Kentucky Health Privacy Rights

No extensive state law beyond HIPAA. Kentucky's Medical Records Act (KRS 422.317) gives patients the right to a copy of medical records within 30 days (the same as HIPAA's original timeline). Kentucky law requires patient authorization for release of medical info except as otherwise provided by law, echoing HIPAA. No separate state-level privacy act for general PHI; specific areas like mental health or HIV have their own consent rules (e.g., HIV test results can only be disclosed to those authorized by law or patient consent). Kentucky basically follows HIPAA with some added clarity in statute that patients must authorize non-routine disclosures.