KRS 393A.830: Security breach.

(1) Except to the extent prohibited by law other than this chapter, the administrator or

administrator's agent shall notify a holder as soon as practicable of:

(a) A suspected loss, misuse or unauthorized access, disclosure, modification, or

destruction of con fidential information obtained from the holder in the

possession of the administrator or an administrator's agent; and

(b) Any interference with operations in any system hosting or housing

confidential information which:

1. Compromises the security, confid entiality, or integrity of the

information; or

2. Creates a substantial risk of identity fraud or theft.

(2) Except as necessary to inform an insurer, attorney, investigator, or others as

required by law, the administrator and an administrator's agent sha ll not disclose,

without the express consent in a record of the holder, an event described in

subsection (1) of this section to a person whose confidential information was

supplied by the holder.

(3) If an event described in subsection (1) of this section occurs, the administrator and

the administrator's agent shall:

(a) Take action necessary for the holder to understand and minimize the effect of

the event and determine its scope; and

(b) Cooperate with the holder with respect to:

1. Any notification requi red by law concerning a data or other security

breach; and

2. A regulatory inquiry, litigation, or similar action.