A Savannah practice administrator opens an email that looks like it came from the practice's clearinghouse, enters a password, and goes back to work. Three weeks later the billing inbox has been forwarding every message with an attachment to an address nobody recognizes. Nothing about that story is unique to Georgia. The Georgia Attorney General's office reports that Georgians lost roughly $534 million to cyber-enabled crime in a single year, and business email compromise is one of the two costliest categories.
OCR (the HHS Office for Civil Rights) treats the aftermath as a HIPAA matter, wherever the office sits: a $600,000 settlement with a health care network over a phishing attack breach (April 23, 2025) and a $3,000,000 settlement with Solara Medical Supplies over a phishing investigation (January 14, 2025) are two recent titles from its enforcement list. The federal rules are the same in Atlanta, Augusta, and Albany. What differs is the thin layer of Georgia law on top.
This guide covers that layer: who is covered, which Georgia statutes stack on HIPAA, how the state's breach law reads next to the federal one, the penalties on both sides, and what it means for hospitals, dental offices, behavioral health practices, and home health agencies.
HIPAA Compliance Georgia: How the Federal and State Rules Interact
HIPAA (the Health Insurance Portability and Accountability Act) sets a floor. 45 CFR 160.203 states the general rule: a HIPAA standard "that is contrary to a provision of State law preempts the provision of State law," and then lists the exceptions. Paragraph (b) is the one that matters for a practice: state law survives when it "relates to the privacy of individually identifiable health information and is more stringent than" the federal Privacy Rule.
Georgia has not built a comprehensive health privacy code on top of that floor the way California, Texas, or Illinois have. As of this writing the state also has no general consumer data privacy statute of the Virginia type. The Georgia rules that do exist are narrow and specific, and a practice that runs a solid federal program will find the state additions short. Short is not the same as optional.
Who Is a Covered Entity in Georgia
The definition is federal. 45 CFR 160.103 defines a covered entity as "(1) A health plan. (2) A health care clearinghouse. (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter." Every Georgia hospital, physician group, dental office, behavioral health practice, pharmacy, home health agency, and nursing facility that bills electronically is in.
Who Is a Business Associate in Georgia
Also federal. A business associate under 160.103 is a person who, on behalf of a covered entity, "creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter, including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, patient safety activities listed at 42 CFR 3.20, billing, benefit management, practice management, and repricing." Billing companies, EHR and cloud vendors, IT firms with access, answering services, shredding companies, and their subcontractors. Each needs a signed B.A.A. (Business Associate Agreement); the BAA guide lists the required terms.
Georgia Statutes and Rules That Stack on Top of HIPAA
Physician Record Retention: 10 Years (Composite Medical Board Rule 360-3-.02)
HIPAA sets no retention period for the medical record itself. It requires that policies and required documentation be kept "for 6 years from the date of its creation or the date when it last was in effect, whichever is later" (45 CFR 164.316(b)(2)(i) and 164.530(j)(2)). Georgia sets the chart period by licensing rule. The Composite Medical Board's unprofessional conduct rule, 360-3-.02, provides that "A physician shall be required to maintain a patient's complete treatment records for a period of no less than 10 years from the patient's last office visit," and defines the complete record to include "history and physical, progress notes, X-ray reports, photographs, laboratory reports, and other reports as may be required by provision of the law." The rule carves out physicians who have retired or sold a practice after notifying active patients by mail. Failure to keep the record is defined as unprofessional conduct, which is a licensing matter, not a HIPAA matter. Other boards (dentistry, nursing, psychology) set their own periods; check the rule for each license type. The record retention guide covers the federal-versus-state split.
Records Disposal (O.C.G.A. 10-15-1 et seq.)
The Attorney General's Consumer Protection Division guide for Georgia businesses states that "Georgia Law § 10-15-1 et seq. requires that business records containing sensitive information be disposed of properly," and recommends cross-cut shredding for paper and physical destruction for reduced-image media. That lines up with the federal media disposal standard in 45 CFR 164.310(d)(2)(i), which is a Required implementation specification. A written disposal policy plus a shredding vendor with a B.A.A. satisfies both.
The Georgia Personal Identity Protection Act (O.C.G.A. 10-1-910 to 10-1-915)
This is Georgia's breach notification statute. One honest caveat first: the Official Code of Georgia is published through a private vendor rather than on a state-run website, and the statute text could not be pulled from a state source for this article. What follows is drawn from the Attorney General's own guidance and should be confirmed against the current code with counsel.
Two features are worth knowing. First, the statute is commonly described as written around "information brokers" and government "data collectors" rather than every business that holds personal data; whether a given practice falls inside its terms is a question for counsel, and it changes nothing about the federal duty. Second, the Attorney General's guide describes the practical obligations without a fixed day count: "Notify affected individuals, businesses and organizations as soon as possible so that they can limit their exposure," and "If the breach affects more than 10,000 people it needs to be reported to all credit reporting agencies." The guide also states that notifying law enforcement is "not required by Georgia law," though it recommends doing so.
HIV and Mental Health Records
Georgia has statutes restricting disclosure of AIDS confidential information and of mental health treatment records beyond the federal treatment, payment, and operations permissions. Neither could be read from a state-hosted source during drafting, so treat this as a flag rather than a summary: a practice that tests for or treats HIV, or that provides mental health or substance use treatment, should have its consent and release forms reviewed against the Georgia statutes by counsel. Substance use disorder programs may also be under 42 CFR Part 2.
Georgia Breach Notification: The Federal Clock Does the Work
Because Georgia's statute is narrow and carries no fixed deadline, the federal Breach Notification Rule is the operative clock for almost every Georgia practice. 45 CFR 164.404(b) requires notice to affected individuals "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach." Under 164.408(b), a breach involving 500 or more individuals goes to HHS "contemporaneously" with the individual notice; under 164.408(c), smaller breaches are logged and reported "not later than 60 days after the end of each calendar year." Under 164.406(a), a breach involving "more than 500 residents of a State or jurisdiction" also goes to prominent media serving that state. A business associate has the same 60-day ceiling to notify the covered entity (164.410(b)).
Discovery is the trigger, and 164.404(a)(2) defines it broadly: a breach "shall be treated as discovered by a covered entity as of the first day on which such breach is known to the covered entity, or, by exercising reasonable diligence would have been known." The forwarding rule in the Savannah inbox counts from the day someone should have noticed, not the day someone did.
Before any letter goes out, 164.402 requires the four-factor risk assessment: "the nature and extent of the protected health information involved," "the unauthorized person who used the protected health information or to whom the disclosure was made," "whether the protected health information was actually acquired or viewed," and "the extent to which the risk to the protected health information has been mitigated." The presumption is that an impermissible disclosure is a breach unless that assessment shows a low probability of compromise, and the burden of proof sits with the practice (164.414).
| Obligation | Federal HIPAA | Georgia |
|---|---|---|
| Trigger | Breach of unsecured P.H.I. (Protected Health Information), 164.402 | Statute written around information brokers and data collectors; applicability to a practice is a counsel question |
| Individual notice deadline | No later than 60 calendar days after discovery | "As soon as possible" per Attorney General guidance; no fixed day count confirmed |
| Government notice | HHS: contemporaneous if 500 or more; annual log if fewer | No Attorney General notice requirement identified; law enforcement notice recommended, not required |
| Media | Prominent outlets if more than 500 residents of a state | Not identified |
| Credit bureaus | Not required | All credit reporting agencies if more than 10,000 people (per Attorney General guide) |
| Vendor to client | No later than 60 days (164.410) | Set it in the B.A.A. |
The working rule for a Georgia practice: run the federal process from the breach notification guide, calendar the credit bureau notice at 10,000, and have counsel confirm at the time of an incident whether the state statute reaches the practice. Do not wait for that answer to start the federal clock.
HIPAA Penalties in Georgia
Federal OCR Penalty Tiers
45 CFR 160.404 sets four culpability tiers, and the amounts are inflation-adjusted each year at 45 CFR 102.3. Under the 2025 adjustment, the per-violation ranges are: $145 to $73,011 where the entity did not know and could not reasonably have known; $1,461 to $73,011 for reasonable cause; $14,602 to $73,011 for willful neglect corrected within 30 days; and $73,011 to $2,190,294 for willful neglect not corrected. The calendar-year cap for identical violations is $2,190,294. OCR has applied a Notice of Enforcement Discretion with lower annual caps for the first three tiers; those figures are not quoted here. The penalty amounts post tracks the numbers.
Georgia Attorney General Enforcement
The Attorney General's Consumer Protection Division enforces the Fair Business Practices Act (O.C.G.A. 10-1-390 et seq.), which "prohibits unfair and deceptive acts or practices in the marketplace" in consumer transactions, and the division pursues cases "whenever the Attorney General determines there is a substantial public interest." A security failure that contradicts a practice's own privacy promises is the kind of conduct that statute reaches. The Attorney General's office also runs a White Collar and Cyber Crime Unit that "investigates and prosecutes cyber-enabled theft targeting businesses and consumers throughout the state." The enforcement provisions of the breach statute itself could not be confirmed from a state source and are not summarized here. Licensing boards add a third track: the Composite Medical Board treats a records failure as unprofessional conduct.
HIPAA Compliance for Georgia Healthcare Providers
Georgia Hospitals and Health Systems
Large systems already run federal programs. The Georgia layer shows up in the retention schedule (10 years for physician records, plus each facility's own licensing rule), the disposal policy, and the incident response plan, which should name who decides whether the state statute applies and who calendars the 10,000-person credit bureau notice. The $950,000 OCR settlement over Security Rule failures (July 1, 2024) and the $1.19 million penalty against Gulf Coast Pain Consultants for Security Rule violations (December 3, 2024) are the current federal reference points.
Georgia Dental Practices
A dental office is a covered entity with its first electronic claim; the dental compliance page covers the federal program. Georgia adds a Board of Dentistry retention rule (check it; the 10-year figure above is the medical board's) and the disposal statute. OCR's dental enforcement runs to patient access and social media: it settled three right of access cases with dental practices in one announcement (September 20, 2022) and a $10,000 case over social media disclosures of patients' P.H.I. (October 2, 2019).
Georgia Behavioral Health Providers
Georgia's mental health records statute sits on top of HIPAA and, for substance use programs, 42 CFR Part 2. The federal enforcement pattern in this sector is patient access: OCR imposed a $100,000 penalty against a mental health center for failure to provide timely access to patient records (November 19, 2024). The 30-day deadline in 45 CFR 164.524(b)(2) applies to a counseling practice exactly as it applies to a hospital. The behavioral health compliance page covers the program.
Georgia Home Health and Long-Term Care
Home health agencies and nursing facilities move P.H.I. on phones and paper in cars across large service areas. The $3 million OCR settlement over failure to encrypt mobile devices (November 5, 2019) is the sector's warning: encrypted devices fall outside the federal definition of "unsecured protected health information," so a lost encrypted phone is an incident to log, not a breach to notify. Every vendor on the agency's list needs a B.A.A. with a notice deadline written in.
Georgia HIPAA Compliance Checklist
| Requirement | Source | Timing | Evidence to keep |
|---|---|---|---|
| Security risk analysis and risk management plan | Federal, 164.308(a)(1) | Documented; reviewed at least annually in practice | Risk analysis report, remediation plan |
| Workforce training | Federal, 164.530(b), 164.308(a)(5) | New hires; when policies change; annual in practice | Training log with dates and names |
| Signed B.A.A. with every P.H.I. vendor | Federal, 164.504(e), 164.314(a) | Before access; include a vendor notice deadline | Executed agreement per vendor |
| Breach procedure with four-factor assessment and federal deadlines | Federal 164.402 to 164.410 | Letters within 60 days of discovery; HHS contemporaneously at 500 or more | Incident log, risk assessment memo, notice copies |
| State breach applicability decision and 10,000-person credit bureau notice | O.C.G.A. 10-1-910 et seq.; Attorney General guidance | At the time of an incident | Counsel memo, notice confirmations |
| Record retention schedule | Composite Medical Board Rule 360-3-.02 (10 years); other boards' rules | Ongoing | Written schedule per license type |
| Written disposal policy (paper and electronic) | O.C.G.A. 10-15-1 et seq.; federal 164.310(d) | Ongoing | Policy, shredding vendor B.A.A. and certificates |
| HIV and mental health release forms reviewed against Georgia statutes | State statutes (counsel review) | Before non-treatment disclosures | Reviewed forms, release log |
One note on timing. The proposed update to the HIPAA Security Rule, published in January 2025, would add express requirements such as encryption and multifactor authentication. It is a proposal, not current law, and OCR is not enforcing it. Nothing in this guide depends on it.
---
FAQ
Does Georgia have its own HIPAA law?
No. Georgia relies on the federal rules for health privacy and adds narrow state pieces: a Composite Medical Board rule requiring physicians to keep records at least 10 years from the last visit, a records disposal statute, a breach notification statute written around information brokers and data collectors, and confidentiality statutes for HIV and mental health records.
How long must a Georgia physician keep patient records?
Composite Medical Board Rule 360-3-.02 requires a physician to maintain a patient's complete treatment records for no less than 10 years from the patient's last office visit. Other licensing boards set their own periods. HIPAA separately requires policies and compliance documentation to be kept six years.
How fast must a Georgia practice notify patients after a breach?
Under 45 CFR 164.404(b), without unreasonable delay and no later than 60 calendar days after discovery. Georgia's Attorney General guidance says to notify affected individuals as soon as possible and to notify all credit reporting agencies if more than 10,000 people are affected; the state statute's own applicability to a practice should be confirmed with counsel.
Does Georgia require notice to the Attorney General after a breach?
No Attorney General notice requirement was identified in the state's guidance, and the Attorney General's own business guide says notifying law enforcement is not required by Georgia law, though recommended. The federal HHS notice at 45 CFR 164.408 still applies.
Who enforces HIPAA in Georgia?
OCR enforces the federal rules. The Georgia Attorney General's Consumer Protection Division enforces the Fair Business Practices Act, and the licensing boards enforce their own rules, including the medical board's 10-year records rule, as matters of professional conduct.
Conclusion
The federal program comes first: risk analysis, written policies, workforce training, and signed B.A.A.s. The Georgia layer is a retention schedule, a disposal policy, and a breach procedure that knows which state filings apply. One Guy Consulting's Full-Scope plan builds the federal program and documents the state overlay alongside it. Start with a free 30-minute compliance review. No obligation, no pressure.
Sources
- Georgia Composite Medical Board Rule 360-3-.02, Unprofessional Conduct Defined (records retention), Rules and Regulations of the State of Georgia
- Georgia Attorney General Consumer Protection Division: Cybersecurity in Georgia (business guide, PDF)
- Georgia Attorney General: Cybersecurity (key issues page)
- Georgia Attorney General Consumer Protection Division: Statutes We Enforce
- 45 CFR 160.203 (preemption of state law)
- 45 CFR 160.103 (definitions: covered entity, business associate)
- 45 CFR 164.404 (breach notification to individuals)
- 45 CFR 164.408 (breach notification to the Secretary)
- 45 CFR 102.3 (civil money penalty amounts)
- HHS: Breach Notification Rule
Related Reading