employment counsel, not a broker, but it's relevant to how companies should think about their current program.
GIPA violations that occurred in prior years don't disappear when you update the form going forward. If your occupational medicine clinic used a family history checklist during physicals conducted three years ago, those claims may still be within the applicable limitations period. Updating the form prospectively fixes the future exposure. It doesn't remediate the past.
That makes the question of how you handle historical records important. Retaining the original intake forms documents the family history requests. Talk to employment counsel before making any decisions about records related to prior physicals. What you do with that documentation matters and it's not a decision to make unilaterally.
What Illinois employers should do now
First, get the actual intake form your occupational medicine clinic uses. Not a summary of what it covers. The form itself. Review whether it contains any questions about family members' health history, diagnoses, or medical conditions. If it does, work with the clinic to remove that section before the next physical.
Second, put your instruction to the clinic in writing. Make it explicit that no family history questions are to be included in any intake form used for applicants or employees. Document that you reviewed the form and identified the non-compliant section. Keep that documentation.
Third, ask your broker specifically about GIPA coverage. Not "does our EPLI respond to employment claims" but directly: "Does our EPLI policy cover claims under the Illinois Genetic Information Privacy Act, and have you reviewed the policy for any exclusions that might apply to genetic privacy statute violations?" If your broker hasn't thought about this, that's useful information.
Fourth, if your company has been running family history questions for several years, talk to employment counsel before doing anything with historical records. The prospective compliance fix is straightforward. The historical exposure requires a more careful approach.
GIPA doesn't require discrimination to create liability. It doesn't require harm. It requires a request for genetic information in an employment context. If your physical intake forms have included family history questions, the exposure is already there. The coverage question is separate and largely unanswered in current policy forms.
If you're an Illinois employer with questions about how your EPLI or commercial liability program addresses GIPA exposure, reach out to Jack Ray directly. He handles commercial accounts across DuPage County, the Chicago suburbs, and the broader Illinois market and can review your current program for this specific gap.
Email: jray@lakeshoreriskadvisors.com