KY · Breach notification statute
Kentucky data breach notification law
Summary
- Statute citation
This state has 2 separate breach notification statutes
Private Sector: KRS § 365.732 (Trade Practices - Security Breach Notification) (amended
- Source
- PRC Data Breach Notification Laws Survey 2026
Who must notify and when
notify affected individuals in the most expedient time possible without unreasonable delay, consistent
Attorney general notice
Yes Kentucky requires government agencies to notify the Attorney General (and other officials) within 72
What counts as a breach
Not extracted in our PRC 2026 summary; check the statute.
What counts as personal information
Not extracted in our PRC 2026 summary; check the statute.
Coverage and remedies
"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.
HIPAA breaches reported in Kentucky
124 reports to HHS OCR affecting 11,757,126 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Kentucky.
Five largest
| Covered entity | Entity type | Individuals | Submitted | Type of breach | Status |
|---|---|---|---|---|---|
| PharMerica Corporation | Healthcare Provider | 5,815,591 | May 12, 2023 | Hacking/IT Incident | Archive (closed) |
| Norton Healthcare Inc. | Healthcare Provider | 2,500,000 | Jul 7, 2023 | Hacking/IT Incident | Archive (closed) |
| Commonwealth Health Corporation | Healthcare Provider | 697,800 | Mar 1, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| CorrectCare Integrated Health, Inc. | Business Associate | 502,089 | Oct 31, 2022 | Unauthorized Access/Disclosure | Archive (closed) |
| Cornerstone Healthcare Group Management Services LLC | Business Associate | 484,957 | Mar 14, 2024 | Hacking/IT Incident | Archive (closed) |
Frequently asked questions
When must Kentucky businesses notify individuals of a data breach?
Our PRC 2026 extract summarises the Kentucky timing rule as: "notify affected individuals in the most expedient time possible without unreasonable delay, consistent". (Source: PRC 2026 survey extract.)
Does Kentucky require notice to the attorney general?
The PRC 2026 extract notes: "Yes Kentucky requires government agencies to notify the Attorney General (and other officials) within 72". (Source: PRC 2026 survey extract.)
Does the Kentucky law cover biometric data?
No. The PRC 2026 survey does not record biometric data as covered by the Kentucky breach law.
Does the Kentucky law cover medical information?
No. The PRC 2026 survey does not record medical information as covered by the Kentucky breach law.
Does the Kentucky law cover paper records?
No. The PRC 2026 survey records the Kentucky law as covering computerised data only, not paper records.
Is there a private right of action in Kentucky?
No. The PRC 2026 survey does not record a private right of action under the Kentucky breach law.
Is credit monitoring required in Kentucky?
No. The PRC 2026 survey does not record a credit monitoring requirement in Kentucky.
How does the Kentucky law relate to HIPAA?
HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Kentucky statute, and see our HIPAA vs state breach notification laws guide.
Sources
- Privacy Rights Clearinghouse, Data Breach Notification Laws Survey 2026 (laws as of 1 January 2026): privacyrights.org
- The Kentucky state legislature website for the current text of the statute.
- HHS OCR Breach Portal: ocrportal.hhs.gov
- Further reading: NCSL security breach notification laws