Kentucky Healthcare Compliance Requirements

Kentucky's breach-notification law — KRS §365.732 — sets no numeric deadline: notification is due "in the most expedient time possible and without unreasonable delay." KRS §365.732 also expressly does not apply to entities subject to HIPAA or GLBA, so a covered medical practice is exempt from it entirely and answers to the federal Breach Notification Rule instead. Kentucky is unusual in requiring no Attorney General notification from private entities at all; the statute's only third-party trigger is notice to the nationwide consumer reporting agencies above 1,000 affected residents, and that sits inside the same section a covered practice is exempt from. Penalties under the Consumer Protection Act reach $10,000 per violation for the entities the section does reach. Kentucky also operates KASPER — the Kentucky All Schedule Prescription Electronic Reporting program — one of the oldest prescription monitoring programs in the United States, established in 1998 and the model on which several other state PMPs were built. KASPER is administered by the Cabinet for Health and Family Services through the Office of Inspector General, and queries are mandatory before every controlled-substance prescription. Lexington and Louisville-area pain-management and behavioral-health practices operate under a particularly rigorous Kentucky Board of Medical Licensure posture in the wake of the opioid crisis: KASPER pattern review is one of the more common drivers of board inquiry, and "failure to check KASPER" is independently a Class D felony with fines up to $10,000. The absence of a state breach clock, the 5-year hospital retention floor under 902 KAR 20:016, and KASPER's depth combine to make Kentucky's framework narrow rather than maximalist for covered practices.

The Kentucky Office of the Attorney General is largely reactive on healthcare-privacy enforcement, opening investigations on breach notifications rather than pursuing proactive sweeps. The Consumer Protection Division will pursue §365.732 violations when notifications are late or incomplete, and the $10,000-per-violation ceiling has shaped settlement posture. The more active state regulator on healthcare matters is the Kentucky Board of Medical Licensure, which has built KASPER pattern review into its routine prescribing-investigation workflow. Pain-management and behavioral-health practices in particular should treat KASPER documentation as audit-grade — failure-to-check is a Class D felony, independent of any patient-harm outcome. Document your HIPAA breach timeline, your harm-analysis worksheet, and your KASPER query log meticulously.

Guides & Articles