Health record rights in Arkansas: what state law adds
In Arkansas, as of October 3, 2026, we found no law on health data held outside HIPAA; copy rights go no further than HIPAA; you can opt out of the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you cannot sue under these laws; breach notices cover one of medical or health insurance information; and we found no law on AI in care. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?No. Only the attorney general or a regulator can enforce these laws. Same answer in 5 of the 50 states, counting this one.
Must you be told if health data leaks in a breach?Partly. The breach notice law covers one of the two: medical information or health insurance information. Same answer in 3 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No comprehensive or consumer health data law found. SB258 of 2025 failed. Act 952 of 2025 covers online data of children and teens, not health data as such, so it was not scored here.
How we searched (October 3, 2026): the official code search for consumer health data, consumer data privacy, sensitive data consent, health data, Arkansas Digital Responsibility, Safety, and Trust Act, 4-110-103. Agency pages checked: arkansasag.gov.
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
No. A law is in force, but it adds nothing to HIPAA's terms.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Deadline is 30 days, not shorter. No free-copy case found. The $75 electronic fee and per-page caps are fee facts only. Nothing goes beyond HIPAA plus the information blocking rule, so beyondFederalFloor is no.
Deadline in the law: 30 days (not shorter than HIPAA's 30).
Fee rule: Paper photocopy cap: "fifty cents (50¢) per page for the first twenty-five (25) pages and twenty-five cents (25¢) for each additional page."
Fee rule: Labor charge up to $25.00 per request plus actual postage (Act 765 of 2023 amended this from $15.00).
Fee rule: Electronic records: "The fee for producing medical records under this subsection is seventy-five dollars ($75.00), and the actual cost of postage, if any postage is required, may be charged in addition to the fee for producing medical records."
Fee rule: Notarized or certified copy: "an additional fee of two dollars ($2.00) may be charged."
Fee rule: Patient's own request follows HIPAA patient access rules as of 2023-01-01, except the HIPAA fee provisions (16-46-106(h)).
Goes beyond the federal floor: no.
Access to medical records: electronic records deadline. Ark. Code § 16-46-106(c)(3), as amended by Act 765 of 2023
In force · effective · read October 3, 2026 · source(arkleg.state.ar.us)
shall be produced within thirty (30) days after receipt of the request unless
Who it binds, in our words: "Medical provider" means a doctor, hospital, ambulance provider, medical healthcare provider, or other medical institution that provides medical care
Access to medical records: fee for electronic records. Ark. Code § 16-46-106(c)(4)(A), as amended by Act 765 of 2023
In force · effective · read October 3, 2026 · source(arkleg.state.ar.us)
subsection is seventy-five dollars ($75.00), and the actual cost of postage,
Who it binds, in our words: Requests in contemplation of a legal proceeding, adjustment of an insurance claim, or a life insurance application; binds a "medical provider".
Patient's own request follows HIPAA patient access rules. Ark. Code § 16-46-106(h)(1), as added by Act 765 of 2023
In force · effective · read October 3, 2026 · source(arkleg.state.ar.us)
records under this section, then access shall be provided according to all
Who it binds, in our words: Patient or person authorized to request the patient's records.
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Opt-out set by OHIT rule, 25 CAR pt. 20. Date is the Code of Arkansas Rules effective date; first rule filed 2011. Rule tells entities not to send records needing special protection, such as 42 CFR Part 2 records.
Set by a regulation.
Designated exchange: State Health Alliance for Records Exchange (SHARE), run by the Office of Health Information Technology.
Some sensitive records need your consent even where routine records do not.
Individual control of information available through the State Health Alliance for Records Exchange. 25 CAR § 20-105(b)
In force · effective · read October 3, 2026 · source(codeofarrules.arkansas.gov)
All individuals may choose not to have information about them made available through the State Health Alliance for Records Exchange.
Who it binds, in our words: This policy applies to the Office of Health Information Technology, the State Health Alliance for Records Exchange, and all participating entities.
Information subject to special protection. 25 CAR § 20-107(b)(5)
In force · effective · read October 3, 2026 · source(codeofarrules.arkansas.gov)
Participating entities should not make protected health information requiring special protection available to the State Health Alliance for Records Exchange.
Who it binds, in our words: This policy applies to the Office of Health Information Technology and all participating entities.
Second check by a separate agent: confirmed.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Reports to the Health Department are confidential; disclosure to law enforcement needs a court order on good cause. Act 560 of 2021 has no emergency clause; date is the 2021 general effective date.
Informed Consent for Chemical Abortion Act: individual reporting, confidentiality. Ark. Code § 20-16-2504(b)(1) (enacted as § 20-16-2404 by Act 560 of 2021)
In force · effective · read October 3, 2026 · source(arkleg.state.ar.us)
section is not a public record and shall remain confidential except that a
Who it binds, in our words: Individual reporting forms that a healthcare provider or healthcare facility submits to the Department of Health.
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Rule in the therapeutic communities certification manual requires informed consent procedures for release. Date is the Code of Arkansas Rules effective date. Statute 20-46-104 found only through a lead.
Confidentiality of mental health and drug or alcohol abuse treatment information. 20 CAR § 416-311(b)
In force · effective · read October 3, 2026 · source(codeofarrules.arkansas.gov)
and the procedures for informed consent for release of information from the record must be followed.
Who it binds, in our words: Programs under 20 CAR pt. 416, the Therapeutic Communities Certification Manual.
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Medical Board rule keeps practitioner HIV status reports confidential and not subject to subpoena. Statute 20-15-904 on HIV reports found only through leads. Date is the Code of Arkansas Rules effective date.
Reports and information confidentiality (practitioner HIV, HBeAg and HCV status). 17 CAR § 140-1006(a)
In force · effective · read October 3, 2026 · source(codeofarrules.arkansas.gov)
Reports and information furnished to the Arkansas State Medical Board relative to the HbeAg, HCV, or HIV status of a practitioner shall not be deemed to constitute a public record but shall be deemed and maintained by the board as confidential and privileged as a medical record
Who it binds, in our words: Reports to the Arkansas State Medical Board about a practitioner's HIV, HBeAg or HCV status.
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Limits compelled disclosure of genetic information in proceedings, with four listed exceptions. Date is 91 days after the 2001 session ended May 14, 2001 under Amendment 7; no amending act found.
Disclosures of genetic information: compulsory disclosure. Ark. Code § 16-43-1101 (Act 1222 of 2001)
In force · effective · read October 3, 2026 · source(arkleg.state.ar.us)
No person or other entity who maintains genetic information
Who it binds, in our words: Any person or other entity who maintains genetic information.
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
No. Only the attorney general or a regulator can enforce these laws.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Breach law enforcement is by the Attorney General. Genetic employment and research acts of 2001 opened had no private suit clause. 16-46-106(f) awards fees when a patient must subpoena records; not a suit for misuse.
Damages a court may award: None found
Personal Information Protection Act: penalties. Ark. Code § 4-110-108 (Act 1526 of 2005)
In force · effective · read October 3, 2026 · source(arkleg.state.ar.us)
Attorney General under the provisions of §§ 4-88-101 through 4-88-115.
Who it binds, in our words: Violations of the Personal Information Protection Act.
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
Partly. The breach notice law covers one of the two: medical information or health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Medical information is in the definition; health insurance information is not. HIPAA is not named; the deemed-compliance clause covers entities under a federal law with equal or stronger breach rules. 2005 date is 91 days after the May 13, 2005 session end.
Deadline to tell people: most expedient time and manner possible and without unreasonable delay.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
Personal Information Protection Act: definition of medical information. Ark. Code § 4-110-103(5) (Act 1526 of 2005)
In force · effective · read October 3, 2026 · source(arkleg.state.ar.us)
"Medical information" means any individually identifiable
Who it binds, in our words: Persons, businesses and state agencies that acquire, own or license computerized personal information of Arkansas residents.
Personal information includes medical information. Ark. Code § 4-110-103(7)(D) (Act 1526 of 2005; subdivision (7) last amended by Act 1030 of 2019)
In force · effective · read October 3, 2026 · source(arkleg.state.ar.us)
(D) Medical information;
Who it binds, in our words: Name in combination with the data element, when either is not encrypted or redacted.
Disclosure of breach: timing. Ark. Code § 4-110-105(a)(2) (Act 1526 of 2005)
In force · effective · read October 3, 2026 · source(arkleg.state.ar.us)
manner possible and without unreasonable delay, consistent with the
Who it binds, in our words: Notice to any Arkansas resident whose unencrypted personal information was or is reasonably believed to have been acquired.
Disclosure of breach to the Attorney General. Ark. Code § 4-110-105(b)(2) (Act 1030 of 2019)
In force · effective · read October 3, 2026 · source(arkleg.state.ar.us)
breach is disclosed to an affected individual or within forty-five (45) days
Who it binds, in our words: Breaches affecting the personal information of more than 1,000 individuals.
Exemptions: compliance with other law deemed compliance. Ark. Code § 4-110-106(a)(2) (Act 1526 of 2005)
In force · effective · read October 3, 2026 · source(arkleg.state.ar.us)
Compliance with the state or federal law shall be deemed
Who it binds, in our words: A person or business regulated by a state or federal law with greater protection and at least as thorough breach disclosure rules.
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No law in force on AI in care or coverage. HB1297 and HB1816 of 2025 did not pass. Insurance Department Bulletin 13-2024 on insurer AI use is guidance, not law, and was not scored.
How we searched (October 3, 2026): the official code search for artificial intelligence, algorithm, automated decision, prior authorization, utilization review, generative artificial intelligence. Agency pages checked: portal.insurance.arkansas.gov.
Second check by a separate agent: confirmed.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
11.3%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
91.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
82.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
15.4%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$56,335 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
4.3%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
6.0%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
7.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
12.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
