Duty LXD-3733
Makes health care decisions, in Georgia
Each law's tag says when it binds: since in force from , in 7 weeks not yet in force
Disposal of records containing personal informationsince 4 lines
O.C.G.A. Sec. 10-15-2 · Read the law's page
- This binds any 'business': a sole proprietorship, partnership, corporation, association, or other group, however organized and whether or not organized to operate at a profit, expressly including a financial institution and an entity that destroys records, that discards or disposes of a customer's record containing personal information.
- Shred the record, erase the personal information, modify the record to make the personal information unreadable, or take other action you reasonably believe will ensure that no unauthorized person will have access to the personal information, before discarding or disposing of a customer's record. Personal information here is personally identifiable data about a customer's medical condition, account or credit balance, information supplied on opening an account or applying for credit, or a tax return, combined with an identifier such as a Social Security number, driver identification number, or date of birth.
- A bank or financial institution subject to the Gramm-Leach-Bliley Act's privacy and security provisions, a hospital or health care institution subject to HIPAA's privacy and security provisions, or any other entity governed by a federal law that itself requires disposal of such records in the same manner, is exempt from this duty.
- Expect Attorney General enforcement, using the Fair Business Practices Act's investigative powers, with an administrative penalty of up to $500 per wrongfully discarded customer record, capped at $10,000 total per order; a business that shows it used due diligence in attempting to properly dispose of the record has an affirmative defense, and the statute creates no private right of action of its own.
Private Review Agent Artificial Intelligence Coverage Determinations Act (SB 444)from , in 7 weeks3 lines
O.C.G.A. ยง 33-46-7.1, enacted by Ga. SB 444 (2025-2026 session) · Read the law's page
- If you are a private review agent or utilization review entity making coverage determinations for healthcare services in Georgia, you may use artificial intelligence systems, artificial intelligence, or other software tools as part of a utilization review plan meeting the Insurance Commissioner's standards.
- Do not let such a system issue an adverse coverage determination on its own; have a natural person qualifying as a private review agent or utilization review entity conduct the utilization review, with a clinical peer participating, before any adverse determination issues.
- Do not let the system supersede the clinical peer's judgment.