KS ยท Breach notification statute
Kansas data breach notification law
Summary
- Statute citation
Statute citation not extracted; see the state legislature website.
- Source
- PRC Data Breach Notification Laws Survey 2026
Who must notify and when
Most expedient time possible without unreasonable delay Kansas requires businesses to notify affected
Attorney general notice
No Kansas does not require notification to the Attorney General or any state agency as part of breach
What counts as a breach
Not extracted in our PRC 2026 summary; check the statute.
What counts as personal information
In Kansas 'personal information' means a consumer's first name or first initial and last name linked to any one or more of the following data elements that relate to the consumer, when the data elements are neither encrypted nor redacted: (1) Social security number; (2) driver's license number or state identification card number; or (3) financial account number, or credit or debit card number, alone or in combination with any required security code, access code or password that would permit acce
Coverage and remedies
"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.
HIPAA breaches reported in Kansas
83 reports to HHS OCR affecting 2,096,082 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Kansas.
Five largest
| Covered entity | Entity type | Individuals | Submitted | Type of breach | Status |
|---|---|---|---|---|---|
| Sunflower Medical Group, P.A. | Healthcare Provider | 220,968 | Mar 7, 2025 | Hacking/IT Incident | Archive (closed) |
| Amerita | Healthcare Provider | 219,707 | Sep 5, 2023 | Hacking/IT Incident | Archive (closed) |
| Hutchinson Clinic, P.A. | Healthcare Provider | 215,632 | Feb 17, 2023 | Hacking/IT Incident | Archive (closed) |
| Mid America Physician Services | Healthcare Provider | 104,513 | Jan 13, 2025 | Hacking/IT Incident | Under investigation |
| Mowery Clinic LLC | Healthcare Provider | 96,000 | Nov 5, 2021 | Hacking/IT Incident | Archive (closed) |
Frequently asked questions
When must Kansas businesses notify individuals of a data breach?
Our PRC 2026 extract summarises the Kansas timing rule as: "Most expedient time possible without unreasonable delay Kansas requires businesses to notify affected". (Source: PRC 2026 survey extract.)
Does Kansas require notice to the attorney general?
The PRC 2026 extract notes: "No Kansas does not require notification to the Attorney General or any state agency as part of breach". (Source: PRC 2026 survey extract.)
Does the Kansas law cover biometric data?
No. The PRC 2026 survey does not record biometric data as covered by the Kansas breach law.
Does the Kansas law cover medical information?
No. The PRC 2026 survey does not record medical information as covered by the Kansas breach law.
Does the Kansas law cover paper records?
No. The PRC 2026 survey records the Kansas law as covering computerised data only, not paper records.
Is there a private right of action in Kansas?
No. The PRC 2026 survey does not record a private right of action under the Kansas breach law.
Is credit monitoring required in Kansas?
No. The PRC 2026 survey does not record a credit monitoring requirement in Kansas.
How does the Kansas law relate to HIPAA?
HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Kansas statute, and see our HIPAA vs state breach notification laws guide.
Sources
- Privacy Rights Clearinghouse, Data Breach Notification Laws Survey 2026 (laws as of 1 January 2026): privacyrights.org
- The Kansas state legislature website for the current text of the statute.
- HHS OCR Breach Portal: ocrportal.hhs.gov
- Further reading: NCSL security breach notification laws