Arkansas Business recently published "Arkansas Hospitals Brace for New HIPAA Cybersecurity Rules," by Mark Friedman. It looks at how hospitals and providers across the state are getting ready for the biggest update to the HIPAA Security Rule in years. We were glad to see our Director of Technology & Cybersecurity, Teri Westbrook, contribute to the story. Her point is one we hear from clients regularly: many healthcare providers don't realize that putting patient information into AI tools can expose it online.

Here's our take on the article, what it means for your organization, and how we can get you AI ready.

What the Article Covers

The U.S. Department of Health & Human Services (HHS) announced in late 2024 that it would tighten the rules for protecting patients' electronic health information. Final rules were first expected in May 2026. After providers raised concerns about cost, the deadline moved to July 2027, and the article notes that "it's unclear whether that July deadline will be met."

Expected changes include "regular vulnerability scans, stronger controls and documented policies." These are the basics of a solid security program, and they will soon be written into the rules instead of left as suggestions.

The threats are growing too. The article cites HIPAA Journal data showing 772 large healthcare data breaches in 2025, up 4% from 2024, and notes that "criminals are using AI to help break into networks."

Thousands of cyberattacks are stopped constantly across all of Pinnacle IT’s networks. If criminals get their hands on patient information, it could be sold to other criminals. That information could then be used to impersonate a patient, “and then they go and have very expensive procedures done as someone else,” Westbrook said.

Our Take: Use the Extra Time Wisely

A later deadline can feel like breathing room. We see it differently. Teri put it simply, “I think people are going to continue doing what they’re doing, which is a whole lot of nothing,” she said. “And then the law is going to go into effect, and people are probably going to panic.”

Ransomware groups, credential thieves, and attackers who target vendors aren't waiting until 2027. Neither are the patients who expect their information to stay private. Organizations that use this extra time to build steadily will reach the deadline ready for an audit. Those that wait will be rushing to buy tools, write policies, and train staff all at once, which almost always costs more.

Based on the proposed rule, Teri pointed to the controls most organizations should expect to put in place or formally verify:

• Multi-factor authentication (MFA)
• Encryption of electronic patient health information, both stored and in transit
• Annual penetration testing
• Vulnerability scanning at least every six months
• Network segmentation
• Complete inventories of technology assets and network diagrams
• Written incident response and disaster recovery plans

None of these are new ideas. What's changing is that "we're working on it" will no longer be a good enough answer.

The Blind Spot: AI and Patient Data

The article's most important warning may be the one that's easiest to miss. AI tools are already part of daily work in healthcare. Staff use them to summarize notes, draft patient letters, write policies, and speed up billing. Most of it is well-meant. But when someone pastes patient information into a free or consumer AI tool, that data may leave your control. It could be stored, used to train the tool, or exposed in ways your security program never planned for.

That's the gap Teri raised in the article, and it's why we treat AI readiness as part of cybersecurity, not a separate project. Before any organization rolls out AI, whether that's Microsoft 365 Copilot, ChatGPT Enterprise, or a tool built into an electronic health record system, it should be able to answer a few basic questions:

• What data will this tool be able to access, and who has permission to see it today?
• Is our sensitive information labeled and protected, or is it scattered across file shares and inboxes?
• Does the vendor sign a business associate agreement (BAA), and where is our data processed and stored?
• Do employees have a clear, written policy on which AI tools are approved and what they can never enter into them?
• Can we monitor how AI is being used across the organization?

If those answers aren't clear, AI tools can multiply your risk. For example, a tool like Copilot shows users whatever they already have permission to see. If your file permissions are too loose, AI will make that problem visible very quickly.

How Pinnacle IT Helps

Pinnacle IT has supported Arkansas organizations for more than three decades. Healthcare and HIPAA compliance are at the center of what we do. We help in two connected ways.

Cybersecurity and HIPAA Compliance

• Security risk assessments. We review your environment against HIPAA and frameworks such as NIST and CIS, then give you a prioritized plan instead of a pile of findings.
• Vulnerability management and penetration testing. We run regular scans and penetration tests to find weaknesses before attackers do.
• 24/7/365 monitoring with endpoint detection and response. Our team watches your network around the clock and stops threats in real time.
• Identity and access controls. We set up MFA, manage high-level administrator access, and limit permissions so only the right staff can access patient data.
• Policies and documentation. We help you write incident response, disaster recovery, and security policies that hold up in an audit.
• Backup, recovery, and business continuity. We protect your data and test your recovery plan so you know it works before you need it.
• Vendor and BAA management. We help make sure your third-party vendors meet the same standards you do.

AI Readiness

• AI readiness and risk assessments. We check whether your identity setup, data labeling, permissions, and security are ready for AI, using frameworks such as the NIST AI Risk Management Framework alongside HIPAA.
• Platform guidance. We help you choose and set up enterprise AI tools such as Microsoft 365 Copilot and ChatGPT Enterprise with the right licenses and safeguards.
• Governance and acceptable-use policies. We write clear rules for which tools are approved, what data can be used, and how use is monitored.
• Data protection before rollout. We clean up loose file permissions, label sensitive data, and put data loss prevention in place so AI only surfaces what it should.
• Staff training. We help your team use AI productively and safely, because the best tools still depend on the people using them.

The goal isn't to slow down innovation. It's to make sure AI helps your organization without putting patient trust at risk.

Practical, Local, and Proven

We know the AHA's cost concerns are real. Most healthcare organizations in Arkansas don't have unlimited IT budgets. That's why we don't sell quick fixes or one-size-fits-all packages. We start with an honest assessment, focus on the controls that reduce the most risk first, and build a roadmap that fits your budget and timeline. With offices across the state, we can also come on-site when remote help isn't enough.

Start With a Free Assessment

Whether you need to prepare for the new HIPAA Security Rule, or you are wondering what your staff is already putting into AI tools, or both, the first step is the same: find out where you stand.

Request your free security and AI readiness assessment or call (877) 938-9450.

Read the full article: "Arkansas Hospitals Brace for New HIPAA Cybersecurity Rules," Arkansas Business, October 5, 2026 (subscription required)