Under the Arkansas Personal Information Protection Act (PIPA), which supplements federal HIPAA with its own state breach-notification duties, how does Arkansas law define 'medical information' for breach-notification purposes?
A. Any individually identifiable information, in electronic or physical form, regarding the individual's medical history or medical treatment or diagnosis by a health care professional
B. Only information stored in an electronic health record system certified under federal meaningful-use standards
C. Only laboratory test results, excluding diagnoses or treatment notes
D. Any information a covered entity labels as 'protected health information' under HIPAA, regardless of form
Show answer and reasoning
Correct answer: A. Any individually identifiable information, in electronic or physical form, regarding the individual's medical history or medical treatment or diagnosis by a health care professional
Correct. Ark. Code Ann. § 4-110-103(5) defines 'medical information' as any individually identifiable information, in electronic or physical form, regarding the individual's medical history or medical treatment or diagnosis by a health care professional.
- B: The Arkansas definition is not limited to certified EHR data; it covers medical history, treatment, or diagnosis information in electronic or physical form generally.
- C: The definition is not limited to lab results; it expressly includes medical history and diagnosis or treatment information.
- D: The Arkansas PIPA definition is a distinct state-law definition; it does not simply adopt whatever a covered entity chooses to label PHI under HIPAA.
Source: Ark. Code Ann. § 4-110-103(5) (Personal Information Protection Act)
Under Arkansas PIPA, an individual's first name or initial combined with their last name, plus which of the following unencrypted data elements, triggers the statutory definition of 'personal information' subject to Arkansas's separate state breach-notification duty?
A. The individual's home telephone number alone
B. Medical information, as defined in § 4-110-103(5)
C. The individual's email address alone
D. The individual's employer name alone
Show answer and reasoning
Correct answer: B. Medical information, as defined in § 4-110-103(5)
Correct. Ark. Code Ann. § 4-110-103(7)(D) includes medical information among the data elements that, combined with an individual's first name or initial and last name when unencrypted, constitute 'personal information' triggering PIPA's breach-notification duty.
- A: A home telephone number alone is not one of the enumerated data elements under § 4-110-103(7)(A)-(D).
- C: An email address alone is not one of the data elements listed in § 4-110-103(7)(A)-(D); Arkansas's definition covers Social Security number, driver's license/state ID number, financial account access credentials, and medical information.
- D: An employer name is not one of the enumerated data elements that, combined with a name, creates 'personal information' under this section.
Source: Ark. Code Ann. § 4-110-103(7)(A)-(D)
Under Arkansas PIPA, what timing standard governs disclosure of a security breach involving Arkansas residents' unencrypted medical information, separate from HIPAA's 60-day breach-notification deadline?
A. Disclosure must occur within 5 business days regardless of any law enforcement investigation
B. Disclosure must be made within exactly 45 calendar days of discovery, mirroring most other states' fixed deadline
C. Disclosure must be made in the most expedient time and manner possible and without unreasonable delay, subject to legitimate law enforcement needs
D. Disclosure is required only if more than 500 Arkansas residents are affected
Show answer and reasoning
Correct answer: C. Disclosure must be made in the most expedient time and manner possible and without unreasonable delay, subject to legitimate law enforcement needs
Correct. Ark. Code Ann. § 4-110-105(a)(2) requires disclosure in the most expedient time and manner possible and without unreasonable delay, consistent with the legitimate needs of law enforcement or measures necessary to determine the scope of the breach and restore data integrity.
- A: The rule does not set a fixed 5-business-day deadline, and it expressly allows delay for legitimate law enforcement needs under § 4-110-105(c).
- B: Arkansas's PIPA does not set a fixed 45-day numeric deadline; it uses an expedience/reasonableness standard instead.
- D: PIPA's notification duty to affected Arkansas residents is not conditioned on a 500-person threshold; that figure instead relates to a different provision governing substitute notice eligibility.
Source: Ark. Code Ann. § 4-110-105(a)(2)
Under Arkansas PIPA, is a business required to notify affected individuals of a breach involving their medical information if, after a reasonable investigation, the business determines there is no reasonable likelihood of harm to customers?
A. Yes, notification is always required regardless of harm likelihood
B. Yes, but only if the Arkansas Attorney General grants prior approval to skip notice
C. No, notice is never required for medical information breaches under Arkansas law
D. No, notice is not required if the reasonable investigation shows no reasonable likelihood of harm to customers
Show answer and reasoning
Correct answer: D. No, notice is not required if the reasonable investigation shows no reasonable likelihood of harm to customers
Correct. Ark. Code Ann. § 4-110-105(d) provides that notification under this section is not required if, after a reasonable investigation, the person or business determines that there is no reasonable likelihood of harm to customers.
- A: PIPA does not impose an unconditional notification duty; § 4-110-105(d) creates a harm-based exception.
- B: The exception in § 4-110-105(d) does not require prior Attorney General approval; it operates based on the business's own reasonable investigation.
- C: The exception is not an absolute bar on notification for medical-information breaches; it applies only when the reasonable-investigation, no-harm standard is actually met.
Source: Ark. Code Ann. § 4-110-105(d)
Under Arkansas PIPA, a business may use substitute notice instead of individual written or email notice if it demonstrates that the cost of providing notice would exceed what amount?
A. $250,000
B. $25,000
C. $100,000
D. $1,000,000
Show answer and reasoning
Correct answer: A. $250,000
Correct. Ark. Code Ann. § 4-110-105(e)(3)(A)(i) allows substitute notice if the person or business demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars ($250,000).
- B: $25,000 understates the cost threshold set by the statute.
- C: $100,000 understates the cost threshold set by the statute.
- D: $1,000,000 overstates the cost threshold; the statute sets it at $250,000, not $1,000,000.
Source: Ark. Code Ann. § 4-110-105(e)(3)(A)(i)
