{"data":{"id":"us-ky/krs-214.645","jurisdiction":"us-ky","citation":"KRS 214.645","heading":"Reporting system of HIV -positive persons -- Confidentiality and reporting","body":"requirements -- Reporting system surveillance, assessment, and restrictions.\n(1) The Cabinet for Health and Family Services shall establish a system for reporting,\nby t he use of the person's name, of all persons who test positive for the human\nimmunodeficiency virus (HIV) infection. The reporting shall include the data\nincluding, but not limited to, CD4 count and viral load, and other information that\nare necessary to co mply with the confidentiality and reporting requirements of the\nmost recent edition of the Centers for Disease Control and Prevention's (CDC)\nGuidelines for National Human Immunodeficiency Virus Case Surveillance.\nAnonymous testing shall remain as an alter native. If less restrictive data identifying\nrequirements are identified by the CDC, the cabinet shall evaluate the new\nrequirements for implementation.\n(2) The reporting system established under subsection (1) of this section shall:\n(a) Use the same confi dential name-based approach for HIV surveillance that is\nused for AIDS surveillance by the cabinet;\n(b) Attempt to identify all modes of HIV transmission, unusual clinical or\nvirologic manifestations, and other cases of public health importance;\n(c) Require collection of the names and data from all private and public sources\nof HIV-related testing and care services; and\n(d) Use reporting methods that match the CDC's standards for completeness,\ntimeliness, and accuracy, and follow up, as necessary, with the health care\nprovider or the provider's designee making the report to verify completeness,\ntimeliness, and accuracy.\n(3) Authorized surveillance staff designated by the cabinet shall:\n(a) Match the information from the reporting system to other public healt h\ndatabases, wherever possible, to limit duplication and to better quantify the\nextent of HIV infection in the Commonwealth;\n(b) Conduct a biennial assessment of the HIV and AIDS reporting systems,\nensure that the assessment is available for review by the public and any state\nor federal agency, and forward a copy of the assessment to the Legislative\nResearch Commission and the Interim Joint Committee on Health Services;\n(c) Document the security policies and procedures and ensure their availability\nfor review by the public or any state or federal agency;\n(d) Minimize storage and retention of unnecessary paper or electronic reports and\nensure that related policies are consistent with CDC technical guidelines;\n(e) Ensure that electronic transfer of data is protected by encryption during\ntransfer;\n(f) Provide that records  be stored in a physically secluded area and protected by\ncoded passwords and computer encryption;\n(g) Restrict access to data a minimum number of authorized surveillance staff\nwho are designated by a responsible authorizing official, who have been\ntrained in confidentiality procedures, and who are aware of penalties for\nunauthorized disclosure of surveillance information;\n(h) Require that any other public health program that receives data has\nappropriate security and confidentiality protections and penalties;\n(i) Restrict use of data, from which identifying information has been removed, to\ncabinet-approved research, and require all persons with this use to sign\nconfidentiality statements;\n(j) Prohibit release of any names or any other identifying informatio n that may\nhave been received in a report to any person or organization, whether public\nor private, except in compliance with federal law or consultations with other\nstate surveillance programs and reporting sources. Under no circumstances\nshall a name or any identifying information be reported to the CDC; and\n(k) Immediately investigate any report of breach of reporting, surveillance, or\nconfidentiality policy, report the breach to the CDC, develop\nrecommendations for improvements in security measure, and take appropriate\ndisciplinary action for any documented breach.\n(4) The cabinet shall require any physician, advanced practice registered nurse,\ndesignee, or medical laboratory that receives a report of a positive test for the\nhuman immunodeficiency virus to report that information by reference to the name\nin accordance with the procedure for establishing name reporting required by the\ncabinet in an administrative regulation.","path":["KRS Chapter 214"],"source_url":"https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=53702","current_through":"Includes enactments through the 2026 Regular Session","vintage":"09/05/2026","retrieved_at":"2026-09-05T20:52:18Z","sha256":"7fd1e6aee2a10b226425a7cfcf7e3924063b044ba5a8097d902d03d469d53d89","source_id":"us-ky","stale":false,"prev":"us-ky/krs-214.640","next":"us-ky/krs-214.650"},"notice":"GroundRules: Original legal text. Not legal advice."}