Palm Vein Check‑In Is ComingWho Governs It?

Hospitals are starting to identify patients by the veins in their palm or by a fingerprint instead of by name and date of birth. The reason is a stubborn problem: matching patients to the right chart. The Office of the National Coordinator for Health IT found that error rates inside a single organization typically run 10 to 20 percent, and climb to 50 or 60 percent when organizations exchange records. Duplicate and mixed-up charts mean repeated tests, delayed care and billing errors.

Biometrics fix much of that. They also add something hospitals have rarely governed before: a credential that can't be reissued. A stolen password gets reset. A stolen palm print doesn't.

The exemption trap

Most teams assume HIPAA settles the question. It doesn't, quite. State laws treat healthcare very differently, and the exemptions are narrower than they look.

• California. There is no biometric privacy statute like Illinois's, and that is not a pass. A template that opens a patient's chart is medical information under the Confidentiality of Medical Information Act, which patients can enforce in court. Licensed hospitals and clinics must report unauthorized access to medical information to CDPH and the patient within 15 business days, with penalties up to $25,000 per patient. The breach law covers "unique biometric data." And a for-profit provider holding patient biometric data outside the medical record should check whether the CCPA reaches it.
• Illinois. The Biometric Information Privacy Act excludes information captured from a patient in a health care setting, and information collected for treatment, payment or operations under HIPAA. In 2023 the Illinois Supreme Court read that broadly, covering nurses' finger scans at medication cabinets (Mosby v. Ingalls Memorial Hospital). Patient check-in likely sits inside the exemption. A 2024 amendment now counts repeated scans of the same person as one violation and accepts electronic signatures as written consent.
• Texas. The Capture or Use of Biometric Identifier Act has no HIPAA exemption. It requires notice and consent before capturing a biometric identifier for a commercial purpose, a term the law doesn't define, and destruction within a year after the purpose ends. Only the Attorney General enforces it, at up to $25,000 per violation. In 2024 Meta paid $1.4 billion to settle the state's case.
• Washington. The My Health My Data Act treats biometric data as consumer health data and lets individuals sue. Protected health information under HIPAA is exempt, but a vendor that uses the data outside its business associate agreement is not.
• Colorado. Since July 1, 2025, the Colorado Privacy Act requires a written biometric policy, a retention schedule, a breach protocol, and notice and consent. Protected health information held by covered entities is exempt, but data outside that exemption, such as a vendor's own uses, is not.

Federal rules sit underneath all of this. HIPAA lists "biometric identifiers, including finger and voice prints" among the identifiers that make data protected health information, so a template linked to a chart falls under the Security Rule, business associate agreements and breach notification. And the Federal Trade Commission's 2023 policy statement on biometrics warns against unsupported accuracy claims and against collecting biometrics without first assessing the foreseeable harms.

Six controls that work in every state

Rather than tailoring a program to each state's exemption, build one program that would hold up under the strictest of them. For a California hospital, that also means a reporting path that can meet the 15-business-day clock.

1. Notice and a real choice. Tell patients what is collected, why, how long it's kept and who sees it, even where the law doesn't require it. A patient who declines is checked in with photo ID, with no delay to care.
2. The strictest state wins. A patient who lives in one state and is seen in another gets the stricter notice and retention rule.
3. Templates, never images. Store only an encrypted template, keyed to your organization so it can't be replayed elsewhere, with a way to revoke it and re-enroll the patient after a breach.
4. Every access logged. Record enrollment, each match and each lookup, and review the log the way you review EHR access.
5. Retention with a clock. Write down when templates are destroyed (withdrawal, inactivity, end of purpose), confirm each destruction and record it. Texas's one-year limit is a sensible default everywhere.
6. Vendor terms that match. A business associate agreement, no secondary use or model training, where the data lives, notice of a breach, and a certificate of destruction when the contract ends.

One more question belongs on the list: how well does the matching work for your patients? Ask the vendor for accuracy results across ages, skin tones and conditions such as worn fingerprints, test it at your own registration desks, and keep a human review step for low-confidence matches. Never merge charts on a biometric match alone.

And measure the result. Hospitals adopt biometrics to fix patient matching, so record your duplicate record, overlay and misidentification rates before rollout, then compare them during a pilot at one site.