Arkansas's Opaque Algorithm to Allocate Health Care Excessively Cut Down Hours for Beneficiaries

Beneficiaries of the Arkansas Department of Human Services (DHS)'s Medicaid waiver program were allocated excessively fewer hours of caretaker visit via an algorithm deployed to boost efficiency, which reportedly contained errors and whose outputs varied wildly despite small input changes.

Risk classification

• Primary risk domain: 5 Human-Computer Interaction
• Primary risk subdomain: 5.2 Loss of human agency and autonomy

The state delegated critical care allocation decisions to an automated system, removing human decision authority and leaving beneficiaries without a meaningful way to appeal or understand the decisions.

Additional risk subdomains

• 7.3 Lack of capability or robustness: The algorithmic tool failed to perform reliably due to significant coding errors regarding diabetes and cerebral palsy.
• 1.3 Unequal performance across groups: The software errors selectively and unfairly reduced care hours for individuals with specific disabilities like cerebral palsy and diabetes.

Causal factors

• Entity: AI
• Intent: Unintentional
• Timing: Post-deployment

The harm was caused by the post-deployment execution of an algorithmic tool that produced unintended and erroneous care cuts due to software bugs.

EU AI Act risk tier

• Risk tier: 2 High Risk

High Risk: The report describes an AI system used in healthcare and public assistance benefits allocation, which has significant implications for safety, fundamental rights, and public interests.

AI system and alleged parties

• AI system: InterRAI home care algorithm (InterRAI)
• AI purpose: Resource Allocation; Health AI Assistant
• Behaviour type: Tool
• Alleged developer: InterRAI
• Alleged deployer: Arkansas Department of Human Services
• Alleged harmed parties: Arkansas Medicaid waiver program beneficiaries, Arkansas healthcare workers

Harm severity

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Minor
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Minor
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Minor, indirect Negligible
• Civil rights: direct Minor, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Minor
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Physical

Reported: The report explicitly describes physical harm, noting that some residents attributed hospitalization to the sudden cuts in care.

Directly caused: N/A

Indirectly caused: The reduction of essential home care hours left severely disabled individuals without assistance for basic tasks, directly leading to at least one reported hospitalization.

Inferred additional harm: It is highly likely that other vulnerable individuals suffered physical injuries, bedsores, or general health deterioration due to the sudden loss of daily care assistance.

Financial

Reported: The report describes indirect financial losses, including family members having to quit county jobs to provide unpaid care.

Directly caused: N/A

Indirectly caused: Family members suffered significant lost income from quitting employment to care for relatives, and Legal Aid incurred substantial litigation costs.

Inferred additional harm: Many families likely faced out-of-pocket expenses for private care or lost wages, totaling tens of thousands of dollars across the affected population.

Differential treatment

Reported: The report describes how the algorithm's errors selectively impacted individuals with specific disabilities.

Directly caused: The system's coding errors selectively reduced care hours for individuals with cerebral palsy and diabetes, resulting in systemic differential treatment of these groups.

Indirectly caused: N/A

Inferred additional harm: Systemic unequal treatment of disabled individuals compared to other Medicaid recipients due to flawed automated profiling.

Civil rights

Reported: The report explicitly describes violations of due process rights, which led to a successful federal lawsuit.

Directly caused: The automated reduction of benefits without proper notice, explanation, or a meaningful appeal process violated the beneficiaries' constitutional rights to due process.

Indirectly caused: N/A

Inferred additional harm: Hundreds of individuals had their civil rights to due process violated by the state's reliance on an uninterpretable and unchallengeable algorithm.

Psychological

Reported: The report describes severe distress, anxiety, and panic among beneficiaries who had their lifelines cut.

Directly caused: N/A

Indirectly caused: Beneficiaries experienced extreme anxiety and fear of forced institutionalization due to the sudden and unexplained loss of care hours.

Inferred additional harm: Widespread psychological distress likely affected hundreds of vulnerable individuals and their families who had to cope with the sudden loss of support.

People affected

• Occurrences reported: 1
• People reportedly harmed: 200
• People reportedly exposed: 1000

Potential causes

Management

• Prioritizing Cost Containment: States adopted algorithms to contain costs rather than prioritize care.
• Ignoring Expert Advice: Arkansas officials ignored advice to grandfather in existing patients.
• Lack of Transparency: Management refused to disclose formulas, citing trade secrets.

Technology

• Cerebral Palsy Coding Error: Software error incorrectly calculated hours for cerebral palsy patients.
• Diabetes Omission in Algorithm: The algorithm version used failed to account for diabetes issues.
• High Algorithmic Complexity: The system's complexity made it impossible for average users to understand.

Data Inputs

• Use of Deeply Flawed Data: Idaho's system relied on flawed data and discarded most of it.
• Lack of Training Data Diversity: AI tools were approved without diverse demographic training data.

Human Factors

• Overreliance on Automation: Assessors deferred to the computer, saying 'it is the computer'.
• Lack of Formula Comprehension: Beneficiaries and assessors could not understand the complex formula.

Process and Methods

• Lack of Technological Due Process: No meaningful ways were provided for individuals to challenge decisions.
• Inadequate Testing by Vendor: The third-party vendor implemented incorrect versions of the algorithm.
• Inadequate Notification Process: The state implemented the algorithm without properly notifying beneficiaries.

Regulatory Environment

• Lack of Regulatory Oversight: In-home care allocation algorithms are not required to be regulated.
• No Mandatory Bias Testing: Manufacturers are not required to test tools for demographic biases.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide detailed, consistent accounts of the algorithmic system's implementation, the specific coding errors (cerebral palsy and diabetes), the legal challenges, and the direct impacts on beneficiaries. The roles of the developer (InterRAI) and the vendor (Center for Information Management) are explicitly documented.
• Ambiguities identified: The exact total number of individuals affected across all states using the InterRAI system is not fully quantified, though the local impact in Arkansas is well-documented.
• Alternative interpretations: None. The causal link between the algorithmic errors and the reduction of care hours is clear and legally established.

A state-level Medicaid administrative algorithm in Arkansas contained coding errors that inappropriately reduced home care hours for disabled individuals. While causing localized physical distress and violating constitutional due process rights for hundreds of citizens, the incident remains a domestic administrative and legal issue with negligible national security implications.

• Overall national security impact: Minor
• Response level: Moderate
• Scope: Single nation
• Primary target: United States
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. The incident represents a past, localized administrative failure rather than an active national security crisis.
• Autonomy: Human-supervised. The system functioned as an automated decision tool with theoretical human oversight, though state workers initially deferred blindly to its outputs.
• Novelty: Established threat. Software coding errors and flawed administrative algorithms in public service delivery are well-documented, pre-existing issues.

Impact by dimension

• Physical security: Negligible. The incident involved a domestic healthcare administrative algorithm and did not affect critical infrastructure, kinetic systems, or national physical security.
• Information security: Negligible. No intelligence compromise, foreign propaganda, or information warfare elements were present in this administrative software failure.
• Sovereignty: Negligible. While the incident disrupted local state-level Medicaid administration, it did not threaten national sovereignty, federal operations, or territorial integrity.
• Economic security: Negligible. Economic impacts were limited to localized personal income losses and state legal costs, with no threat to strategic industries or national economic security.
• Societal stability: Minor. The algorithmic errors caused systemic due process violations and reduced essential care for hundreds of vulnerable disabled individuals, representing a minor civil rights impact managed through standard legal procedures.