New HIPAA Exemption Added to Kentucky Consumer Data Protection Act
In April 2024, Kentucky joined the growing number of states that have adopted comprehensive consumer privacy and data protection laws. The Kentucky Consumer Data Protection Act was signed into law on April 4, 2024, and is due to take effect on January 1, 2026. The Kentucky Consumer Data Protection Act applies to individuals and legal entities that control or process the personal data of at least 100,000 Kentucky consumers or control or process the personal data of 25,000 Kentucky consumers and derive over 50% of gross revenue from the sale of personal data.
An amendment to the law has been signed by state governor Andy Beshear that narrows the scope of the law, exempting information collected by healthcare providers covered under HIPAA that maintain protected health information in compliance with the HIPAA Rules and other related regulations. The amendment also expands the excluded information to include information collected in a limited data set, as defined in 45 C.F.R. 8 164.514(e) to the extent the information is used, disclosed, and maintained as specified in 45 C.F.R. 8 164.514(e).
The exemption for small telephone utilities and municipally owned utilities that do not sell or share personal data with any third-party processor has also been updated, changing “any third-party processor” to “any third party.” The Kentucky Consumer Data Protection Act requires controllers to conduct and document a data protection impact assessment of certain processing activities involving personal data. Data protection impact assessments are required for the processing of personal data for the purposes of profiling, where the profiling presents reasonably foreseeable risks. The definition of risks has been amended to include unlawfulness, with the update now covering risks of “unfair or deceptive treatment of consumers or unlawful, disparate impact on consumers.”
Governor Beshear signed the amendment into law on March 15, 2025. The amendments will take effect on January 1, 2026, and the law’s data protection assessment requirements will apply to processing activities created or generated on or after June 1, 2026.
