State agencies, a teaching hospital and a large bank all sit in Little Rock, and all of them get audited.
Arkansas runs its government from Little Rock, and UAMS and Bank OZK are based in the same city. Each keeps sensitive records about Arkansans and each gets audited. In our Little Rock conversations the question is how quickly they can show who had access, and why.
- Identity Governance & AdministrationCybersecurity
- Privileged Access ManagementCybersecurity
- Governance, Risk & ComplianceCybersecurity
- Healthcare Provider PlatformsEnterprise Platforms
- Banking & Capital Markets PlatformsEnterprise Platforms
- Data Governance & AccessData & Analytics
- AI Governance & SecurityAI & Machine Learning
In Little Rock we work with state agencies and their contractors, academic and regional health systems, and banks.
The work covers identity governance and access reviews, privileged access for shared admin accounts, data platforms for clinical and agency reporting, and rules for AI tools on state and patient data. We are headquartered in Frisco, Texas, serve Arkansas clients remotely and travel to Little Rock for workshops and launches.
Cohash has no office in Arkansas. We are based in Frisco, Texas. Projects run remotely, and we travel in for discovery, design workshops and go-live weeks.
- rules
- Arkansas Personal Information Protection Act, Ark. Code §4-110-105Arkansas Act 1030 of 2019, biometric dataHIPAA Security Rule technical safeguards, 45 CFR §164.312
What's specific about Little Rock
Each figure comes from a public source, linked on the card.
Government accounts for 68,300 of the Little Rock-North Little Rock-Conway metro's 397,100 nonfarm jobs in September 2026 (preliminary), per BLS, and education and health services for 68,800.
source ↗ 02 500,671The University of Arkansas for Medical Sciences in Little Rock lists 559 hospital beds and 500,671 UAMS Health outpatient visits for fiscal 2025 on its fast facts page, along with 3,553 students in fall 2025.
source ↗ 03 $40 billionBank OZK, which lists a Little Rock mailing address, reports more than $40 billion in assets and more than 260 offices across nine states.
source ↗ 04Arkansas's Office of State Technology, within the Department of Shared Administrative Services, reports that in March 2025 the Governor blocked DeepSeek, RedNote and Lemon8 from executive branch devices.
source ↗ 05The Port of Little Rock sits on the McClellan-Kerr Arkansas River Navigation System, which the port describes as 443 miles long with 18 locks and dams.
source ↗Who we work with in Little Rock, and the rules they work under
-
State agencies and their contractors
Agency staff, county users and vendor developers often share one directory and a handful of admin accounts that nobody has rotated in years. We run access reviews by program, put shared admin accounts in a vault with session recording, and write the joiner and leaver rules so contractor access ends when the contract does.
-
Academic medicine and hospitals
A teaching hospital mixes clinicians, residents, students, researchers and regional clinic staff, and one person can hold three of those roles at once. We model those roles in the governance platform, connect them to the EHR and research systems and remove access when a rotation or study ends.
-
Regional and community banking
Banks that grew through acquisitions carry several cores, loan systems and branch directories. Examiners ask for evidence of least privilege and timely terminations. We consolidate entitlements, automate quarterly certifications and keep privileged access to the core under recorded sessions.
-
AI use in government and health
Arkansas already restricts some apps on state devices. Agencies and hospitals adding AI assistants still need a list of approved tools, an identity for each agent and rules on which records it can read. We help write that policy and build the controls that enforce it.
-
Arkansas Personal Information Protection Act, Ark. Code §4-110-105 ↗
If a breach affects more than 1,000 people, the Attorney General must be told at the same time as residents or within 45 days of determining a reasonable likelihood of harm, whichever is first. The written breach determination must be kept for five years and produced within 30 days of an AG request.
-
Arkansas Act 1030 of 2019, biometric data ↗
The same act added biometric data such as fingerprints, faceprints, retinal or iris scans, hand geometry and DNA to the definition of personal information when it is used to authenticate a person. Biometric sign-in data at hospitals or banks therefore falls under the breach law.
-
HIPAA Security Rule technical safeguards, 45 CFR §164.312 ↗
For academic and regional health systems and their vendors, the rule sets standards for access control, unique user IDs, audit controls, integrity and person or entity authentication on electronic PHI.
Most requested in Little Rock
The services clients in Little Rock ask us for most.
- CybersecurityIdentity Governance & Administration
- CybersecurityPrivileged Access Management
- CybersecurityGovernance, Risk & Compliance
- Enterprise PlatformsHealthcare Provider Platforms
- Enterprise PlatformsBanking & Capital Markets Platforms
- Data & AnalyticsData Governance & Access
- AI & Machine LearningAI Governance & Security
01Do we have to tell the Arkansas Attorney General about every breach?
No. AG notice applies when more than 1,000 people are affected, and the AG's office says it is required when you determine there is a reasonable likelihood of harm. Either way, keep the written determination for five years. Counsel should make the harm call.
02Does Arkansas have a comprehensive consumer privacy law like Texas?
We have not found one in force as of October 2026, so Arkansas obligations for most businesses come from the breach statute, sector rules such as HIPAA and GLBA, and contracts. If you also hold data on Texans or Tennesseans, those states' privacy acts may apply. Confirm with counsel.
03Our employees sign in with fingerprints on shared workstations. Is that covered?
Yes, if the fingerprint data authenticates them. Since Act 1030 of 2019 Arkansas counts biometric data used that way as personal information, so a leak of the template store is a reportable breach. We review where templates are stored and who can export them.
04How do you run access reviews for a state agency with many contractors?
We group access by program and system, assign each contractor account a sponsor and an end date, and send reviews to program managers who know the work. Accounts with no sponsor get disabled after a notice period you set.
5ae2294e - 01BLS, Little Rock-North Little Rock-Conway economy at a glancebls.gov ↗
- 02UAMS fast factsweb.uams.edu ↗
- 03Bank OZK, Aboutozk.com ↗
- 04Arkansas Department of Shared Administrative Services, Office of State Technologysas.arkansas.gov ↗
- 05Port of Little Rockportoflittlerock.com ↗
- 06Arkansas Act 1030 of 2019 (HB 1943), amending the Personal Information Protection Actarkleg.state.ar.us ↗
- 07Arkansas Attorney General, security or data breacharkansasag.gov ↗
- 0845 CFR §164.312 (Cornell LII)law.cornell.edu ↗
Tell us what you're running. We'll tell you what we'd do first.
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it