Health Information Technology

The Kentucky Consumer Data Protection Act Goes into Effect on January 1, 2026: Is Your Business Ready?

Wyatt Health Information Technology
by Margaret Young Levi

Kentucky’s new privacy law, the Kentucky Consumer Data Protection Act (KCDPA), will afford Kentucky consumers certain rights over their personal data. Importantly, the KCDPA imposes new requirements on certain businesses that either control or process personal data, called “controllers” and “processers.”  The KCDPA was signed into law on April 4, 2024, and goes into effect on January 1, 2026. It is codified at KRS 367.3611 to KRS 367.3629.  The KCDPA’s approximate 21-month lead time before its effective date allowed businesses who are “controllers” to bring consumer data collection and processing practices in line with the law’s requirements.  Businesses who have not yet reviewed the KCDPA should do so immediately to determine whether the law applies to them and, if so, what actions they need to take to comply.

PROTECTED PERSONAL DATA

The KCDPA creates protections for “personal data,” which means information that is linked, or reasonably could be linked, to an identified or identifiable natural person. It does not include de-identified data or information that is publicly available.

One useful exemption is data processed or maintained by a controller in their role as an employer. The KCDPA exempts data regarding job applicants, employees, agents, and independent contractors that is used for employment, relates to the administration of benefits, or is used for emergency contact purposes.

The KCDPA also exempts numerous other types of personal data, much of which is protected under other laws. For example, it exempts personal health information (PHI) protected under the Health Insurance Portability and Accountability Act (HIPAA) and human subjects research data protected by various laws. In addition, the KCPDA exempts from its application data regulated by the Health Care Quality Improvement Act of 1986, the Fair Credit Reporting Act, the Driver’s Privacy Protection Act, the Family Educational Rights and Privacy Act (FERPA), and the federal Farm Credit Act.

CONSUMER RIGHTS

The KCDPA grants consumers certain rights over their personal data. For purposes of the KCDPA, a “consumer” is a Kentucky resident, a natural person acting only in an individual context. A “consumer” does not include a person who is acting in a commercial or employment context.

The KCDPA grants consumers the following rights:

  1. To confirm whether a controller is processing the consumer’s personal data;
  2. To obtain access to the consumer’s personal data;
  3. To correct inaccuracies in the consumer’s personal data;
  4. To delete personal data provided by or obtained about the consumer;
  5. To obtain a copy of the consumer’s personal data in a portable and readily usable format; and
  6. To opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

In order to exercise these rights, a consumer may submit a request to a controller, at any time, via the method specified in the controller’s privacy notice, which is discussed further below. A child’s parent or legal guardian may invoke such consumer rights on behalf of the child. Controllers must respond to consumer requests within 45 days.

BUSINESSES THAT ARE SUBJECT TO THE KCDPA

The KCDPA applies to certain businesses located in Kentucky or targeting Kentucky residents. In particular, it applies to natural persons or legal entities that conduct business in Kentucky or produce products or services that are targeted to residents of Kentucky and that, during a calendar year, “control” or “process” personal data of at least: (a) 100,000 consumers, or (b) 25,000 consumers and derive over 50% of gross revenue from the sale of personal data.

There are a handful of business categories exempt from the KCDPA. Specifically, the KCDPA does not apply to any:

  1. City, state agency, or any political subdivision of the state;
  2. Financial institution, its affiliates, or data subject to the Gramm-Leach-Bliley Act;
  3. HIPAA covered entity or a business associate of such covered entity;
  4. Nonprofit organization;
  5. Institution of higher education;
  6. Small telephone utility, a Tier III CMRS provider, or a municipally owned utility that does not sell or share personal data with any third-party processor; or
  7. Organization that:
    i) Does not provide net earnings to, or operate in any manner that inures to the benefit of any officer, employee, or shareholder of the entity; and
    ii) collects, processes, uses, or shares data solely in relation to identifying, investigating, or assisting either (a) law enforcement agencies suspected of insurance-related crimes or fraud, or (b) first responders in connection with catstrophic events.

Many of these exempted entities are already subject to other state or federal data protection laws.

CONTROLLER RESPONSIBILITIES AND OBLIGATIONS

The KCDPA imposes various responsibilities and obligations upon controllers, which include, but are not limited to, the following:

  1. Limit Collection and Use of Personal Data. Controllers must limit the collection of personal data to what is “reasonably necessary.” If the controller desires to process personal data for purposes that are neither reasonably necessary nor compatible with the disclosed purposes, then they must obtain the consumer’s consent.
  2. Implement Reasonable Security Practices. Controllers are required to protect the personal data entrusted to them. They must ensure that they have in place “reasonable administrative, technical, and physical data security practices” to protect the “confidentiality, integrity, and accessibility” of personal data. The KCDPA declines to specify exactly what these data security practices entail but allows flexibility and scalability based on the volume and nature of the personal data involved. More personal data and more sensitive data would, of course, demand tighter security measures.
  3. Consumer Rights. Controllers will need to timely comply with an authenticated request from a consumer to exercise a consumer right. In addition, they will need to establish; and follow; a process for a consumer to appeal the controller’s refusal to act on a request.
  4. Nondiscrimination. A controller must comply with state and federal laws that prohibit unlawful discrimination against consumers.
  5. Obtain Consent for Use of Sensitive Data. Sensitive data requires special handling procedures. “Sensitive data” is personal data indicating racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status. It also includes genetic or biometric data that can identify a specific natural person, personal data collected from a known child, or precise geolocation data. Controllers must first obtain the consumer’s consent before processing any sensitive data. Controllers must comply with the federal Children’s Online Privacy Protection Act (COPPA) when processing sensitive data from a known child.
  6. Contracts with Processors. Controllers must enter into binding contracts with processors that perform operations on personal data on behalf of a controller, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data. This contract shall include:

    a. Clear instructions for processing personal data, the nature and purpose of processing, the type of data subject to processing, the duration of processing, and the rights and obligations of both parties;
    b. A requirement that the processor ensure that each person processing personal data is subject to a duty of confidentiality with respect to the data;
    c. A provision regarding the deletion or return of all personal data to the controller upon termination of the contract;
    d. A requirement for the processor to make available to the controller all information in the processor’s possession in order to demonstrate the processor’s compliance with the KCDPA;
    e. A requirement for the processor to cooperate with the controller’s assessments of the processor’s policies and technical and organizational measures designed to comply with the KCDPA; and
    f. A requirement to enter into a written contract with any subcontractor that requires the subcontractor to meet the obligations of the processor with respect to the personal data.

Controller versus Processor. Whether your business is acting as a controller or processor with respect to a specific processing of data is a fact-based determination that depends on upon the context in which personal data is to be processed.  Nevertheless, a processor that continues to adhere to a controller’s instructions with respect to a specific processing of personal data remains a processor. (KRS 367.3619(4).) The KCDPA provides, however, that nothing in the law’s section on obligations of a processor (in KRS 367.3619) is to be construed as relieving a controller or processor from the liability imposed on it by virtue of its role in a processing relationship as defined by the KCDPA. KRS 367.3619(3).

7. Privacy Notices. Like HIPAA and other privacy laws, the KCDPA requires controllers to provide consumers with a privacy notice that informs them about how the controller uses and discloses their personal data and how consumers can exercise their rights. The privacy notice must be “reasonably accessible, clear, and meaningful” and include:
a. The categories of personal data processed by the controller;
b. The purpose for processing personal data;
c. How consumers may exercise their consumer rights, including how a consumer may submit a request to exercise their consumer rights as well as how to appeal a controller’s decision to such a request;
d. The categories of personal data that the controller shares with third parties, if any, and the categories of third parties, if any, with whom the controller shares personal data; and
e. Whether a controller sells personal data or uses the personal data for targeted advertising, and how a consumer may exercise the right to opt out of processing.

This KCDPA does not specify how the privacy notice should be communicated to consumers, merely that it should be “conspicuously available.”

8. Data Protection Impact Assessment. Controllers must perform, and document, a data protection impact assessment identifying the benefits from certain processing of personal data (such as sensitive data, targeted advertising, profiling, and the sale of personal data). These identified benefits should be weighed against the potential risks to the consumer’s rights associated with such processing. The controller should also consider whether employing safeguards could mitigate those risks. The data protection impact assessment should be performed on processing activities generated on or after June 1, 2026. The Kentucky Attorney General may demand a copy of this assessment as part of an investigation.

ENFORCEMENT

The Kentucky Attorney General has exclusive authority to enforce violations of the KCDPA. Before it can seek damages for alleged violations, the KCDPA requires the Kentucky Attorney General to first provide a controller or processor with written notice identifying alleged violations and allow the controller or processor an opportunity to cure the violation(s). If cured, then no further enforcement action is taken. If not cured, then the Kentucky Attorney General may bring an action seeking damages of up to $7,500 for each violation. There is no private right of action for violations of the KCDPA.

Looking for assistance in navigating compliance with the KCDPA?  We work with our clients regarding their policies and procedures related to compliance with the KCDPA, HIPAA and other data privacy and security laws and regulations. If you are looking for assistance in this area, contact Kathie McDonald-McClure at (502) 562-7526 or Margaret Young Levi at (859) 288-7469. To learn more about Wyatt’s health care, data privacy and cyber security practice, visit the following Wyatt website pages: Wyatt Data Privacy & Cyber Security and Wyatt Health Care.

HHS Announces Crackdown on “Information Blocking” Violations

WyattLLP Electronic Health Records, Health Information Technology , , , , , , ,

By: Kathie McDonald-McClure

The 21st Century Cures Act of 2016 (Cures Act) was passed by Congress and signed into law by President Obama on December 13, 2016. The Cures Act seeks to ensure access, exchange, and use of electronic health information. The Act mandated the U.S. Department of Health and Human Services (HHS) to establish rules prohibiting “information blocking” by developers of certified electronic health information technology (CEHRT), healthcare providers, health information networks (HINs), and health information exchanges (HIEs).

HHS, during the first Trump Administration, proposed and finalized initial information blocking rules for CEHRT developers and healthcare providers. The rules were initially set to take effect in November 2020 but were delayed due to the COVID-19 pandemic. The Biden Administration HHS announced that there would be no further delays and those initial information blocking rules became effective on April 21, 2021. These rules are applicable to developers of CEHRT and healthcare providers as well as HINs and HIEs. See 45 C.F.R. Part 171—Information Blocking and see our April 6, 2021 article discussing these complex rules, “Information Blocking Rule Effective April 5, 2021: Are Providers Ready?”

The next mandate under the Cures Act was to establish civil monetary penalties (CMPs) for CEHRT developers and “appropriate disincentives” for healthcare providers who violate the information blocking rules. The Biden Administration HHS Office of Inspector General (OIG) proposed and finalized the CMPs of not more than one million dollars per violation for CEHRT developers who commit information blocking. Those rules became effective September 1, 2023. See 42 C.F.R. Part 1003 Subpart N.

The Biden Administration HHS also proposed and finalized the disincentives for certain healthcare providers who run afoul of the information blocking rule. These disincentives became effective on July 31, 2024. See 45 C.F.R. 171.1000.

On September 3, 2025, HHS, under the direction of Secretary Robert F. Kennedy, Jr., announced a crackdown on information blocking violations. The announcement states that the Cures Act was “published” during the first Trump Administration despite being signed into law by President Obama. The announcement goes on to say that “[i]nformation blocking was not a priority under the Biden Administration” despite the implementation of penalties and disincentives for violations.

Nevertheless, it is important to note the intent of HHS under Secretary Kennedy to prioritize enforcement of the information blocking rules. The announcement summarizes the penalties and disincentives for information blocking violations. The disincentives for hospitals, critical access hospitals, and clinicians are not as straightforward as the CMPs for CEHRT developers because they are tied to Medicare payment formulas. Although not detailed in the HHS announcement, we discuss the disincentives in more depth in our July 3, 2024 article, “HHS Adds New Teeth to Information Blocking Law for Health Care Providers.”

Looking for assistance in navigating compliance and avoiding the pitfalls associated with the information blocking rules?  We work with our clients regarding their policies and procedures related to compliance with information blocking, HIPAA and other data privacy and security laws and regulations. If you are looking for assistance in this area, contact Kathie McDonald-McClure at (502) 562-7526 or Margaret Levi Young at (859) 288-7469. To learn more about Wyatt’s health care, data privacy and cyber security practice, visit the following Wyatt website pages: Wyatt Data Privacy & Cyber Security and Wyatt Health Care.

HHS Adds New Teeth to Information Blocking Law for Health Care Providers

Kathie McDonald-McClure Cures Act and Program Interoperability, Electronic Health Records, Health Information Technology, HITECH Law, Meaningful Use , , , , , , , , , , , , , ,

by Margaret Young Levi, Kathie McDonald-McClure, and Drayden Burton (Wyatt Summer Associate)

On July 1, 2024, the U.S. Department of Health and Human Services (HHS) published a final rule entitled “21st Century Cures Act: Establishment of Disincentives for Health Care Providers That Have Committed Information Blocking,” 89 Fed. Reg. 54662 (Final Rule) establishing “disincentives” for health care providers who commit information blocking. Importantly, the 21st Century Cares Act explicitly delegated the authority to HHS to establish “appropriate disincentives” for information blocking through notice and comment rulemaking. 42 U.S. Code § 300jj–52(b)(2)(B). Previously, on October 23, 2023, HHS published its proposed rule seeking comments on the proposed appropriate disincentives (Proposed Rule).   

In general, “information blocking” means knowingly and unreasonably interfering with, preventing, or materially discouraging the access, exchange, or use of “electronic health information” (EHI) unless such blocking is required by law or permitted by regulatory exceptions. To learn more about information blocking and the permitted exceptions, see our article “Information Blocking Rule Effective April 5, 2021: Are Providers Ready?,” which provides an overview of the Rule’s key elements and requirements. The prohibition on information blocking went into effect on April 5, 2021, but until now did not contain any penalties for health care providers who engage in information blocking.  Previously, on June 27, 2023, the HHS Office of Inspector General (HHS-OIG) established civil monetary penalties of up to $1 million per information blocking violation by developers of certified health information technology and for health information networks (HINs) and health information exchanges (HIEs).  (88 Federal Register 42820).

This Final Rule adds some teeth, aiming to ensure that individuals and their health care providers always have access to the individual’s health information.  Some of the comments that HHS had received to its Proposed Rule supported disincentives that incentivize an exchange of EHI across care settings on the basis that this will lead to better patient outcomes. In issuing its Final Rule HHS stated, “When health information can be appropriately accessed and exchanged, care is more coordinated and efficient, allowing the health care system to better serve patients.”

The “Disincentives”

The Final Rule establishes certain “disincentives” for several categories of health care providers that HHS-OIG finds to have engaged in activities that interfere with or prevent access to EHI that constitute information blocking. These disincentives are as follows:

Continue reading

Changes to the Health Breach Notification Rule Include Regulations for Health Apps

Wyatt Data Breach & Notification, Data Privacy & Security, Electronic Health Records, FTC Enforcement, Health Information Technology, HIPAA , , , , , , , , , , ,

Written by: Margaret Young Levi and Casey Parker-Bell (Wyatt Summer Associate)

Vendors who maintain personal health records will soon be subject to amended rules for notifying customers of data breaches. The Federal Trade Commission (“FTC”) has issued a Final Rule, finalizing changes to the Health Breach Notification Rule (“HBNR“) first issued in 2009 (the “2009 Rule”). The Final Rule clarifies the HBNR’s application to apps and other new technologies in the healthcare industry.

New technology, like fitness trackers and other direct-to-consumer health tech and wearable apps, have increased the amount of health data collected from consumers. There is a growing concern that some companies are disclosing or selling individuals’ personal health data for marketing and other purposes, while not subject to protections under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). “We are witnessing an explosion of health apps and connected devices, many of which aren’t covered by HIPAA, collecting vast amounts of sensitive consumer health information.” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “The proposed amendments to the new rule will allow it to keep up with marketplace trends, and respond to development and changes in technology.” The FTC has announced this Final Rule to address these new technologies.

The Final Rule’s Changes to the HBNR

The HBNR requires vendors of personal health records (“PHRs”) to notify individuals, the FTC, and, in some cases, the media of a breach of unsecured PHR identifiable health information. The HBNR also requires third-party service providers of personal health records to provide notifications. After seeking comments on proposed changes to better protect consumer who use PHRs, the FTC finalized the following changes to the HBNR:

Continue reading →

CMS Issues Updated Guidance on Texting Patient Orders

Margaret Young Levi Cyber Security and Cyber Crime, Data Privacy & Security, Electronic Health Records, Health Information Technology, HIPAA, Privacy & Security , , , , , , , , , ,

By: Margaret Young Levi

On February 8, 2024, the Centers for Medicare and Medicaid Services (CMS) issued a memorandum entitled Texting of Patient Information and Orders for Hospitals and CAHs (the 2024 Memo), which provides updated guidance to State Survey Agency Directors.  This 2024 Memo now permits the texting of patient orders among members of the hospital care team—if the texting is accomplished on a secure platform that protects the privacy and integrity of the patient information. 

This new guidance updates CMS’ previous memorandum entitled Texting of Patient Information among Healthcare Providers in Hospitals and Critical Access Hospitals (CAHs) (the 2017 Memo), which permitted texting patient information if done through a secure platform, but prohibited texting of patient orders regardless of the platform utilized.

Even though texting of patient orders through a secure platform is now permitted by CMS, that does not mean it is recommended.  CMS still prefers that providers enter their orders into the medical record via computerized provider order entry (CPOE) or even a handwritten order because of concerns about medical record retention, accuracy, privacy and security, etc. as set forth in the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Medicare Conditions of Participation (CoPs), and, if applicable, The Joint Commission (TJC) standards discussed below.

Continue reading