Law / United States / 
Kentucky
Kentucky health care data reporting, patient identifiers stripped and aggregate data only released
In force since .
A de-identification rule binding public and private bodies.
- Obligation class
- Prohibition, Disclosure
- Audit expectation
- none
What it requires
- If you are the Cabinet for Health and Family Services, a state agency, or its designee, once you assign a unique patient identifier to patient data collected under KRS 216.2920 to 216.2929, strip all direct identifying information from the data and do not retain it (KRS 216.2927(4)).
- If you are the Cabinet for Health and Family Services, a state agency, make available to the public only aggregate data that does not allow disclosure of the identity of any individual patient, and do not release data that, because of small sample size, breaches the confidence of individual patients (KRS 216.2927(3)(a) and (6)).
- If you request the aggregate health care data the Cabinet for Health and Family Services holds, agree to a public-use data agreement that prohibits the sale or further release of the data, and to the Health Insurance Portability and Accountability Act (HIPAA) privacy rules referenced in 45 C.F.R. Part 164 (KRS 216.2927(3)(b)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
KRS 216.2927 requires patient identifiers to be stripped and bars release of identifying data. It requires no log of the stripping and gives no body a power to inspect one.
- Kind
- None
- As of
What this law does
KRS 216.2927(4) requires the Cabinet for Health and Family Services, once it assigns a unique patient identifier to the patient data it collects, to strip all direct identifying information from the data and not to retain it. KRS 216.2927(3)(a) requires the cabinet to make available to the public only aggregate data that does not allow disclosure of the identity of any individual patient.
KRS 216.2927(6) bars the cabinet from releasing data that, because of small sample size, breaches the confidence of individual patients. KRS 216.2927(3)(b) requires every person requesting the aggregate data to agree to a public-use data agreement that prohibits the sale or further release of the data. KRS 216.2927(7) fines a cabinet employee who violates the section not more than $500 for each violation, or confines the employee in the county jail for not more than six months, or both. KRS 216.2927 took effect on .
When LexLint raises it
When your app profile says your app processes personal data, processes de-identified data or handles health records.
Back to the example · Lint your app
Page updated .