Beyond the federal HIPAA Privacy Rule, Kansas separately protects patient confidentiality through K.S.A. 60-427, which creates:
A. A physician-patient evidentiary privilege applicable in civil actions and misdemeanor prosecutions
B. A duplicate of the HIPAA Privacy Rule with no independent Kansas content
C. A rule that only applies to hospitals, not individual physicians
D. A federal reporting requirement administered by the Kansas Insurance Department
Source: K.S.A. 60-427
Under K.S.A. 60-427, in which circumstance does Kansas law provide that NO physician-patient privilege exists?
A. Whenever the patient is a minor
B. In an action where the patient's condition is itself an element or factor of the claim or defense being litigated
C. Whenever the treating provider is a specialist rather than a primary care physician
D. Whenever the patient has ever missed a scheduled appointment
Source: K.S.A. 60-427
Under K.S.A. 60-427, the physician-patient privilege also does not apply to information that:
A. Was communicated more than five years before the litigation
B. Was discussed in a hospital hallway
C. The physician or patient is required to report to a public official or is required to be recorded in a public office, unless the statute requiring that report or record specifically bars disclosure
D. Relates to a routine annual physical exam
Source: K.S.A. 60-427
Kansas's general consumer security breach notification law, K.S.A. 50-7a01, defines 'personal information' as a consumer's name linked to a Social Security number, driver's license or state ID number, or financial account/card number. What does this mean for a breach involving ONLY an individual's diagnosis and treatment history, with none of those listed data elements exposed?
A. Such a breach can never require any notification under any law
B. Such a breach must be reported to the Kansas Real Estate Commission
C. Such a breach automatically triggers Kansas's general consumer breach notification law because health data is inherently 'personal information'
D. Such a breach falls outside the definition of 'personal information' under K.S.A. 50-7a01, so it does not, by itself, trigger this particular Kansas statute; federal HIPAA breach notification obligations would still be analyzed separately
Source: K.S.A. 50-7a01(g)
Under K.S.A. 50-7a02, once an investigation determines that misuse of personal information covered by the statute has occurred or is reasonably likely, when must notice be given to affected Kansas residents?
A. As soon as possible and in the most expedient time and manner possible, without unreasonable delay, consistent with legitimate law enforcement needs and the measures necessary to determine the scope of the breach
B. Only if more than 500 Kansas residents are affected
C. Within 24 hours, with no exceptions
D. Within exactly 60 calendar days, no sooner and no later
Source: K.S.A. 50-7a02
