Section 218B.135 - Cabinet to maintain confidential list of cardholders - Exemptions from Open Records Act - Certain information not exempt - Penalty(1) The cabinet shall maintain a confidential list of the persons to whom the cabinet has issued registry identification cards and their addresses, telephone numbers, and registry identification numbers.(2) The cabinet shall, only at a cardholder's request, confirm his or her status as a registered qualified patient, visiting qualified patient, or designated caregiver to a third party, such as a landlord, employer, school, medical professional, or court.(3) The following information received and records kept pursuant to the cabinet's administrative regulations promulgated for purposes of administering this chapter shall be confidential and exempt from the Open Records Act, KRS 61.870 to 61.884, and shall not be subject to disclosure to any individual or public or private entity, except as necessary for authorized employees of the cabinet to perform official duties pursuant to this chapter:(a) Applications and renewals, their contents, and supporting information submitted by qualified patients, visiting qualified patients, and designated caregivers in compliance with KRS 218B.055, including information regarding their designated caregivers and medicinal cannabis practitioners;(b) The individual names and other information identifying persons to whom the cabinet has issued registry identification cards;(c) Any dispensing information required to be kept under KRS 218B.110 or the cabinet's administrative regulations which shall only identify cardholders by their registry identification numbers and shall not contain names or other personal identifying information; and(d) Any cabinet hard drives or other data-recording media that are no longer in use and that contain cardholder information. These hard drives and other media shall be destroyed after a reasonable time or after the data is otherwise stored. Data subject to this section shall not be combined or linked in any manner with any other list or database maintained by the cabinet and shall not be used for any purpose not provided for in this chapter.
(4) Nothing in this section shall preclude the following:(a) Notification by the cabinet's employees to state or local law enforcement about falsified or fraudulent information submitted to the cabinet or of other apparently criminal violations of this chapter if the employee who suspects that falsified or fraudulent information has been submitted has conferred with his or her supervisor and both agree that circumstances exist that warrant reporting;(b) Notification by the cabinet's employees to a state licensing board if the cabinet has reasonable suspicion to believe a medicinal cannabis practitioner did not have a bona fide practitioner-patient relationship with a patient for whom he or she signed a written certification, if the cabinet has reasonable suspicion to believe the medicinal cannabis practitioner violated the standard of care, or for other suspected violations of this chapter by a medicinal cannabis practitioner;(c) Notification by dispensary agents to the cabinet of a suspected violation or attempted violation of this chapter or the administrative regulations promulgated thereunder;(d) Verification by the cabinet of registry identification cards issued pursuant to KRS 218B.055, 218B.060, and 218B.065; and(e) The submission of the report required by KRS 218B.020 to the General Assembly.(5) It shall be a misdemeanor punishable by up to one hundred eighty (180) days in jail for any person, including an employee or official of the cabinet or another state agency or local government, to knowingly breach the confidentiality of information obtained pursuant to this chapter.Added by 2023 Ky. Acts ch. 146,§ 26, eff. 6/28/2023.