Beyond the federal HIPAA Privacy Rule, Kansas separately protects patient confidentiality through K.S.A. 60-427, which creates:
A. A physician-patient evidentiary privilege applicable in civil actions and misdemeanor prosecutions
B. A duplicate of the HIPAA Privacy Rule with no independent Kansas content
C. A rule that only applies to hospitals, not individual physicians
D. A federal reporting requirement administered by the Kansas Insurance Department
Show answer and reasoning
Correct answer: A. A physician-patient evidentiary privilege applicable in civil actions and misdemeanor prosecutions
Correct. K.S.A. 60-427 is a Kansas rule of evidence creating a physician-patient privilege that a person, whether or not a party, may generally assert in a civil action or in a prosecution for a misdemeanor.
- B: K.S.A. 60-427 is an independent, state-created evidentiary privilege distinct from the federal HIPAA Privacy Rule; it is not a mere restatement of the federal rule.
- C: K.S.A. 60-427's privilege language covers a physician or another practitioner of the healing arts, not only hospitals as institutions.
- D: K.S.A. 60-427 is a Kansas Code of Civil Procedure evidentiary rule, not a federal reporting requirement administered by an insurance regulator.
Source: K.S.A. 60-427
Under K.S.A. 60-427, in which circumstance does Kansas law provide that NO physician-patient privilege exists?
A. Whenever the patient is a minor
B. In an action where the patient's condition is itself an element or factor of the claim or defense being litigated
C. Whenever the treating provider is a specialist rather than a primary care physician
D. Whenever the patient has ever missed a scheduled appointment
Show answer and reasoning
Correct answer: B. In an action where the patient's condition is itself an element or factor of the claim or defense being litigated
Correct. K.S.A. 60-427 provides there is no privilege in an action in which the condition of the patient is an element or factor of the claim or defense of the patient, or of a party claiming through the patient.
- A: K.S.A. 60-427's listed exceptions do not turn on the patient's minority status as a categorical bar to the privilege.
- C: The statute's exceptions do not distinguish between specialists and primary care physicians.
- D: A missed appointment has no bearing on the statutory exceptions to the physician-patient privilege under K.S.A. 60-427.
Source: K.S.A. 60-427
Under K.S.A. 60-427, the physician-patient privilege also does not apply to information that:
A. Was communicated more than five years before the litigation
B. Was discussed in a hospital hallway
C. The physician or patient is required to report to a public official or is required to be recorded in a public office, unless the statute requiring that report or record specifically bars disclosure
D. Relates to a routine annual physical exam
Show answer and reasoning
Correct answer: C. The physician or patient is required to report to a public official or is required to be recorded in a public office, unless the statute requiring that report or record specifically bars disclosure
Correct. K.S.A. 60-427 provides there is no privilege as to information the physician or patient is required to report to a public official or record in a public office, unless the statute requiring that report or record specifically states the information shall not be disclosed.
- A: The statute does not create a five-year time-based exception to the privilege.
- B: The location of a conversation is not the statutory trigger for this exception; the exception concerns information that must be reported to a public official or recorded publicly.
- D: Whether an exam was routine or not is not the statutory basis for this particular exception.
Source: K.S.A. 60-427
Kansas's general consumer security breach notification law, K.S.A. 50-7a01, defines 'personal information' as a consumer's name linked to a Social Security number, driver's license or state ID number, or financial account/card number. What does this mean for a breach involving ONLY an individual's diagnosis and treatment history, with none of those listed data elements exposed?
A. Such a breach can never require any notification under any law
B. Such a breach must be reported to the Kansas Real Estate Commission
C. Such a breach automatically triggers Kansas's general consumer breach notification law because health data is inherently 'personal information'
D. Such a breach falls outside the definition of 'personal information' under K.S.A. 50-7a01, so it does not, by itself, trigger this particular Kansas statute; federal HIPAA breach notification obligations would still be analyzed separately
Show answer and reasoning
Correct answer: D. Such a breach falls outside the definition of 'personal information' under K.S.A. 50-7a01, so it does not, by itself, trigger this particular Kansas statute; federal HIPAA breach notification obligations would still be analyzed separately
Correct. Because diagnosis and treatment information alone is not within K.S.A. 50-7a01(g)'s defined 'personal information,' a breach limited to that data does not, by itself, trigger Kansas's general consumer breach notification statute, even though the separate federal HIPAA Breach Notification Rule may still apply to a covered entity.
- A: A breach of health information may still trigger notification obligations under federal HIPAA rules or other applicable law; it is not automatically exempt from every notification framework.
- B: The Kansas Real Estate Commission has no jurisdiction over health information security breaches; this is an insurance/health-privacy topic, not a real estate licensing matter.
- C: K.S.A. 50-7a01(g)'s definition of 'personal information' is limited to a name linked to a Social Security number, driver's license/state ID number, or financial account/card number; it does not list diagnosis or treatment information as a qualifying data element.
Source: K.S.A. 50-7a01(g)
Under K.S.A. 50-7a02, once an investigation determines that misuse of personal information covered by the statute has occurred or is reasonably likely, when must notice be given to affected Kansas residents?
A. As soon as possible and in the most expedient time and manner possible, without unreasonable delay, consistent with legitimate law enforcement needs and the measures necessary to determine the scope of the breach
B. Only if more than 500 Kansas residents are affected
C. Within 24 hours, with no exceptions
D. Within exactly 60 calendar days, no sooner and no later
Show answer and reasoning
Correct answer: A. As soon as possible and in the most expedient time and manner possible, without unreasonable delay, consistent with legitimate law enforcement needs and the measures necessary to determine the scope of the breach
Correct. K.S.A. 50-7a02 requires notice to affected Kansas residents to be given as soon as possible, in the most expedient time and manner possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and any measures necessary to determine the scope of the breach.
- B: The Kansas breach notification statute does not set a 500-resident minimum threshold before the general notice duty applies; the additional consumer-reporting-agency notice duty is what has a numeric trigger, not the underlying resident-notice duty.
- C: There is no fixed 24-hour deadline under K.S.A. 50-7a02; the statute allows the time needed for a reasonable investigation while requiring expedience once misuse is determined likely.
- D: K.S.A. 50-7a02 does not set a fixed 60-day window; it uses an 'as soon as possible' expedience standard rather than a specific day count.
Source: K.S.A. 50-7a02
