Kansas healthcare breach data

Notification deadline

In the most expedient time possible and without unreasonable delay, following the investigation-based determination that misuse of personal information has occurred or is reasonably likely to occur, consistent with (i) the legitimate needs of law enforcement, and (ii) any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the computerized data system. No numeric outer bound.

State regulator notice

Not required

None. K.S.A. § 50-7a02 does not impose an affirmative Attorney General notice obligation. Under § 50-7a02(g), the Kansas Attorney General has enforcement authority to bring an action for violations of the section (except as to insurance companies, whose enforcement is exclusively vested in the Kansas Insurance Commissioner under § 50-7a02(h)) — but this is post-violation enforcement authority, not an affirmative pre-notification trigger.