What a provider can and can't say in Georgia
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | 43-34-8(a)(7) unprofessional conduct; (a)(21) federal-law compliance (inference) |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Yes - applies to licensed providers regardless of HIPAA status | 43-34-8(a)(7) unprofessional conduct; (a)(21) federal-law compliance (inference) |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | 43-34-8(a)(7) unprofessional conduct; (a)(21) federal-law compliance (inference) |
| Medical med spa | Depends; cash-only med spas often not covered | Yes - applies to licensed providers regardless of HIPAA status | 43-34-8(a)(7) unprofessional conduct; (a)(21) federal-law compliance (inference) |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No (cosmetic laser practitioners are Board-licensed under 43-34-240+) | 43-34-8(a)(7) unprofessional conduct; (a)(21) federal-law compliance (inference) |
- Consumer privacy and health data law: Georgia has no comprehensive consumer privacy law in force as of October 22, 2026. [GA-005]
- Data breach notification: Its data breach notification law does not list medical information as a trigger on its own, so a breach involving only charts or photos may not require state notice (HIPAA breach rules still apply to HIPAA covered entities).† [GA-002]
- Patient confidentiality duties: Patient confidentiality duties come mainly from licensing-board discipline rules.† [GA-001]
- Patient confidentiality duties: Board discipline for confidentiality breaches rests on a general professional-conduct ground (43-34-8).† [GA-001]
- Lawsuits by individuals: Court decisions recognize patient privacy or confidentiality lawsuits in some situations (Pavesich). [GA-004]
- Photos, names and likeness: No likeness statute protecting living persons in advertising was located; courts may recognize a common-law claim (Common law only). [GA-004, U-98]
- Med spa rules: Med spas: there is med-spa-specific law (Cosmetic Laser Services Act).† [GA-002, GA-003]
- Enforcement located: Strongest state enforcement evidence located: the law exists but no state enforcement was located (E4). Not finding enforcement does not mean none exists.† [GA-001, U-97]
- Research notes and gaps: Some Georgia code text was read on an unofficial website and should be confirmed against the official code. [U-95]
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources:
- [GA-001] O.C.G.A. 43-34-8(a)(7), (10), (11), (17), (21); (b)(1)(G); (o) (https://law.justia.com/codes/georgia/title-43/chapter-34/article-1/section-43-34-8/)
- [GA-002] O.C.G.A. 10-1-911(2), (3), (6); 10-1-912(a), (d) (https://law.justia.com/codes/georgia/title-10/chapter-1/article-34/section-10-1-912/)
- [GA-003] O.C.G.A. 43-34-240 et seq.; Ga. Comp. R. & Regs. 360-35-.01, -.05 (https://medicalboard.georgia.gov/document/document/tocrule-chapter-360-35pdf/download)
- [GA-004] Pavesich v. New England Life Ins. Co., 122 Ga. 190 (1905) (https://www.courtlistener.com/opinion/3406421/pavesich-v-new-england-life-insurance/)
- [GA-005] n/a (https://www.legis.ga.gov/)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Georgia (GA) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | No general patient-confidentiality statute located; 43-34-8(a)(7), (21) board grounds | Yes - applies to licensed providers regardless of HIPAA status | None | 10-1-912: applies only to information brokers and government data collectors; medical info NOT covered | 43-34-8(a)(7) unprofessional conduct; (a)(21) federal-law compliance (inference) | HIPAA if covered; Pavesich common-law appropriation for ad use | Common law (Pavesich 1905; Bullard 2013 not read) | Common-law privacy/appropriation (Pavesich); none statutory for confidentiality located | Composite Medical Board, Board of Dentistry, Board of Nursing, Board of Cosmetology and Barbers, AG/Governor's Office of Consumer Protection | Board fine up to $3,000 per violation; license discipline | E4 | Medium (secondary code host) | 2026-10-22 |
| Georgia (GA) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | No general patient-confidentiality statute located; 43-34-8(a)(7), (21) board grounds | Yes - applies to licensed providers regardless of HIPAA status | None | 10-1-912: applies only to information brokers and government data collectors; medical info NOT covered | 43-34-8(a)(7) unprofessional conduct; (a)(21) federal-law compliance (inference) | HIPAA if covered; Pavesich common-law appropriation for ad use | Common law (Pavesich 1905; Bullard 2013 not read) | Common-law privacy/appropriation (Pavesich); none statutory for confidentiality located | Composite Medical Board, Board of Dentistry, Board of Nursing, Board of Cosmetology and Barbers, AG/Governor's Office of Consumer Protection | Board fine up to $3,000 per violation; license discipline | E4 | Medium (secondary code host) | 2026-10-22 |
| Georgia (GA) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | No general patient-confidentiality statute located; 43-34-8(a)(7), (21) board grounds | Yes - applies to licensed providers regardless of HIPAA status | None | 10-1-912: applies only to information brokers and government data collectors; medical info NOT covered | 43-34-8(a)(7) unprofessional conduct; (a)(21) federal-law compliance (inference) | HIPAA if covered; Pavesich common-law appropriation for ad use | Common law (Pavesich 1905; Bullard 2013 not read) | Common-law privacy/appropriation (Pavesich); none statutory for confidentiality located | Composite Medical Board, Board of Dentistry, Board of Nursing, Board of Cosmetology and Barbers, AG/Governor's Office of Consumer Protection | Board fine up to $3,000 per violation; license discipline | E4 | Medium (secondary code host) | 2026-10-22 |
| Georgia (GA) | Medical med spa | Depends; cash-only med spas often not covered | No general patient-confidentiality statute located; 43-34-8(a)(7), (21) board grounds | Yes - applies to licensed providers regardless of HIPAA status | None | 10-1-912: applies only to information brokers and government data collectors; medical info NOT covered | 43-34-8(a)(7) unprofessional conduct; (a)(21) federal-law compliance (inference) | HIPAA if covered; Pavesich common-law appropriation for ad use | Common law (Pavesich 1905; Bullard 2013 not read) | Common-law privacy/appropriation (Pavesich); none statutory for confidentiality located | Composite Medical Board, Board of Dentistry, Board of Nursing, Board of Cosmetology and Barbers, AG/Governor's Office of Consumer Protection | Board fine up to $3,000 per violation; license discipline | E4 | Medium (secondary code host) | 2026-10-22 |
| Georgia (GA) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No general patient-confidentiality statute located; 43-34-8(a)(7), (21) board grounds | No (cosmetic laser practitioners are Board-licensed under 43-34-240+) | None | 10-1-912: applies only to information brokers and government data collectors; medical info NOT covered | 43-34-8(a)(7) unprofessional conduct; (a)(21) federal-law compliance (inference) | HIPAA if covered; Pavesich common-law appropriation for ad use | Common law (Pavesich 1905; Bullard 2013 not read) | Common-law privacy/appropriation (Pavesich); none statutory for confidentiality located | Composite Medical Board, Board of Dentistry, Board of Nursing, Board of Cosmetology and Barbers, AG/Governor's Office of Consumer Protection | Board fine up to $3,000 per violation; license discipline | E4 | Medium (secondary code host) | 2026-10-22 |
Related pages
Topics
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources
GA-005. n/a
Georgia has no comprehensive consumer privacy law in force as of 2026-10-22.
Search result (negative) · Inferred from search · Medium · Bill status not verified (U-59).
GA-002. O.C.G.A. 10-1-911(2), (3), (6); 10-1-912(a), (d)
Georgia's breach law applies only to 'information brokers' and 'data collectors' (state and local government entities); 'personal information' excludes medical information. A typical private medical, dental or aesthetic practice is not covered.
Statute · Explicit (secondary host) · Medium-High · HIPAA breach rules still apply to covered practices. CRA notice if more than 10,000.
https://law.justia.com/codes/georgia/title-10/chapter-1/article-34/section-10-1-912/
GA-001. O.C.G.A. 43-34-8(a)(7), (10), (11), (17), (21); (b)(1)(G); (o)
Composite Medical Board grounds include unprofessional or unethical conduct (departure from minimum standards of acceptable practice), violating laws relating to the practice of medicine, untrustworthiness, conduct that discredits the profession, and failing to comply with federal laws relating to the delivery of health care; no explicit confidentiality ground. Fines up to $3,000 per violation; final public actions are published.
Statute · Explicit (secondary host) · Medium-High · Reaching HIPAA violations via (a)(21) is an inference. Official O.C.G.A. not freely accessible (U-59).
https://law.justia.com/codes/georgia/title-43/chapter-34/article-1/section-43-34-8/
GA-004. Pavesich v. New England Life Ins. Co., 122 Ga. 190 (1905)
Georgia recognized a common-law right of privacy, including appropriation of a person's likeness for advertising.
Judicial decision · Holding per well-known summaries (opinion not re-read) · Medium · Supports appropriation claims over before/after photos in ads (application inferred). Bullard v. MRA Holding (Ga. 2013) also addresses appropriation (not read).
https://www.courtlistener.com/opinion/3406421/pavesich-v-new-england-life-insurance/
GA-003. O.C.G.A. 43-34-240 et seq.; Ga. Comp. R. & Regs. 360-35-.01, -.05
Cosmetic Laser Services Act and Board Rule 360-35: the Board licenses assistant and senior laser practitioners; an assistant works under a physician or senior practitioner, and patients must first be examined by a consulting physician (or a PA/APRN who is a licensed laser practitioner); on-site supervision and the prior exam are not required for laser hair removal and pulsed light. Covered services include non-ablative light, hair removal, ultrasound, cryolipolysis, microwave and RF.
Statute; Regulation · Explicit (rules); statute not read · High · Binding med spa licensing regime for energy-based cosmetic devices; injectables not addressed here (U-59).
https://medicalboard.georgia.gov/document/document/tocrule-chapter-360-35pdf/download
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All
U-97. U-97 · Open (accepted limitation)
Licensing-board discipline databases were not census-searched for review-response or confidentiality discipline in any jurisdiction (consolidates U-28, U-42, U-52, U-60, U-69, U-78, U-87). Absence of a located board order is not evidence that none exists.
High priority · All
U-95. U-95 · Open
Claims and cases that remain unverifiable from official sources (bot checks, outages or no public record): Ohio bill status (legislature.ohio.gov connection failed); Tausinga (no docket found); OSBMLS v. Larson final order; TN, AR, MS and GA code text (Justia hosts; tnsosfiles 403); KS-005 rule text (KSBHA 403); MS-004 rule; NM-001 (NMOneSource 403); WV rule 11-1A-12.1.f (LII host); Hawaii HRS text after 2017 (capitol.hawaii.gov Cloudflare, not circumvented); DC B26-0525 status; Aspen Dental final approval order; Cancelmo docket entries (PACERMonitor mirror); basis of the Amazon Ads SDK termination; case-law reproductions on secondary hosts.
High priority · All