Kansas Attorney General Opinion 2016-008

May 4, 2016
ATTORNEY GENERAL OPINION NO. 2016- 8
The Honorable Jim Kelly
State Representative, 11th District
State Capitol, 512-N
300 S.W. 10th Avenue
Topeka, Kansas 66612
Re: 	Public Health—Confidential Communications and Information—Privilege of
Patient of Treatment Facility to Prevent Disclosure of Treatment and of
Confidential Communications
Public Health—Health Care Data—Kansas Health Information Technology
Act; Controlling Law on Confidentiality of Protected Health Information
Synopsis: 	The Kansas Health Information Technology Act does not abrogate a health
treatment 	facility’s 	duty 	to 	protect 	provider-patient 	privileged 	treatment
information. Cited herein: K.S.A. 19-4001; 65-5602; K.S.A. 2015 Supp. 38-
2223, 65-5603, 65-6823, 65-6825, 65-6828; 45 C.F.R. § 160.103; 45 C.F.R.
§ 164.512.
* 	* 	*
Dear Representative Kelly:
As the Representative for the Eleventh District, you ask our opinion on whether a
community mental health center established pursuant to K.S.A. 19-4001, et seq., is still
bound by the provider-patient treatment records privilege found at K.S.A. 65-5602
following the passage of the Kansas Health Information Technology Act (KHITA), K.S.A.
2015 Supp. 65-6821, et seq. Because the KHITA was enacted with the purpose 1 of
harmonizing state law with the Health Information Portability and Accountability Act of
1996 (HIPAA), 2 you ask if the KHITA’s declaration that its terms control over “any
provision of state law regarding the confidentiality, privacy, security or privileged status of
1 K.S.A. 2015 Supp. 65-6823.
2 Pub. L. No. 104-191, 110 Stat. 1936.

Rep. Jim Kelly
Page 2
any protected health information” 3 effectively abolishes the provider-patient privilege
contained at K.S.A. 65-5602 in favor of allowing any disclosure contemplated by HIPAA.
For the reasons further discussed below, we believe that it does not.
Nature of the Privilege
K.S.A. 65-5602(a) provides,
A 	patient 	of 	a 	treatment 	facility 	has 	a 	privilege 	to 	prevent 	treatment
personnel or ancillary personnel from disclosing that the patient has been or
is 	currently 	receiving 	treatment 	or 	from 	disclosing 	any 	confidential
communications made for the purposes of diagnosis or treatment of the
patient’s mental, alcoholic, drug dependency, or emotional condition. The
privilege extends to individual, family, or group therapy under the direction
of the treatment personnel and includes members of the patient’s family.
The privilege may be claimed by the patient, by the patient’s guardian or
conservator or by the personal representative of a deceased patient. The
treatment personnel shall claim the privilege on behalf of the patient unless
the patient has made a written waiver of the privilege and provided the
treatment personnel with a copy of such waiver or unless one of the
exceptions provided by K.S.A. 2015 Supp. 65-5603 is applicable.
If, for example, a treatment facility is served with a subpoena duces tecum for the
medical records of a patient or former patient, it must assert the privilege on the patient’s
behalf unless the patient or former patient has made a written waiver of the privilege or
unless a statutory exception applies. 4
The statutory privilege is not, however, absolute. There are sixteen exceptions in which
the privilege contained in K.S.A. 65-5602(a) does not apply, including various instances
involving emergency treatment, patient transfer, and bill collection, among others.5
We caution that not all situations covered by the enumerated exceptions may be readily
apparent. For example, K.S.A. 65-5603(a)(4) allows treatment personnel to comply with,
inter alia, the mandatory reporting requirements of K.S.A. 2015 Supp. 38-2223(a)(1)(B)
regarding suspected physical, mental, or emotional abuse or neglect or sexual abuse of a
child. The mandatory reporter, however, may also be required to “disclose protected
health information freely and cooperate fully with the secretary and law enforcement
throughout 	the 	investigation 	and 	subsequent 	legal 	process,” 6 	which 	may 	include
disclosing confidential communications made to the mandatory reporter.7
3 K.S.A. 2015 Supp. 65-6828.
4 See Hosey v. Presbyterian Church (U.S.A.), 160 F.R.D. 161 (D. Kan., 1995) (but also discussing
limitations on application of the privilege in certain civil claims following the death of the patient).
5 K.S.A. 2015 Supp. 65-5603(a)(1-16). This statute was recently amended by L. 2016, ch. 46, § 55
(effective July 1, 2016). The changes refer only to the location of terms defined in subsection (b) and do not
affect our analysis.
6 K.S.A. 2015 Supp. 38-2223(b)(2).
7 In re D.W., 2008 WL 624714, at *2 (Kan. Ct. App. 2008) (unpublished opinion).

Rep. Jim Kelly
Page 3
Scope and Purpose of KHITA; Certain Permitted Disclosures under HIPAA
The KHITA generally prohibits a covered entity8 from using or disclosing protected health
information 9 except as allowed by federal regulations or limited statutory exceptions. We
believe highlighting two types of permitted disclosures under the KHITA will help illustrate
the way the KHITA affects pre-existing statutes, including the provider-patient privilege, in
order to answer your question.
One of the areas of state law the KHITA was intended to harmonize with HIPAA is
“facilitating the development and use of health information technology and the sharing of
health information electronically.” 10 To that end, the KHITA allows for covered entities to
disclose protected health information to health information organizations 11 when certain
threshold conditions are met12 in order to facilitate the creation and maintenance of
electronic 	infrastructure 	for 	moving 	protected 	health 	information 	between 	covered
entities. 13 	Two 	health 	information 	organizations 	have 	been 	awarded 	certificates 	of
authority under the KHITA: the Kansas Health Information Network (KHIN) and the Lewis
and Clark Information Exchange (LACIE).14
The KHITA also allows disclosure of protected health information “in a manner as
permitted under 45 C.F.R. § . . . 164.512.” 15 That regulation provides, in relevant part,
A 	covered 	entity 	may 	disclose 	protected 	health 	information 	for 	a 	law
enforcement purpose to a law enforcement official if the conditions in
paragraphs (f)(1) through (f)(6) of this section are met, as applicable.
(1) Permitted disclosures: 	Pursuant to process and as otherwise required
by law. A covered entity may disclose protected health information:
. . .
(ii) In compliance with and as limited by the relevant requirements of:
. . .
(C) An administrative request, including an administrative subpoena or
summons, a civil or an authorized investigative demand, or similar process
authorized under law, provided that:
8 K.S.A. 2015 Supp. 65-6822(d); 45 C.F.R. § 160.103.
9 K.S.A. 2015 Supp. 65-6822(q); 45 C.F.R. § 160.103.
10 K.S.A. 2015 Supp. 65-6823.
11 K.S.A. 2015 Supp. 65-6822(j).
12 K.S.A. 2015 Supp. 65-6825(b).
13 See K.S.A. 2015 Supp. 65-6822(j).
14 “Kansas HIO Contacts.” Kansas Department of Health and Environment Health Information Technology.
http://www.kanhit.org/participate.htm (accessed March 1, 2016).
15 K.S.A. 2015 Supp. 65-6825(a)(2).

Rep. Jim Kelly
Page 4
(1) The information sought is relevant and material to a legitimate law
enforcement inquiry;
(2) The request is specific and limited in scope to the extent reasonably
practicable in light of the purpose for which the information is sought; and
(3) De-identified information could not reasonably be used. 16
At first glance, these allowed disclosures would seem to establish a conflict between the
KHITA 	and 	the 	provider-patient 	privilege 	statute, 	K.S.A. 	65-5602, 	which 	requires
treatment personnel to assert the privilege on the patient’s behalf to prevent disclosure.
Under the terms of K.S.A. 2015 Supp. 65-6828, the KHITA would control and the
disclosures would be permitted.17
Resolving an Apparent Conflict
In order to determine whether—and the extent to which—an actual conflict exists, closer
examination of K.S.A. 2015 Supp. 65-5603 is required. We believe that two separate
statutory 	provisions 	resolve 	the 	question 	of 	whether 	the 	provider-patient 	privilege
survives under the KHITA in the two situations we described above: 	sharing information
with a health information organization and responding to a law enforcement inquiry.
We first note the provider-patient privilege contains an exception that allows treatment
personnel to disclose:
any communication and information by and between or among treatment
facilities . . . regarding a proposed patient, patient or former patient for
purposes of promoting continuity of care by and between treatment facilities
. . . ; the proposed patient, patient, or former patient’s consent shall not be
necessary to share evaluation and treatment records by and between or
among treatment facilities . . . regarding a proposed patient, patient or
former patient. 18
We assume without deciding that disclosing protected health information to a health
information organization is consistent with promoting continuity of care among treatment
facilities. In that situation no conflict exists between the KHITA and the provider-patient
privilege statutes, so the privilege is preserved.
Next, we note the KHITA by its terms does not conflict with, or take precedence over, the
provider-patient privilege found in K.S.A. 2015 Supp. 65-5602 because the KHITA
expressly preserves “any statutory health care provider-patient evidentiary privilege
applicable to a judicial or administrative proceeding” and provides that “[n]othing in
[KHITA] shall limit or restrict the effect and application of” that privilege. 19 We also note
16 45 C.F.R. § 164-512(f).
17 K.S.A. 2015 Supp. 65-6828.
18 K.S.A. 2015 Supp. 65-5603(a)(13).
19 K.S.A. 2015 Supp. 65-6828(a).

Rep. Jim Kelly
Page 5
the provider-patient privilege has an explicit exception for confirming “whether a person is
or has been a patient of any treatment facility with the last six months.”20
When read in pari materia, the KHITA and the provider-patient privilege statute require a
mental health treatment facility to confirm whether a person is or has been a patient of
the treatment facility within the last six months provided that person is,
lawfully detained by a law enforcement officer upon reasonable suspicion
that such person is committing, has committed or is about to commit a
misdemeanor or felony, if such law enforcement officer has reasonable
suspicion that such person is suffering from mental illness and such law
enforcement officer has a reasonable belief that such person may benefit
from 	treatment 	at 	a 	treatment 	facility 	rather 	than 	being 	placed 	in 	a
correctional institution, jail, juvenile correctional facility or juvenile detention
facility. 21
Any such request must also satisfy the covered entity that: 	the information sought is
relevant and material to a legitimate law enforcement inquiry; the request is specific and
limited in scope to the extent reasonably practicable in light of the purpose for which the
information is sought; and de-identified information could not reasonably be used. 22
Other law enforcement requests for disclosure of protected health information remain
subject to the rule preserving the provider-patient privilege in judicial or administrative
proceedings as that rule existed prior to enactment of the KHITA.
Sincerely,
Derek Schmidt
Kansas Attorney General
Craig Paschang
Assistant Attorney General
DS:AA:CP:sb
20 K.S.A. 2015 Supp. 65-5603(a)(16).
21 Id.
22 45 C.F.R. § 164.512(f)(1)(ii)(C)(1-3).