KentuckyHB 6762026 Regular SessionHouseWALLET

AN ACT relating to the Kentucky statewide health data utility.

Sponsored By: Rebecca Raymer (Republican)

Became Law

Administrative Regulations And ProceedingsAdvisory Boards, Commissions, And CommitteesData ProtectionEducation, HigherEffective Dates, DelayedFederal Laws And RegulationsFundsGeneral AssemblyHealth And Medical ServicesHealth Care ProfessionalsHospitals And Health FacilitiesInsuranceInsurance, HealthInsurance, Motor VehicleLegislative Research CommissionLocal GovernmentMedicaidPharmacistsPhysiciansPublic HealthReports MandatedState AgenciesActuarial Analysis

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

14 provisions identified: 8 benefits, 1 costs, 5 mixed.

Stronger privacy and patient opt-out

The utility must follow HIPAA and 42 C.F.R. part 2. You can opt out of having your identifiable, long‑term health record in the utility. Deidentified or aggregated claims and encounter data may still be used if you cannot reasonably be reidentified. All data users must agree to the law’s use rules before access. The consortium must do a privacy impact assessment, plan fixes, and get board approval. It must also keep strong safeguards, audits, and disaster recovery plans.

State health data utility rules

The law creates a statewide health data utility with strict privacy and security rules. Individual health data in the utility is not open to public records requests. No one may reidentify people, use data for trade secrets or resale, or break privacy laws. The consortium cannot publish or use health data without the executive director’s approval and must oversee vendors. The Office of Data Analytics leads cabinet‑wide data work and quality checks, and the Office of Inspector General oversees the current health information exchange until the new utility is fully operating. The law also clarifies the utility is not a health insurance network.

Statewide health data utility launches

The law creates a single statewide network to share health information. It combines clinical, pharmacy, claims (all‑payer claims database), and community referral data. The Office of Data Analytics oversees it, and a four‑university consortium runs it. The executive director seeks grants, Medicare data, and cross‑state and agency data‑sharing deals that protect confidentiality and follow the law. The consortium must adopt organizing papers within 60 days and sign an operating contract within 180 days; the director must also contract with the consortium and may hire vendors.

New reporting rules and penalties

Participants must share required health data in set formats and on set schedules. Required reporters must sign an agreement and start sending data by the later of three months after a database goes live or when they start the regulated activity, as allowed by federal law. The Secretary can investigate, subpoena, seek injunctions, and assess civil penalties. Penalties can be up to $1,000 per day and may be adjusted every two years by the medical CPI; government agencies are exempt. The consortium must report material or willful noncompliance, and the cabinet must seek any needed federal approvals within 90 days and may delay only the parts that need that approval.

New EMS data and privacy rules

Ambulance, mobile integrated healthcare, and medical first response providers must send required patient care data electronically in the board’s format. If a provider collects data electronically, it must give a full patient care record to the receiving facility and to the patient on request if not transported. Patient care records are confidential under HIPAA and can be released only with written authorization by the patient, guardian, or a court. The board’s quality‑review records are confidential and not usable in court, and the cabinet has immediate access to board data. The board publishes a yearly, de‑identified EMS report.

Hospital DSH payments and deadlines

Medicaid hospitals must file DSH surveys within 60 days after filing annual cost reports; extensions are rare and up to 30 days, requested 10 days before the deadline. New hospitals without six months of data must submit a limited DSH survey by September 1 before the first calculation. Plans must give paid claims listings within 90 days of year‑end and again at 12 months; if listings are wrong or missing, hospitals use internal data. Essential hospitals get a distribution factor using 200% of remaining uncompensated care costs, and leftover funds are split by each hospital’s remaining uncompensated costs. Total DSH payments cannot exceed the federal cap, a hospital’s uncompensated costs, or its hospital‑specific DSH limit.

Easier Parkinson’s registry reporting

Movement disorder centers and providers may use automated tools from the cabinet or a state health information exchange to report Parkinson’s cases. This can reduce manual reporting work.

Annual reports on utility performance

Each year by June 1, the consortium reports on operations, finances, performance, and recommended improvements. Each year by September 1, the executive director reports on oversight and enforcement, contract compliance, finances, performance, and recommendations.

Brain and spinal injury registry

The state creates a confidential registry for traumatic brain and spinal cord injuries. Licensed professionals may be required to report cases and related data. Hospitals only report data already available from the statewide health data utility or other state reporting. The board must protect confidentiality and cover any copying costs for records it requests.

More reporting for CHIP and women's health

CHIP data is included in the statewide health data utility (or other state reporting until that utility is ready). The program tracks enrollment, services, and effects on children’s health. The Division of Women’s Health guides which women’s health data are collected and helps publish aggregate findings online.

New Health IT Board oversight

The law creates the Kentucky Health Information Technology Board. It sets who serves, with the executive director as chair who votes only to break a tie. The board meets at least quarterly for the first two years and at least twice a year after; members may meet remotely. The cabinet pays board costs and reimburses travel for non‑cabinet members. The board reviews draft rules and forms before filing, can request needed information, and all members get HIPAA and data‑governance training within 60 days of appointment.

Fees and funding for data utility

The law creates a restricted state fund to run the utility. It can hold grants, gifts, fees, penalties, and appropriations, and money does not lapse. The director can set fees for authorized data access and set what non‑identifiable data are released publicly. The General Assembly and the Legislative Research Commission get free read‑only access to non‑identifiable data.

Hospitals post access sign, provide audits

Hospitals that get DSH reimbursement must post a sign saying they accept patients regardless of race, creed, ethnic background, or ability to pay. When asked, a hospital must send documents that prove it meets federal audit rules in 42 C.F.R. § 455.

Parkinson's registry with patient opt-out

The state creates a Parkinson’s Disease Research Registry. Starting January 1, 2026, movement disorder centers and providers must report Parkinson’s cases. Patients must get notice and can opt out in writing; then only a case count is reported. The cabinet keeps registry data confidential, controls contacts with patients, and logs all access. The cabinet may share data with other states or researchers under strict confidentiality and IRB rules. Yearly public summaries begin October 1, 2027. Earlier Parkinson’s statute sections are repealed July 1, 2028.

Sponsors & Cosponsors

Sponsor

Rebecca Raymer
Republican • House

Cosponsors

There are no cosponsors for this bill.

Roll Call Votes

All Roll Calls

Yes: 130 • No: 1

Senate vote • 3/31/2026

3rd reading, passed

Yes: 37 • No: 1

House vote • 3/19/2026