Georgia Breach Notification Thresholds for Physician Practices Under State Law

Understanding Personal Information Definitions

What “personal information” means under Georgia’s data breach notification statute

Georgia’s data breach notification statute applies when unencrypted personal information in computerized form is acquired by an unauthorized person. For state-law purposes, “personal information” is a name plus one or more specific data elements: Social Security number; driver’s license or state ID number; financial account, credit/debit card number (when usable without additional credentials); or access credentials like passwords or PINs. Georgia also treats these elements alone as “personal information” if their compromise would be sufficient to attempt identity theft. ([law.justia.com](https://law.justia.com/codes/georgia/title-10/chapter-1/article-34/section-10-1-911/))

The statute’s trigger centers on unencrypted personal information; encrypted data generally falls outside the definition if the information is not rendered readable. This focus on “unencrypted personal information” is explicit in the notification duty. ([law.justia.com](https://law.justia.com/codes/georgia/title-10/chapter-1/article-34/section-10-1-912/))

What is not included (and why that matters to physicians)

Medical or clinical details by themselves are not enumerated under Georgia’s definition of personal information. For physician practices, state notification typically turns on whether identity-theft data elements (for example, SSNs or account numbers) are involved, even if the incident also affects protected health information. ([law.justia.com](https://law.justia.com/codes/georgia/title-10/chapter-1/article-34/section-10-1-911/))

Georgia does not use a separate “risk of harm” test before notice is required; once the statute’s conditions are met, notification is expected. ([privacyrights.org](https://privacyrights.org/sites/default/files/pdfs/PrivacyRightsClearinghouse_DataBreachNotificationLaws_2026.pdf?utm_source=openai))

Notification Timing Requirements

The core timeline you should plan around

You must notify affected Georgia residents “in the most expedient time possible and without unreasonable delay,” allowing only for steps to scope the incident, restore system integrity, and any applicable law enforcement hold. ([law.justia.com](https://law.justia.com/codes/georgia/title-10/chapter-1/article-34/section-10-1-912/))

If your practice acts as a service provider that maintains data for another covered entity, you must notify that entity within 24 hours of discovering a qualifying breach. Build this 24-hour escalation into all vendor and business-associate agreements. ([law.justia.com](https://law.justia.com/codes/georgia/title-10/chapter-1/article-34/section-10-1-912/))

How to deliver notice (and when substitute notice is permitted)

Georgia permits written, telephone, or electronic notice. Substitute notice is allowed only if direct notice would cost over $50,000, the affected class exceeds 100,000 individuals, or contact data is insufficient; substitute notice requires email (if available), a conspicuous website posting, and notice to major statewide media. ([law.justia.com](https://law.justia.com/codes/georgia/title-10/chapter-1/article-34/section-10-1-911/))

State guidance also frames the duty broadly for “businesses” that collect or maintain unencrypted personal information, aligning with how physician practices typically store billing and identity data. ([consumered.georgia.gov](https://consumered.georgia.gov/ask-ed/2023-08-30/getting-notified-following-data-breach?utm_source=openai))

Thresholds for Notification to Consumer Reporting Agencies

When consumer reporting agencies notification is required

In addition to notifying individuals, you must notify all nationwide consumer reporting agencies when a single incident requires notice to more than 10,000 Georgia residents. This consumer reporting agencies notification must be made without unreasonable delay and include the timing, distribution, and content of the individual notices. ([law.justia.com](https://law.justia.com/codes/georgia/title-10/chapter-1/article-34/section-10-1-912/))

Exceptions Due to Law Enforcement Investigations

Georgia recognizes a law enforcement investigation exemption: you may delay individual notices if a law enforcement agency determines that immediate notification would compromise a criminal investigation. Notification must resume once the agency advises that doing so will no longer compromise the investigation. ([law.justia.com](https://law.justia.com/codes/georgia/title-10/chapter-1/article-34/section-10-1-912/))

State consumer protection guidance echoes this rule, so document any hold request and the date you were cleared to proceed to keep your breach notification timelines defensible. ([consumered.georgia.gov](https://consumered.georgia.gov/ask-ed/2023-08-30/getting-notified-following-data-breach?utm_source=openai))

Absence of Penalties and Private Rights of Action

Georgia’s breach notification statute does not specify regulatory penalties for failure to notify, and it imposes no requirement to notify the Attorney General—an effective attorney general notification exemption under state law. ([dwt.com](https://www.dwt.com/-/media/files/dwt-data-breach-notice-summaries.pdf?utm_source=openai))

The statute also does not create a private right of action for residents based solely on noncompliance with the notification provisions; courts analyzing § 10-1-912 have treated the absence of such language as dispositive. ([privacyrights.org](https://privacyrights.org/sites/default/files/pdfs/PrivacyRightsClearinghouse_DataBreachNotificationLaws_2026.pdf?utm_source=openai))

Compliance Best Practices for Physician Practices

Make Georgia’s rules workable in a clinical setting

• Data inventory with a Georgia lens: Map where you store unencrypted personal information alongside PHI (EHR, patient intake, billing) so you can quickly determine whether the state trigger applies. ([law.justia.com](https://law.justia.com/codes/georgia/title-10/chapter-1/article-34/section-10-1-911/))
• Encrypt everywhere practical: Because the state trigger focuses on unencrypted personal information, strong encryption (with protected keys) materially lowers state-law exposure. ([law.justia.com](https://law.justia.com/codes/georgia/title-10/chapter-1/article-34/section-10-1-912/))
• Contract for speed: Require vendors and business associates to alert you within 24 hours of suspected compromise and to share indicators, affected data elements, and preliminary counts to support timely notice decisions. ([law.justia.com](https://law.justia.com/codes/georgia/title-10/chapter-1/article-34/section-10-1-912/))
• Pre-build notices and a decision tree: Include direct notice templates, substitute notice criteria, and the step to notify nationwide consumer reporting agencies if the 10,000-resident threshold is met. ([law.justia.com](https://law.justia.com/codes/georgia/title-10/chapter-1/article-34/section-10-1-911/))
• Document any law enforcement investigation exemption: Keep written or recorded confirmation of the hold and the date clearance was granted, then issue notices without unreasonable delay. ([law.justia.com](https://law.justia.com/codes/georgia/title-10/chapter-1/article-34/section-10-1-912/))
• Coordinate with HIPAA: Even when Georgia law does not require notice, the HIPAA Breach Notification Rule may. Align your plan with HIPAA’s 60-day outer limit for covered entities and media notice rules for larger incidents. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html?utm_source=openai))
• Know what you don’t need to do: Georgia imposes no routine Attorney General reporting for breaches, but maintain records that would support inquiries under other consumer protection laws. ([dwt.com](https://www.dwt.com/-/media/files/dwt-data-breach-notice-summaries.pdf?utm_source=openai))

FAQs.

What constitutes a data breach under Georgia law?

A “breach of the security of the system” is the unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information held by a covered entity; good-faith access by an employee or agent is excluded if there’s no further unauthorized use or disclosure. ([law.justia.com](https://law.justia.com/codes/georgia/title-10/chapter-1/article-34/section-10-1-911/))

When must physician practices notify affected individuals?

Notify “in the most expedient time possible and without unreasonable delay,” allowing for forensic scoping, system remediation, and any law enforcement hold. If you maintain data on behalf of another covered entity, you must notify that entity within 24 hours of discovery. ([law.justia.com](https://law.justia.com/codes/georgia/title-10/chapter-1/article-34/section-10-1-912/))

Are there penalties for not complying with breach notification requirements?

Georgia’s breach statute does not specify civil penalties within the law itself and does not create a private right of action for breach-notice violations, though other legal theories may still be asserted depending on the facts. ([omm.com](https://www.omm.com/media/5toj1tkf/a_guide_to_us_breach_notification_laws.pdf?utm_source=openai))

Is notification to the Attorney General required after a breach?

No. Georgia’s statute contains no requirement to notify the Attorney General or any state agency; reporting to consumer reporting agencies is required only when more than 10,000 Georgia residents must be notified. ([dwt.com](https://www.dwt.com/-/media/files/dwt-data-breach-notice-summaries.pdf?utm_source=openai))