That Job Form Asked About Your Mom's Health. In Illinois, That's a $15,000 Question.

A nurse in Chicago fills out a pre-employment health form. One question asks if anyone in her immediate family has ever had heart disease, diabetes, or cancer. She answers honestly, because that's what you do on a job application, right? She has no idea that question alone might be illegal for her employer to ask — and that answering it could hand her a lawsuit-sized paycheck years later.

Here's the thing nobody tells you when you're filling out a new-hire packet: your family's medical history isn't just "personal information." In Illinois, it's legally protected genetic information — meaning it counts as health data about your DNA and your relatives, even if no lab ever touched a test tube. And a law most people have never heard of, called GIPA (the Genetic Information Privacy Act), says your employer isn't allowed to ask for it. Not on a job application. Not during a physical. Not through a wellness survey that seems totally harmless.

The Law Nobody Read Until Now

GIPA has been sitting on the books in Illinois since the late 1990s, quietly doing nothing while everyone focused on its flashier cousin, BIPA — the law that made companies pay out over fingerprints, face scans, and voiceprints. BIPA turned into a legal gold rush. Employers got hit with class-action lawsuits for using fingerprint time clocks without proper written consent. Some of those settlements ran into the hundreds of millions. This article is part of a series — start with Biometric Binding Id Verification Explained.

Now, according to JD Supra, plaintiffs' lawyers appear to be looking at GIPA the same way they once looked at BIPA: a law with real teeth that almost nobody is following correctly. And healthcare employers — hospitals, clinics, home health agencies, anyone running pre-employment physicals or wellness programs — are squarely in the crosshairs, because their hiring paperwork almost always brushes up against family medical history.

Let that number sink in for a second. Fifteen thousand dollars — per violation, not per lawsuit. If a company asks the same illegal question on a standard intake form used across 200 new hires, that's not one mistake. That's potentially 200 separate violations. Even the "we didn't mean to" version of breaking the law — what the statute calls a negligent violation — still costs $2,500 a pop. Multiply either number by a class of employees, and you understand exactly why lawyers are suddenly very interested in a law that's been gathering dust for 25 years.

GIPA allows for statutory damages of $2,500 per negligent violation and $15,000 per intentional or reckless violation — a damages structure that closely mirrors the one that fueled Illinois's biometric privacy litigation boom. — reported by JD Supra

Why This Law Even Exists — And Why It's Backfiring

Here's the part that actually made me sit up. GIPA wasn't written to punish employers for being nosy. It was written to protect you — specifically, to make sure people would feel safe getting genetic testing done without worrying it would cost them a job. Back when the law passed, lawmakers worried that if employers could see a genetic test showing someone was at higher risk for, say, breast cancer or Huntington's disease, they'd quietly discriminate in hiring or promotions. So the law drew a hard line: employers can't ask, can't request, and can't use that information as a condition of employment — full stop.

The irony is almost too perfect. The exact tool meant to make people feel safe getting tested is now the thing catching employers off guard, because standard hiring paperwork and workplace wellness programs quietly do the thing the law was built to prevent. A form asking "does a family member have a history of diabetes?" sounds like basic due diligence to an HR department. Legally, it's the exact question GIPA exists to ban. Previously in this series: Ticketmaster Face Data Retention Explained.

And here's a detail that should worry any employer who thinks a third-party doctor's office is a shield: it isn't. If an outside clinic conducts your pre-employment physical and asks about family history on the employer's behalf, the employer can still be on the hook. Handing the awkward question to someone else doesn't make it not your problem.

Is GIPA the New BIPA? Kind Of — And That's the Point

People keep asking whether GIPA is "the next BIPA," and honestly, the comparison is more useful than it first sounds. Both laws share the same DNA, so to speak: both are Illinois laws, both let individual workers sue directly instead of waiting for a government agency to act (lawyers call this a private right of action — it just means you personally can take your employer to court, not just file a complaint and hope), and both punish violations automatically, without requiring proof that anyone was actually harmed. That last part matters. You don't need to show the employer used your family's cancer history to deny you a promotion. You just need to show they asked for it, or stored it insecurely, in the first place.

That's a very different standard than the federal version of this law, called GINA, which is narrower and harder to win under. GIPA goes further, covers more, and gives Illinois workers a sharper sword. If you've ever wondered whether a company quietly collecting your health details could actually come back to bite them — this is the answer. Yes. And it might already be sitting in a filing cabinet or a cloud folder somewhere, waiting for someone to notice.

If you want one thing to actually watch for: next time you fill out a pre-employment physical or a "voluntary" wellness survey at work, notice whether it asks about anyone besides you. Your own symptoms, your own diagnoses — that's one thing. A question about your parents, siblings, or children's health history is a different animal entirely, and in Illinois, it's a question your employer probably shouldn't be asking at all. That single distinction — you versus your family — is the line the whole law is built around. Up next: Your Real Id Can Still Be Used To Steal 47 Billion Heres The.

What Employers Are Being Told to Do About It

The compliance advice going around right now boils down to five moves: audit every application and intake form for hidden family-history questions, strip those questions out entirely, rework wellness programs so they don't collect data they don't need, train HR staff and outside medical providers who conduct physicals on the company's behalf, and keep records proving the company actually did all of the above. None of that is complicated. What's striking is that it took a wave of lawsuits to get healthcare employers — companies that live and breathe medical privacy rules every single day — to actually look at their own hiring paperwork.

What gets me about this story isn't the lawsuits or the dollar figures. It's the gap between how routine these forms feel and how serious the law says they actually are. Nobody filling out a hiring packet thinks twice about a box asking "any family history of illness?" It reads like small talk. Legally, in Illinois, it reads like a $15,000 mistake waiting for someone to notice. The real question isn't whether GIPA becomes the next BIPA. It's how many hiring forms, sitting in HR drawers right now, are already breaking a law nobody bothered to read.