{"data":{"id":"us-ky/krs-216.2927","jurisdiction":"us-ky","citation":"KRS 216.2927","heading":"Types of data not to be published, released, or subject to inspection --","body":"Public-use data agreements and privacy rules -- Confidentiality of raw data --\nPenalty for violation.\n(1) The following types of data shall be deemed as relating to p ersonal privacy and,\nexcept by court order, shall not be published or otherwise released by the cabinet or\nits staff and shall not be subject to inspection under KRS 61.870 to 61.884:\n(a) Any data, summary of data, correspondence, or notes that identify or  could be\nused to identify any individual patient or member of the general public, unless\nthe identified individual gives written permission to release the data or\ncorrespondence;\n(b) Any correspondence or related notes from or to any employee or employees\nof a provider if the correspondence or notes identify or could be used to\nidentify any individual employee of a provider, unless the corresponding\npersons grant permission to release the correspondence; and\n(c) Data considered by the cabinet to be incompl ete, preliminary, substantially in\nerror, or not representative, the release of which could produce misleading\ninformation.\n(2) Health care providers submitting required data to the cabinet shall not be required\nto obtain individual permission to release the data, except as specified in subsection\n(1) of this section, and, if submission of the data to the cabinet complies with\npertinent administrative regulations promulgated pursuant to KRS Chapter 13A,\nshall not be deemed as having violated any statute or administrative regulation\nprotecting individual privacy.\n(3) (a) No less than sixty (60) days after the annual report or reports are published\nand except as otherwise provided, the cabinet shall make all aggregate data\nwhich does not allow disclosure of th e identity of any individual patient, and\nwhich was obtained for the annual period covered by the reports, available to\nthe public.\n(b) Persons or organizations requesting use of the data shall agree to abide by a\npublic-use data agreement and by HIPAA pri vacy rules referenced in 45\nC.F.R. Part 164. The public-use data agreement shall include, at a minimum, a\nprohibition against the sale or further release of data, and guidelines for the\nuse and analysis of the data released to the public related to provide r quality,\noutcomes, or charges.\n(4) Collection of data about individual patients shall include information commonly\nused to identify an individual for assigning a unique patient identifier. Upon\nassigning a unique patient identifier, all direct identifyin g information shall be\nstripped from the data and shall not be retained by the cabinet or the cabinet's\ndesignee.\n(5) All data and information collected shall be kept in a secure location and under lock\nand key when specifically responsible personnel are absent.\n(6) Only designated cabinet staff shall have access to raw data and information. The\ndesignated staff shall be made aware of their responsibilities to maintain\nconfidentiality. Staff with access to raw data and information shall sign a statement\nindicating that the staff person accepts responsibility to hold that data or identifying\ninformation in confidence and is  aware of penalties under state or federal law for\nbreach of confidentiality. Data which, because of small sample size, breaches the\nconfidence of individual patients, shall not be released.\n(7) Any employee of the cabinet who violates any provision of thi s section shall be\nfined not more than five hundred dollars ($500) for each violation or be confined in\nthe county jail for not more than six (6) months, or both, and shall be removed and\ndisqualified from office or employment.","path":["KRS Chapter 216"],"source_url":"https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=56435","current_through":"Includes enactments through the 2026 Regular Session","vintage":"09/05/2026","retrieved_at":"2026-09-05T20:52:20Z","sha256":"5f231ac840f5dd272cd7a64a8340f8382f5add95d23e64a171f3f7e04c707126","source_id":"us-ky","stale":false,"prev":"us-ky/krs-216.2925","next":"us-ky/krs-216.2929"},"notice":"GroundRules: Original legal text. Not legal advice."}