Handles health records, in Kentucky

KRS 214.625, 214.995 · Read the law's page

• Do not perform a test designed to identify the human immunodeficiency virus, or its antigen or antibody, without first obtaining the informed consent of the person tested, except where a signed general consent form covers the test or in an emergency in which informed consent cannot reasonably be obtained (KRS 214.625(2), (3) and (5)(a)).
• Do not determine a test result to be positive, or reveal a positive result to any person, without corroborating or confirmatory tests (KRS 214.625(5)(b)).
• If you have obtained or have knowledge of a test result, do not disclose the identity of the person tested, or the results in a manner that permits identification of the subject, except to a person KRS 214.625(5)(c) lists.
• When you disclose test results under subsection (5), accompany the disclosure with the written statement the subsection prescribes (for an oral disclosure, an oral notice followed by a written notice within ten days), and if test results have been disclosed to you, do not disclose them to another person except as the subsection authorizes (KRS 214.625(5)).
• Do not use the result of a serologic test conducted under the auspices of the Cabinet for Health and Family Services to determine whether a person may be insured for disability, health or life insurance, or to screen or determine suitability for, or to discharge a person from, employment (KRS 214.625(6)(d)).

KRS 216.2927 · Read the law's page

• If you are the Cabinet for Health and Family Services, a state agency, or its designee, once you assign a unique patient identifier to patient data collected under KRS 216.2920 to 216.2929, strip all direct identifying information from the data and do not retain it (KRS 216.2927(4)).when it serves a public body
• If you are the Cabinet for Health and Family Services, a state agency, make available to the public only aggregate data that does not allow disclosure of the identity of any individual patient, and do not release data that, because of small sample size, breaches the confidence of individual patients (KRS 216.2927(3)(a) and (6)).when it serves a public body
• If you request the aggregate health care data the Cabinet for Health and Family Services holds, agree to a public-use data agreement that prohibits the sale or further release of the data, and to the HIPAA privacy rules referenced in 45 C.F.R. Part 164 (KRS 216.2927(3)(b)).

KRS 422.317 · Read the law's page

• If you are a hospital licensed under KRS Chapter 216B or a health care provider, give a patient a copy of the patient's medical record, without charge, upon the patient's written request (KRS 422.317(1)).
• You may charge no more than one dollar per page for a second copy requested by the patient, the patient's attorney or the patient's authorized representative (KRS 422.317(1)).

KRS 304.17A-555 · Read the law's page

• If you are an insurer, request from a provider only such limited information from a patient's record as is necessary for determining covered services and benefits, medical necessity, appropriateness and quality of care for authorization or continuation of mental health and chemical dependency services, or for payment for those services (KRS 304.17A-555(1)).
• If a provider discloses a patient's records to you, do not redisclose or otherwise reveal the patient's mental health and chemical dependency records beyond the purpose for which the disclosure was made without first obtaining the patient's specific written consent to the redisclosure (KRS 304.17A-555(2)).