Georgia Healthcare Compliance: Breach Notification + State Medical Records Rules

Georgia layers two patient-data statutes on top of HIPAA: the breach-notification regime at O.C.G.A. § 10-1-910 et seq. and the medical records access rule at O.C.G.A. § 31-33-2. The two practical divergences from HIPAA: Georgia's per-page records-release fee cap at § 31-33-3 and the UDTPA private-right-of-action overlay at O.C.G.A. § 10-1-372 that HIPAA does not provide.

What Georgia statutes actually require

Georgia has no single comprehensive medical-privacy statute analogous to California's CMIA or Texas's HB300. Instead, the medical-data regime is built from three Code provisions:

• Breach notification at O.C.G.A. § 10-1-910 to § 10-1-915. Applies to "information brokers" and "data collectors" — defined broadly to capture any business that handles computerized personal information of Georgia residents.
• Medical records access at O.C.G.A. § 31-33-2. Governs patient access to medical records held by Georgia providers, with a 30-day window under § 31-33-2(b).
• Records retention at O.C.G.A. § 31-33-2(a)(1)(A). Specified record items retained for at least 10 years from the date of creation.

Core obligations:

• Breach definition. § 10-1-911(6) — unauthorized acquisition of unencrypted computerized data containing personal information. "Personal information" includes name combined with SSN, driver's license or state ID, account number with access credential, or password/PIN/access code.
• Individual notification. § 10-1-912(a) — notice to affected Georgia residents in the most expedient time possible, subject to law-enforcement hold. No fixed numeric deadline.
• Consumer reporting agency notification at >10,000 affected. § 10-1-912(d) — written notice to all nationwide consumer reporting agencies. Georgia does not require AG notification by statute.
• Records access. § 31-33-2(b) — copy of medical record within 30 days of written request.
• Fee caps on copies. § 31-33-3 — specific per-page and per-record caps for copies provided to patients.

Where Georgia is stricter than HIPAA

The single comparative table a Georgia practice needs:

| Topic | HIPAA | Georgia | Stricter | |---|---|---|---| | Patient records access | 30 days, +30-day extension (45 CFR § 164.524(b)(2)) | 30 days under O.C.G.A. § 31-33-2(b) | Comparable | | Records retention | 6 years for compliance docs (45 CFR § 164.530(j)); clinical retention deferred to state law | 10 years from creation for specified items (O.C.G.A. § 31-33-2(a)(1)(A)) | Georgia on clinical retention | | Breach individual notice | 60 days from discovery (45 CFR § 164.404(b)) | "Most expedient time possible" (O.C.G.A. § 10-1-912(a)) | HIPAA gives fixed ceiling; Georgia practically faster | | CRA notification threshold | None for CRAs; HHS at any size | Notice to nationwide CRAs at >10,000 Georgia residents (O.C.G.A. § 10-1-912(d)) | Georgia on CRA path | | UDTPA exposure | None | Individual claims for unfair business practice (O.C.G.A. § 10-1-372) | Georgia | | Encryption safe harbor | Encrypted-data exclusion (45 CFR § 164.402) | Unencrypted-data trigger (O.C.G.A. § 10-1-911(6)) | Comparable | | Civil penalty per violation | Tier-1 $145–$73,011; higher tiers use $1,461 / $14,602 / $73,011 minimums and a $2,190,294 annual cap per identical violation (penalties assessed on or after Jan. 28, 2026 — 45 CFR § 102.3; 91 FR 3665) | Fair Business Practices Act civil penalties up to $5,000 per violation under O.C.G.A. § 10-1-397 | HIPAA per-violation higher |

Where Georgia practices most often trip is the records-release fee cap at § 31-33-3. The statute prescribes tiered per-page and per-record caps for copies furnished to patients; a flat copying fee or a vendor-pass-through charge can violate the cap and trigger UDTPA exposure or Composite Medical Board complaints. A Georgia practice running a generic HIPAA workflow without state-specific fee-cap review is the most common pattern we see.

The other consistent surprise is the 10-year records retention floor under § 31-33-2(a)(1)(A). HIPAA's six-year retention applies to compliance documentation, not to clinical records — clinical retention is governed by state law. Georgia's 10-year floor (running from creation of the specified items) is the binding requirement, and a practice that purges clinical records on a six-year HIPAA-shaped schedule has likely violated Georgia retention.

Where HIPAA is stricter than Georgia

The three areas where federal law is the harder rule:

• Security Rule technical safeguards. Georgia has no analogous statute. HIPAA's Security Rule at 45 CFR Part 164, Subpart C prescribes a structured technical, administrative, and physical safeguards program — annual risk analysis, audit logging, encryption decisions, contingency planning, sanction policy.
• Breach risk assessment methodology. HIPAA's four-factor analysis at 45 CFR § 164.402 governs whether a security incident qualifies as a reportable breach. Georgia's breach statute does not impose a comparable methodology; Georgia regulators look to the federal framework when reviewing § 10-1-912 filings.
• Authorization specificity. HIPAA's authorization rules at 45 CFR § 164.508 prescribe content, format, and expiration. Georgia has no parallel statutory authorization form.

Breach notification timeline

A Georgia practice that discovers a breach affecting GA residents runs three parallel notifications:

1. Individual notice "in the most expedient time possible" under O.C.G.A. § 10-1-912(a). No fixed numeric outer deadline; AG enforcement and best practice treat 45 days as the working ceiling absent investigative complexity. The notice must describe the categories of personal information involved and provide contact information for the major credit bureaus.
2. Consumer reporting agency notification at >10,000 affected under O.C.G.A. § 10-1-912(d) — written notice to all nationwide consumer reporting agencies. Under the 10,000 threshold, CRA notice is not required.
3. Processor-to-owner notice within 24 hours under O.C.G.A. § 10-1-912(b) — applies only when the entity that suffers the breach maintains the data on behalf of a separate data owner.
4. HHS report and individual notice under HIPAA at 45 CFR § 164.408 and 45 CFR § 164.404 — 60-day individual notice; HHS report within 60 days for 500+ affected.

Substitute notice via statewide media is available under O.C.G.A. § 10-1-912 when the cost of direct notice would exceed $250,000 or more than 500,000 Georgia residents are affected.

Penalties + private right of action

The numbers a Georgia practice needs:

• Fair Business Practices Act penalties. O.C.G.A. § 10-1-397 — up to $5,000 per violation in AG enforcement under the FBPA; up to $5,000 per intentional violation plus injunctive relief.
• UDTPA injunctive relief. O.C.G.A. § 10-1-372 — individual plaintiffs can seek injunctive relief and attorney's fees for unfair business practices, using a § 10-1-912 breach-notification violation as the predicate.
• Common-law negligence claims. Georgia recognizes negligence per se where a statutory standard is violated; plaintiffs in medical-data breach cases often plead negligence per se with the breach statute as the predicate.
• Medical Board discipline. Failure to comply with § 31-33-2 records access can trigger Composite Medical Board action against the physician's license, independent of any civil claim.
• HIPAA OCR penalties continue to apply in parallel under 45 CFR § 160.404.

Georgia's enforcement environment is less aggressive than CA or WA, but UDTPA layering and Medical Board action are the practical levers plaintiffs and patients use. The dollar exposure is modest compared to CMIA or BIPA, but the volume of records-access complaints filed with the Medical Board is meaningful for any practice with a slow records-release workflow.

Compliance checklist for in-state practices

A Georgia-specific overlay to a HIPAA program:

• Records release SLA at 30 days under O.C.G.A. § 31-33-2(b). Train front-desk and HIM staff to log the request date and the release date for every patient records request.
• Records retention at 10 years from creation under § 31-33-2(a)(1)(A). Replace any six-year HIPAA-derived purge cycle with the 10-year Georgia floor.
• Fee-cap documentation under § 31-33-3 for every records-release fee charged. The cap is per-page tiered; a flat copying fee can violate the statute.
• Encryption posture documentation for every device and database holding personal information of Georgia residents — for invoking the § 10-1-911(6) safe harbor if a breach occurs.
• Breach response runbook that triggers individual notice within 45 days absent investigative complexity, CRA notice at >10,000 affected, processor-to-owner notice within 24 hours where applicable, and HHS notice on the 60-day HIPAA track.
• Workforce training on Georgia statutes at hire and annually, separately documented from HIPAA training. Cover the 10-business-day continuity rule and the 10-year retention floor specifically.
• UDTPA exposure review — periodic counsel review of any patterns of records-access delays or breach-notification timing that could form the basis of UDTPA claims.
• Composite Medical Board complaint monitoring — Board complaints driven by records-access delays are the most common direct discipline path; a quarterly review of records-release metrics reduces this exposure.

The d3rx compliance binder state-overlay branches on Georgia and produces the 30-day records-release SLA, the 10-year retention policy, the § 31-33-3 fee-cap reference, and the breach response template a Georgia practice runs alongside the federal HIPAA backbone. It is an administrative documentation aid; the practice and its counsel remain responsible for executing the controls.

Cross-references: see Florida FIPA for medical practices and Texas HB300 for the neighboring-state regimes a Southeastern multi-state practice often runs alongside Georgia compliance.