What a provider can and can't say in Arkansas
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 17-95-409(a)(2)(N); no board order located |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Partly: dental grounds not read | 17-95-409(a)(2)(N); no board order located |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 17-95-409(a)(2)(N); no board order located |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 17-95-409(a)(2)(N); no board order located |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No | 17-95-409(a)(2)(N); no board order located |
- Consumer privacy and health data law: Arkansas has no comprehensive consumer privacy law in force as of October 22, 2026. A narrower enacted law, the Arkansas Children and Teens' Online Privacy Protection Act (Act 952 of 2025, effective July 1, 2026), applies only to online operators directed to children or teens or with actual knowledge of them; it is enforced by the attorney general, with no private right of action. [AR-006]
- Data breach notification: Its data breach notification law covers medical information. Regulator notice: attorney general if more than 1,000 residents affected.† [AR-001, AR-002]
- Patient confidentiality duties: Patient confidentiality duties come mainly from licensing-board discipline rules.† [AR-003]
- Patient confidentiality duties: The licensing board can discipline willful breaches of patient confidentiality (17-95-409(a)(2)(N)).† [AR-003]
- Lawsuits by individuals: No private right of action was located in the statutes reviewed; other claims, such as privacy torts, may still exist. [U-98]
- Photos, names and likeness: A statute limits using a person's name or likeness in advertising without consent (Broyles Act 4-75-1101+). [AR-005]
- Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures. [AR-004]
- Enforcement located: Strongest state enforcement evidence located: the law exists but no state enforcement was located (E4). Not finding enforcement does not mean none exists.† [AR-003, U-97]
- Research notes and gaps: Some Arkansas code text was read on an unofficial website and should be confirmed against the official code. [U-95]
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources:
- [AR-001] Ark. Code 4-110-103(5), (7); 4-110-105(a), (b)(2), (d), (g) (https://law.justia.com/codes/arkansas/title-4/subtitle-7/chapter-110/section-4-110-103/)
- [AR-002] Ark. Code 4-110-106(a) (https://law.justia.com/codes/arkansas/title-4/subtitle-7/chapter-110/section-4-110-106/)
- [AR-003] Ark. Code 17-95-409(a)(2)(L), (N), (P) (https://law.justia.com/codes/arkansas/title-17/subtitle-3/chapter-95/subchapter-4/section-17-95-409/)
- [AR-004] 17 CAR 140-1601(a)-(d) (https://codeofarrules.arkansas.gov/Rules/Rule?chapterID=173&levelType=section&partID=1045§ionID=36295&subChapterID=216&subPartID=5595&titleID=17)
- [AR-005] Ark. Code 4-75-1101 to -1104 (Act 8 of 2016, 3d Ex. Sess.) (https://webftp.blr.arkansas.gov/Home/FTPDocument?path=ACTS%2F2016S3%2FPublic%2FSearchable%2FACT8.pdf)
- [AR-006] Act 952 of 2025 (HB 1717) (https://arkleg.state.ar.us/Home/FTPDocument?path=%2FACTS%2F2025R%2FPublic%2FACT952.pdf)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Arkansas (AR) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | 17-95-409(a)(2)(N) willful betraying of a professional secret | Yes - applies to licensed providers regardless of HIPAA status | None comprehensive (Act 952 of 2025 children/teens only, eff. 2026-07-01) | 4-110: medical info COVERED; most expedient time; AG >1,000 (<=45 days); greater-protection deemed compliance | 17-95-409(a)(2)(N); no board order located | HIPAA if covered; Broyles Act 4-75-1104 consent | Frank Broyles Publicity Rights Protection Act, 4-75-1101 et seq. | None located under PIPA (common law not researched) | State Medical Board, Board of Dental Examiners, Board of Nursing, AG | License sanctions (17-95-410, amounts not read); AG DTPA | E4 | Medium-High | 2026-10-22 |
| Arkansas (AR) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | 17-95-409(a)(2)(N) willful betraying of a professional secret | Partly: dental grounds not read | None comprehensive (Act 952 of 2025 children/teens only, eff. 2026-07-01) | 4-110: medical info COVERED; most expedient time; AG >1,000 (<=45 days); greater-protection deemed compliance | 17-95-409(a)(2)(N); no board order located | HIPAA if covered; Broyles Act 4-75-1104 consent | Frank Broyles Publicity Rights Protection Act, 4-75-1101 et seq. | None located under PIPA (common law not researched) | State Medical Board, Board of Dental Examiners, Board of Nursing, AG | License sanctions (17-95-410, amounts not read); AG DTPA | E4 | Medium-High | 2026-10-22 |
| Arkansas (AR) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | 17-95-409(a)(2)(N) willful betraying of a professional secret | Yes - applies to licensed providers regardless of HIPAA status | None comprehensive (Act 952 of 2025 children/teens only, eff. 2026-07-01) | 4-110: medical info COVERED; most expedient time; AG >1,000 (<=45 days); greater-protection deemed compliance | 17-95-409(a)(2)(N); no board order located | HIPAA if covered; Broyles Act 4-75-1104 consent | Frank Broyles Publicity Rights Protection Act, 4-75-1101 et seq. | None located under PIPA (common law not researched) | State Medical Board, Board of Dental Examiners, Board of Nursing, AG | License sanctions (17-95-410, amounts not read); AG DTPA | E4 | Medium-High | 2026-10-22 |
| Arkansas (AR) | Medical med spa | Depends; cash-only med spas often not covered | 17-95-409(a)(2)(N) willful betraying of a professional secret | Yes - applies to licensed providers regardless of HIPAA status | None comprehensive (Act 952 of 2025 children/teens only, eff. 2026-07-01) | 4-110: medical info COVERED; most expedient time; AG >1,000 (<=45 days); greater-protection deemed compliance | 17-95-409(a)(2)(N); no board order located | HIPAA if covered; Broyles Act 4-75-1104 consent | Frank Broyles Publicity Rights Protection Act, 4-75-1101 et seq. | None located under PIPA (common law not researched) | State Medical Board, Board of Dental Examiners, Board of Nursing, AG | License sanctions (17-95-410, amounts not read); AG DTPA | E4 | Medium-High | 2026-10-22 |
| Arkansas (AR) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | 17-95-409(a)(2)(N) willful betraying of a professional secret | No | None comprehensive (Act 952 of 2025 children/teens only, eff. 2026-07-01) | 4-110: medical info COVERED; most expedient time; AG >1,000 (<=45 days); greater-protection deemed compliance | 17-95-409(a)(2)(N); no board order located | HIPAA if covered; Broyles Act 4-75-1104 consent | Frank Broyles Publicity Rights Protection Act, 4-75-1101 et seq. | None located under PIPA (common law not researched) | State Medical Board, Board of Dental Examiners, Board of Nursing, AG | License sanctions (17-95-410, amounts not read); AG DTPA | E4 | Medium-High | 2026-10-22 |
Related pages
Topics
Healthcare industry
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources
AR-006. Act 952 of 2025 (HB 1717)
No comprehensive consumer privacy law located. Act 952 of 2025 (Arkansas Children and Teens' Online Privacy Protection Act, Ark. Code 4-88-1501 et seq., effective July 1, 2026) covers operators directed to children or teens or with actual knowledge; AG exclusive enforcement; no private right of action.
Statute (session law) · Explicit · High · Not a comprehensive law; negative finding on a comprehensive law per secondary trackers.
https://arkleg.state.ar.us/Home/FTPDocument?path=%2FACTS%2F2025R%2FPublic%2FACT952.pdf
AR-001. Ark. Code 4-110-103(5), (7); 4-110-105(a), (b)(2), (d), (g)
Personal Information Protection Act: 'personal information' includes name plus 'medical information' (individually identifiable information about medical history or medical treatment or diagnosis by a health care professional) and biometric data; notice in the most expedient time possible; AG notice if more than 1,000 individuals at the same time as individuals or within 45 days of determining likely harm; no notice if no reasonable likelihood of harm (determination kept 5 years).
Statute · Explicit · Medium-High · Secondary host (official Code is Lexis-hosted). AG-notice clause sits in subsection (b), which addresses data maintainers (drafting oddity noted).
https://law.justia.com/codes/arkansas/title-4/subtitle-7/chapter-110/section-4-110-103/
AR-002. Ark. Code 4-110-106(a)
PIPA exempts persons regulated by a state or federal law that provides greater protection and at least as thorough breach disclosure; compliance with that law is deemed compliance.
Statute · Explicit · Medium-High · Whether HIPAA qualifies is inferred, not stated.
https://law.justia.com/codes/arkansas/title-4/subtitle-7/chapter-110/section-4-110-106/
AR-003. Ark. Code 17-95-409(a)(2)(L), (N), (P)
State Medical Board unprofessional conduct includes 'the willful betraying of a professional secret', advertising in a false or misleading manner, and violating a Board rule.
Statute · Explicit · Medium-High · Secondary host.
https://law.justia.com/codes/arkansas/title-17/subtitle-3/chapter-95/subchapter-4/section-17-95-409/
AR-005. Ark. Code 4-75-1101 to -1104 (Act 8 of 2016, 3d Ex. Sess.)
Frank Broyles Publicity Rights Protection Act of 2016: an individual has a property right in the commercial use of name, voice, signature, photograph or likeness.
Statute (session law) · Explicit · High · Remedies section not read.
https://webftp.blr.arkansas.gov/Home/FTPDocument?path=ACTS%2F2016S3%2FPublic%2FSearchable%2FACT8.pdf
AR-004. 17 CAR 140-1601(a)-(d)
Medical Board rule: medical laser use, therapeutic or cosmetic, is the practice of medicine; for minor procedures a physician may delegate to trained nonphysician staff only after personally diagnosing and prescribing, must be available for complications and must document who performed it; non-compliance is treated as gross negligence.
Regulation · Explicit · High · Personal diagnosis requirement is stricter than AL/OK models.
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All
U-97. U-97 · Open (accepted limitation)
Licensing-board discipline databases were not census-searched for review-response or confidentiality discipline in any jurisdiction (consolidates U-28, U-42, U-52, U-60, U-69, U-78, U-87). Absence of a located board order is not evidence that none exists.
High priority · All
U-95. U-95 · Open
Claims and cases that remain unverifiable from official sources (bot checks, outages or no public record): Ohio bill status (legislature.ohio.gov connection failed); Tausinga (no docket found); OSBMLS v. Larson final order; TN, AR, MS and GA code text (Justia hosts; tnsosfiles 403); KS-005 rule text (KSBHA 403); MS-004 rule; NM-001 (NMOneSource 403); WV rule 11-1A-12.1.f (LII host); Hawaii HRS text after 2017 (capitol.hawaii.gov Cloudflare, not circumvented); DC B26-0525 status; Aspen Dental final approval order; Cancelmo docket entries (PACERMonitor mirror); basis of the Amazon Ads SDK termination; case-law reproductions on secondary hosts.
High priority · All