Arkansas practices follow HIPAA plus the Arkansas Personal Information Protection Act, which specifically includes medical information and biometric data and requires attorney general notice for larger breaches.
AT A GLANCE
| Law | Personal Information Protection Act, Ark. Code §§ 4-110-101 and following |
|---|---|
| Data covered | Includes medical information and biometric data, along with Social Security, driver license and financial account numbers |
| Notice to residents | In the most expedient time and manner possible, without unreasonable delay |
| No-harm determination | Notice is not required if there is no reasonable likelihood of harm, but you must keep the written determination and supporting records for five years |
| Attorney general | Required if more than 1,000 individuals are affected, within 45 days after determining there is a reasonable likelihood of harm |
| Other regulated entities | Entities regulated by laws that provide greater protection and similar disclosure rules are exempt |
| Enforcement | Attorney general, under the Deceptive Trade Practices Act. No private right of action |
02
HOW WE HELP
HIPAA risk assessment
The documented risk analysis HIPAA requires, the foundation for every state law too.
Learn more →Incident response planning
Know who to notify, and by when, before a breach happens.
Learn more →HIPAA compliance program
Policies and procedures that cover both HIPAA and your state requirements.
Learn more →FAQ
Yes. Medical information is included in the definition of personal information, along with biometric data.
If a breach affects more than 1,000 individuals, notify the attorney general within 45 days after determining there is a reasonable likelihood of harm.
Notice is not required when there is no reasonable likelihood of harm, but you must document that determination and keep it for five years. HIPAA has its own risk assessment standard you must also meet.
Sources: Mintz: Arkansas breach law. This page is general information about the law as of November 2026, not legal advice. Statutes change, so confirm current requirements with your attorney.
Start with the free HIPAA risk assessment, or talk to an analyst.
