Health record rights in Georgia: what state law adds
In Georgia, as of October 3, 2026, we found no law on health data held outside HIPAA; you get a free copy of your record in some cases; you can opt out of the health information exchange; and one of the three rules we look for on AI in care is in force. Two answers are not checked yet (right to sue, breach notice). Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Are there rules for AI used in your care?One of the three rules is in force. A licensed clinician decides, not AI alone. Also signed, not yet in force: SB 444 (2026): AI in utilization review by private review agents (January 1, 2027); SB 540 (2026): Conversational AI services (July 1, 2027). Same answer in 12 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No comprehensive or consumer health data law found. SB 111 passed the Senate as a privacy bill, but the enrolled act (legis.ga.gov document 249143) only amends the rural hospital tax credit, O.C.G.A. 31-8-9.1.
How we searched (October 3, 2026): the official code search for consumer health data, consumer privacy protection act, sensitive data consent, health data, SB 111. Agency pages checked: law.georgia.gov.
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
In one way: a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Free copy for a disability benefits application goes beyond HIPAA and 45 CFR 171. Deadline left null: lead copy of 31-33-2 says 30 days, equal to HIPAA, and no official text was reachable. Date is DCH's July 1, 2015 change.
Free copy: Records requested to make or complete an application for a disability benefits program (O.C.G.A. 31-33-3(a))
Fee rule: DCH rates effective July 1, 2026: search, retrieval and other direct administrative costs up to $25.88
Fee rule: Certification fee up to $9.70 per record
Fee rule: Paper copies: $0.97 per page for pages 1-20, $0.83 for pages 21-100, $0.66 over 100
Fee rule: DCH: state rates should not be applied when individuals request records for themselves from a covered entity; HIPAA fee rules apply
Fee rule: Rates do not apply to records requests for a disability benefits program or vocation rehabilitation program application
Goes beyond the federal floor: yes.
Costs of copying and mailing; disability benefits exception (Composite Medical Board guidance). O.C.G.A. 31-33-3(a)
In force · effective · read October 3, 2026 · source(medicalboard.georgia.gov)
physician may not charge for medical records requested in order to make or complete an application for a disability benefits program per O.C.G.A. § 31-33-3(a).
Who it binds, in our words: Providers having custody of patient records under O.C.G.A. Chapter 31-33; the Board page addresses physicians.
Medical Records Retrieval Rates (Department of Community Health). O.C.G.A. 31-33-3
In force · effective · read October 3, 2026 · source(dch.georgia.gov)
Rates do not apply to records requests necessary to make or complete an application for a disability benefits program or vocation rehabilitation program.
Who it binds, in our words: Providers charging under O.C.G.A. 31-33-3; DCH publishes the annual rates.
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No Georgia statute on HIE consent found. DCH names GaHIN the State-Designated Entity. GeorgiaConnX policies effective 30 Sep 2021. GaHIN's current patient page also says patients can opt out by contacting their physician.
Set by the published policy of the state-designated exchange; no state law sets the rule.
Designated exchange: Georgia Health Information Network (GaHIN).
Some sensitive records need your consent even where routine records do not.
GaHIN Policy GaHIN-1007, Opt-Out. Georgia Health Information Network, Inc., Policies and Procedures, Policy GaHIN-2002
In force · effective · read October 3, 2026 · source(gahin.org, reached from dch.georgia.gov)
Patients of a Network Participant or Member Affiliate who is a health care provider shall be automatically enrolled in the Network without a written HIPAA authorization.
Who it binds, in our words: This Policy applies to all Network Participants and Member Affiliates.
GaHIN Policy GaHIN-1009, Restrictions on Sensitive Health Information. Georgia Health Information Network, Inc., Policies and Procedures, Policy GaHIN-2005
In force · effective · read October 3, 2026 · source(gahin.org, reached from dch.georgia.gov)
The sending Network Participant or Member Affiliate shall obtain an appropriate consent in accordance with applicable law from the patient prior to disclosing or re-disclosing SHI through the Network.
Who it binds, in our words: This Policy applies to all Network Participants and Member Affiliates.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Subsection (f) makes health records available to the district attorney where the abortion occurs or the patient resides. A 2024 Fulton order on it was vacated 20 Feb 2025 (S25A0300) per leads. No court order opened.
Restrictions on abortion; availability of health records (HB 481, LIFE Act, Section 4). O.C.G.A. 16-12-141(f), as amended by Ga. L. 2019, p. 711, HB 481
In force · effective · read October 3, 2026 · source(legis.ga.gov)
Health records shall be available to the
Who it binds, in our words: Health records of abortions performed in Georgia.
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
DBHDD (August 2014 provider training) states written consent or a specific legal authorization is needed. HB 89 revised subsection (a), effective 1 July 2025.
Confidentiality of mental health and developmental disabilities information (DBHDD provider guidance). O.C.G.A. 37-3-166(a), as revised by HB 89 (2025), Act 43
In force · effective · read October 3, 2026 · source(law.georgia.gov)
The clinical record shall not be a public record and no part of it shall be released except:
Who it binds, in our words: Clinical records of mental health and developmental disability patients under Title 37.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
24-12-21 sets who may receive AIDS confidential information. HB 1058 has no date clause, so Georgia's default 1 July date applies. DPH's privacy notice says written consent is needed before disclosing HIV/AIDS information.
Disclosure of AIDS confidential information (HB 1058, Section 5). O.C.G.A. 24-12-21(c), as amended by Ga. L. 2016, p. 735, HB 1058
In force · effective · read October 3, 2026 · source(legis.ga.gov)
AIDS confidential information may be disclosed to such person's parent
Who it binds, in our words: AIDS confidential information as defined in O.C.G.A. 31-22-9.1.
Second check by a separate agent: confirmed.
Genetic records
Not checked We did not finish the research on this question here, so this is not a no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Lead copies show O.C.G.A. 33-54-3 (1995) on consent and confidentiality for genetic testing. The official Lexis code needs a login, and no official or agency page with the text was reachable.
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
Not checked We did not finish the research on this question here, so this is not a no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
A lead copy of O.C.G.A. 33-54-8 gives harmed individuals a cause of action for genetic testing violations, with actual damages, costs and fees. No official text was reachable, so no level is set.
"Level" is the step on our rulebook's scale for this question. 0 means nothing beyond HIPAA. Higher means the law gives you more here.
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
Not checked We did not finish the research on this question here, so this is not a no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Lead copy of 10-1-911(6) lists no medical or health insurance items. Official text not reachable, so no level. The AG Consumer Protection Division page quotes the 10-1-912 deadline used above.
"Level" is the step on our rulebook's scale for this question. 0 means nothing beyond HIPAA. Higher means the law gives you more here.
Deadline to tell people: in the most expedient time possible and without unreasonable delay.
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
One of the three rules is in force. A licensed clinician decides, not AI alone.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
SB 444 meets clinician decides from 1 Jan 2027. SB 540's chatbot ban starts 1 Jul 2027 and is recorded as a pending prohibition. No AI health care provision in force found.
You must be told when AI is used in your care: not found.
A licensed clinician decides, not AI alone: in force.
You can reach a human, or have a human review the decision: not found.
Related limit on AI (recorded, not counted in the answer): An operator shall not knowingly and intentionally cause or program an AI companion chatbot to make any representation that it is licensed, certified, or otherwise authorized to provide professional mental health, behavioral health, medical, or counseling services
SB 444 (2026): AI in utilization review by private review agents. O.C.G.A. 33-46-7.1(c), enacted by SB 444 (2026)
Signed, not yet in force · effective · read October 3, 2026 · source(legis.ga.gov)
not issue an adverse determination to a patient until a natural person qualifying as a private
Who it binds, in our words: Private review agents and utilization review entities certified under O.C.G.A. Chapter 33-46.
SB 540 (2026): Conversational AI services. O.C.G.A. 39-5-6(h), enacted by SB 540 (2026)
Signed, not yet in force · effective · read October 3, 2026 · source(legis.ga.gov)
provide professional mental health, behavioral health, medical, or counseling services,
Who it binds, in our words: Operators of AI companion chatbots and conversational AI services available in Georgia.
O.C.G.A. 31-12-12(a)(1), (d)(2) and (d)(4), as revised by HB 203 (2023)
In force · effective · read October 3, 2026 · source(legis.ga.gov)
Not use the data or information obtained from an eye assessment as the sole basis for
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
14.0%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
94.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
87.8%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
9.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$71,355 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
3.5%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
6.0%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
14.5%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
9.9%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
