AI Is Already Entering Arkansas Healthcare. Who Is Responsible for Keeping It Safe?

In Brief

• AI is reaching Arkansas patients through three doors at once: health system pilots, features switched on inside existing vendor software, and staff using consumer tools on their own. Each door carries a different owner for the risk.
• Under HIPAA, an AI vendor that handles protected health information on your behalf is a business associate. Without a Business Associate Agreement, sharing PHI with that tool is likely an impermissible disclosure, regardless of how useful the output is.
• Responsibility for accuracy stays with the clinician who signs the note, and federal nondiscrimination rules already require covered providers to identify and mitigate discrimination risks in clinical decision support tools.

The Short Answer

When an AI tool handles patient information in an Arkansas clinic, the practice remains responsible for the privacy and security of that data, the vendor is responsible for the safeguards it contractually promises, and the clinician remains responsible for anything that enters the medical record. Safety comes from making each of those responsibilities explicit before the tool is in use, not from trusting that someone else has handled it.

What Is Actually Happening in Arkansas

It is easy to talk about healthcare AI in the abstract. The Arkansas picture is more concrete.

Baptist Health, headquartered in Little Rock, began piloting AI-powered ambient documentation for nurses in August 2024. According to a case study published by the Health Management Academy, the pilot used a Microsoft ambient tool through Epic's Rover mobile application across six medical-surgical units, with the goal of automating flowsheet documentation that nurses would otherwise enter by hand.

At the University of Arkansas for Medical Sciences, researchers have been working on a different problem: how to let staff use large language models without sending patient data outside the institution. At the Translational Research Institute's AI symposium in April 2025, UAMS biomedical informatics leadership announced that the university was building the legal and technical framework to offer researchers language models that keep patient data inside UAMS firewalls. UAMS also hosts an annual Innovations in Artificial Intelligence Conference; the third was scheduled for October 8 and 9, 2026, on the Little Rock campus.

Both examples share a feature that smaller practices often skip. The organization decided in advance where the data would go, who would use the tool, and how results would be measured. That deliberateness is the part of their approach that scales down to a four-physician clinic in Sherwood.

Three Ways AI Arrives, and Who Owns Each

Door 1: A Deliberate Purchase

A practice selects an AI scribe, a prior-authorization assistant or a patient-messaging tool. This is the most controllable path. The practice can negotiate a Business Associate Agreement, ask where data is processed and stored, and decide whether recordings are retained.

Door 2: A Feature That Appears

The EHR, phone system or office suite releases an update, and an AI summarization button appears. No purchase decision occurred, so no one reviewed it. The relevant question is whether the vendor's existing agreement covers the new feature and whether data now flows to a sub-processor that was not part of the original arrangement.

Door 3: An Employee Who Found a Shortcut

A billing specialist pastes a denial letter into a free chatbot to draft an appeal. A provider dictates into a consumer transcription app. Nobody intends harm, and the output may be excellent. But the practice has no agreement with that service, no control over retention, and often no record that the disclosure happened.

The third door is the one most practices underestimate, because it is invisible until someone looks.

A Responsibility Map for AI That Touches Patient Data

The table below assigns primary ownership for the risks that come up most often. It is a governance starting point, not a legal opinion.

Risk	Primary owner	What "owning it" means in practice
PHI disclosed to an unapproved tool	Practice leadership	Publish an approved-tools list; block or monitor high-risk consumer AI sites on clinic networks; train staff on why
Vendor safeguards and sub-processors	Vendor, verified by practice	Signed BAA; written answers on storage location, retention and model training on your data
Accuracy of AI-drafted notes	Signing clinician	Review before signing; never auto-file drafts; document the review expectation in policy
Discriminatory outputs in decision support	Practice as a covered entity	Inventory tools that use protected characteristics; ask vendors for input variables; monitor
Security of the integration	Practice IT partner and vendor	Least-privilege API access, logging, MFA on admin accounts, offboarding when the contract ends
Patient transparency	Practice leadership	Decide how and when patients are told an AI tool is listening or drafting

The nondiscrimination line deserves emphasis. The 2024 Section 1557 final rule requires covered entities to make reasonable efforts to identify patient care decision support tools that use race, color, national origin, sex, age or disability as inputs, and to mitigate the risk of discrimination. Those provisions became enforceable May 1, 2025. The obligation sits with the provider using the tool, even when the developer is not itself subject to Section 1557.

Questions to Ask Before an AI Tool Touches PHI

Most vendor sales conversations focus on time saved. These questions focus on what happens to your data.

1. Will you sign a Business Associate Agreement that covers this specific product and feature?
2. Where is audio, text or image data processed, and where is it stored? For how long?
3. Is any of our data used to train or improve models, including de-identified data? Can we opt out in writing?
4. Which sub-processors receive our data, and will you notify us before adding new ones?
5. Can we export or delete our data when the contract ends, and how will you confirm deletion?
6. What audit logs do we receive, and can they show which user generated which output?
7. What accuracy testing have you performed for our specialty, and how do you report errors?
8. Does the tool use protected characteristics as inputs to any recommendation?

A vendor that cannot answer these clearly is telling you something about its maturity.

Practical Safeguards for Smaller Clinics

Large systems build AI governance committees. A practice in Cabot or Maumelle needs something lighter that still works.

Name one accountable person. A practice administrator or medical director owns the approved-tools list and signs off on new AI features. Without an owner, Door 2 and Door 3 stay open indefinitely.

Write a one-page AI use rule. Staff need to know three things: which tools are approved, what may never be entered into an unapproved tool (patient identifiers, images, insurance numbers), and whom to ask. Longer policies are useful later; a page that people read is useful now.

Turn on what your existing tools already offer. Many organizations already license enterprise AI features covered by existing agreements. Directing staff to an approved option reduces the pull toward consumer tools far more effectively than prohibition alone.

Keep the clinician in the loop by design. Configure ambient and drafting tools so output arrives as a draft requiring review. Make "I reviewed and edited this" part of the signing workflow, not an assumption.

Fold AI into the risk analysis. Every AI tool that touches ePHI belongs in your HIPAA asset inventory and risk analysis, with the same scrutiny as any other system. A tool that was never inventoried cannot be defended.

Plan the exit. Know before signing how you will retrieve and delete data if the product is discontinued, acquired or replaced. Early-stage AI vendors change hands frequently.

Where Behavioral Health and Specialty Practices Need Extra Care

Some records carry heightened protections. Substance use disorder treatment records governed by 42 CFR Part 2, psychotherapy notes and certain reproductive health information each have rules beyond baseline HIPAA. An ambient tool recording a therapy session or an addiction medicine visit raises questions a general-purpose scribe vendor may not have considered. Practices in these specialties should confirm with counsel and the vendor how those categories are handled before deployment, not after.

Conclusion

The question in the headline has a clear answer, even if it is not a comfortable one. The organization that delivers the care is responsible for the safety of the tools it lets into that care, whether it bought them deliberately, received them in an update, or never knew staff were using them. Arkansas's larger systems are showing that AI can be adopted thoughtfully. Smaller practices can do the same with a short list of approved tools, a signed agreement for each, a clinician review step that cannot be skipped, and a person whose job is to say yes or no.

Talk to Meem Health

Meem Health helps Central Arkansas healthcare organizations evaluate AI tools, review vendor data practices, fold AI systems into HIPAA risk analysis, and put technical guardrails around approved and unapproved use. If an AI feature is about to switch on in your practice, we can help you review it first. Call 501-777-5177 or visit our Digital Transformation & AI services.