Duty LXD-1121
Processes de-identified data, in Kentucky
Kentucky health care data reporting, patient identifiers stripped and aggregate data only releasedsince 3 lines
KRS 216.2927 · Read the law's page
- If you are the Cabinet for Health and Family Services, a state agency, or its designee, once you assign a unique patient identifier to patient data collected under KRS 216.2920 to 216.2929, strip all direct identifying information from the data and do not retain it (KRS 216.2927(4)).when it serves a public body
- If you are the Cabinet for Health and Family Services, a state agency, make available to the public only aggregate data that does not allow disclosure of the identity of any individual patient, and do not release data that, because of small sample size, breaches the confidence of individual patients (KRS 216.2927(3)(a) and (6)).when it serves a public body
- If you request the aggregate health care data the Cabinet for Health and Family Services holds, agree to a public-use data agreement that prohibits the sale or further release of the data, and to the HIPAA privacy rules referenced in 45 C.F.R. Part 164 (KRS 216.2927(3)(b)).
Kentucky Consumer Data Protection Act, de-identified and pseudonymous datasince 4 lines
KRS 367.3623 · Read the law's page
- Take reasonable measures to ensure that de-identified data you hold cannot be associated with a natural person (KRS 367.3623(1)(a)).
- Publicly commit to maintaining and using de-identified data without attempting to re-identify it (KRS 367.3623(1)(b)).
- Contractually obligate every recipient of the de-identified data to comply with all provisions of KRS 367.3611 to 367.3629 (KRS 367.3623(1)(c)).
- When you disclose pseudonymous data or de-identified data, exercise reasonable oversight to monitor compliance with the contractual commitments it is subject to, and take appropriate steps to address any breach of those commitments (KRS 367.3623(5)).