Privacy and Confidentiality; Use of Data; Security Program

  1. Law
  2. Georgia Code
  3. Crimes and Offenses
  4. Controlled Substances
  5. Regulation of Controlled Substances
  6. Prescription Drug Monitoring Program Data Base
  7. Privacy and Confidentiality; Use of Data; Security Program

Checkout our iOS App for a better way to browser and research.

  1. Except as otherwise provided in subsections (c), (c.1), and (d) of this Code section, prescription information submitted pursuant to Code Section 16-13-59 shall be confidential and shall not be subject to open records requirements as contained in Article 4 of Chapter 18 of Title 50.
  2. The department, in conjunction with the board, shall establish and maintain strict procedures to ensure that the privacy and confidentiality of patients, prescribers, and patient and prescriber information collected, recorded, transmitted, and maintained pursuant to this part are protected. Such information shall not be disclosed to any person or entity except as specifically provided in this part and only in a manner which in no way conflicts with the requirements of the federal Health Insurance Portability and Accountability Act (HIPAA) of 1996, P.L. 104-191. Nothing in this subsection shall be construed to prohibit the agency or department from accessing prescription information as a part of an investigation into suspected or reported abuses or regarding illegal access of the data. Such information may be used in the prosecution of an offender who has illegally obtained prescription information.
  3. The department shall be authorized to provide requested prescription information collected pursuant to this part only as follows:
    1. To persons authorized to prescribe or dispense controlled substances for the sole purpose of providing medical or pharmaceutical care to a specific patient;
    2. Upon the request of a patient, prescriber, or dispenser about whom the prescription information requested concerns or upon the request on his or her behalf of his or her attorney;
    3. To local or state law enforcement or prosecutorial officials pursuant to the issuance of a search warrant from an appropriate court or official in the county in which the office of such law enforcement or prosecutorial officials are located; to federal law enforcement or prosecutorial officials as allowed by federal law by the issuance of a search warrant, a grand jury subpoena, an administrative subpoena, or a civil investigative demand; or to the Attorney General's Medicaid Fraud Control Unit by the issuance of an administrative subpoena;
    4. To the agency, the Georgia Composite Medical Board or any other state regulatory board governing prescribers or dispensers in this state, or the Department of Community Health for purposes of the state Medicaid program, for health oversight purposes, or upon the issuance of a subpoena by such agency, board, or Department of Community Health pursuant to their existing subpoena power or to the federal Centers for Medicare and Medicaid Services upon the issuance of a subpoena by the federal government pursuant to its existing subpoena power;
      1. To not more than two individuals who are members per shift or rotation of the prescriber's or dispenser's staff;
      2. Such individuals may retrieve and review such information strictly for the purpose of:
        1. Providing medical or pharmaceutical care to a specific patient; or
        2. Informing the prescriber or dispenser of a patient's potential use, misuse, abuse, or underutilization of prescribed medication;
      3. All information retrieved and reviewed by such individuals shall be maintained in a secure and confidential manner in accordance with the requirements of subsection (f) of this Code section; and
      4. The delegating prescriber or dispenser may be held civilly liable and criminally responsible for the misuse of the prescription information obtained by such individuals;
    6. To not more than two individuals, per shift or rotation, who are employed or contracted by the health care facility in which the prescriber is practicing so long as the medical director of such health care facility has authorized the particular individuals for such access;
    7. In any hospital which provides emergency services, each prescriber may designate two individuals, per shift or rotation, who are employed or contracted by such hospital so long as the medical director of such hospital has authorized the particular individuals for such access; and
    8. To a prescription drug monitoring program operated by a government entity in another state or an electronic medical records system operated by a prescriber or health care facility, provided the program or system, as determined by the department, contains legal, administrative, technical, and physical safeguards that meet or exceed the security measures of the department for the operation of the PDMP pursuant to this part.
      1. Refer instances of a patient's possible personal misuse or abuse of controlled substances to the patient's primary prescriber to allow for potential intervention and impairment treatment;
      2. Refer probable violations of controlled substances being acquired for illegal distribution, and not solely for a patient's personal use, to the appropriate authorities for further investigation and potential prosecution; or
      3. Refer probable regulatory violations by prescribers or dispensers to the regulatory board governing such person; or

        Include PDMP prescription information in a patient's electronic health or medical record.

  4. The department may provide data that has been processed to remove personal identifiers from the health information in compliance with the standard and implementation rules of the federal Health Insurance Portability and Accountability Act (HIPAA) of 1996, P.L. 104-191, to government entities and other entities for statistical, research, educational, instructional, drug abuse prevention, or grant application purposes after removing information that could be used to identify prescribers.
  5. Any person or entity that receives PDMP prescription information or related reports relating to this part from the department shall not disclose such information or reports to any other person or entity except by order of a court of competent jurisdiction or as otherwise permitted pursuant to this part.
  6. Any permissible user identified in this part who directly accesses PDMP prescription information shall implement and maintain a comprehensive information security program that contains administrative, technical, and physical safeguards that are substantially equivalent to the security measures of the department. The permissible user shall identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of personal information that could result in the unauthorized disclosure, misuse, or other compromise of the information and shall assess the sufficiency of any safeguards in place to control the risks.
  7. No provision in this part shall be construed to modify, limit, diminish, or impliedly repeal any authority of a licensing or regulatory board or any other entity so authorized to obtain prescription information from sources other than the PDMP maintained pursuant to this part; provided, however, that the department shall be authorized to release information from the PDMP only in accordance with the provisions of this part.

(c.1)An individual authorized to access PDMP prescription information pursuant to this part may:

Communicate concerns about a patient's potential usage, misuse, abuse, or underutilization of a controlled substance with prescribers and dispensers that are involved in the patient's health care;

Report potential violations of this article to the agency for review or investigation. Following such review or investigation, the agency shall:

(Code 1981, §16-13-60, enacted by Ga. L. 2011, p. 659, § 2/SB 36; Ga. L. 2016, p. 202, § 2/HB 900; Ga. L. 2017, p. 319, § 1-2/HB 249; Ga. L. 2018, p. 550, § 4-5/SB 407; Ga. L. 2018, p. 1112, § 16/SB 365; Ga. L. 2019, p. 933, § 2/SB 121.)

The 2016 amendment, effective July 1, 2016, added the third and fourth sentences in subsection (b); in subsection (c), added "or to delegates of such persons authorized to prescribe or dispense controlled substances in accordance with the following:" at the end of paragraph (c)(1), added subparagraphs (c)(1)(A) through (c)(1)(C), substituted the present provisions of paragraph (c)(3) for the former provisions, which read: "To local, state, or federal law enforcement or prosecutorial officials pursuant to the issuance of a search warrant pursuant to Article 2 of Chapter 5 of Title 17; and", substituted the present provisions of paragraph (c)(4) for the former provisions, which read: "To the agency or the Georgia Composite Medical Board upon the issuance of an administrative subpoena issued by a Georgia state administrative law judge."; added subsection (c.1); and, in subsection (d), inserted "statistical" and inserted "and other entities" near the beginning, and added "; the board may provide nonpatient specific data to the agency for instructional, drug abuse prevention, and research purposes" at the end.

The 2017 amendment, effective July 1, 2017, substituted "department" for "agency" throughout this Code section; inserted ", (c.1)," in subsection (a); inserted "or department" in the third sentence of subsection (b); rewrote subsections (c) and (c.1); substituted the present provisions of subsection (d) for the former provisions, which read: "The board may provide statistical data to government entities and other entities for statistical, research, educational, or grant application purposes after removing information that could be used to identify prescribers or individual patients or persons who received prescriptions from dispensers; the board may provide nonpatient specific data to the agency for instructional, drug abuse prevention, and research purposes."; in subsection (e), substituted "entity that receives PDMP" for "entity who receives electronic data base" near the beginning, substituted "disclose" for "provide" in the middle, and inserted "as otherwise permitted" near the end; substituted "PDMP" for "electronic data base" near the beginning of the first sentence of subsection (f); and, in subsection (g), deleted "existing on June 30, 2011," following "any authority" and twice inserted "PDMP".

The 2018 amendments. The first 2018 amendment, effective July 1, 2018, in paragraph (c)(3), deleted "pursuant to Article 2 of Chapter 5 of Title 17" following "officials are located" near the middle and substituted "as allowed by federal law by the issuance of a search warrant, a grand jury subpoena, an administrative subpoena, or a civil investigative demand" for "pursuant to the issuance of a search warrant pursuant to 21 U.S.C. or a grand jury subpoena pursuant to 18 U.S.C." in the middle; substituted "power" for "powers" at the end of paragraph (c)(4); substituted the present provisions of subparagraph (c)(5)(A) for the former provisions, which read: "(c)(5)(A) To not more than two individuals who are members per shift or rotation of the prescriber's or dispenser's staff or employed at the health care facility in which the prescriber is practicing, provided that such individuals:

"(i) Are licensed under Chapter 11, 30, 34, or 35 of Title 43;

"(ii) Are registered under Title 26;

"(iii) Are licensed under Chapter 26 of Title 43 and submit to the annual registration process required by subsection (a) of Code Section 16-13-35, and for purposes of this Code section, such individuals shall not be deemed exempted from registration as set forth in subsection (g) of Code Section 16-13-35; or

"(iv) Submit to the annual registration process required by subsection (a) of Code Section 16-13-35, and for purposes of this Code section, such individuals shall not be deemed exempted from registration as set forth in subsection (g) of Code Section 16-13-35;"; deleted "and" at the end of paragraph (c)(6); added "; and" at the end of paragraph (c)(7); and added paragraph (c)(8). The second 2018 amendment, effective May 8, 2018, part of an Act to revise, modernize, and correct the Code, revised punctuation near the end of subsection (a); and substituted "existing subpoena power" for "existing subpoena powers" at the end of paragraph (c)(4).

The 2019 amendment, effective July 1, 2019, in paragraph (c)(3), substituted "located; to" for "located or to" in the middle, and added "or to the Attorney General's Medicaid Fraud Control Unit by the issuance of an administrative subpoena;" at the end.

Code Commission notes.

- Pursuant to Code Section 28-9-5, in 2017, "of" was inserted following "subsection (a)" in divisions (c)(5)(A)(iii) and (c)(5)(A)(iv).

Editor's notes.

- Ga. L. 2017, p. 319, § 1-1/HB 249, not codified by the General Assembly, provides: "This part shall be known and may be cited as the 'Jeffrey Dallas Gay, Jr., Act.'"

Law reviews.

- For article on the 2017 amendment of this Code section, see 34 Ga. St. U. L. Rev. 143 (2017). For article on the 2018 amendment of this Code section, see 35 Ga. St. U.L. Rev. 45 (2018).


Download our app to see the most-to-date content.