Roswell Public Sector Injury Privacy in 2026

A big change is coming for public sector employee privacy in Roswell, and it’s all about workplace injuries. A legislative amendment going live on January 1, 2026, completely changes how city and county agencies must de-identify personal health information (PHI) in injury records, creating new privacy and legal compliance headaches they need to solve now.

Understanding Georgia House Bill 101: A New Standard for Public Sector Data

When Governor Kemp signed Georgia House Bill 101 into law on July 1, 2025, it set a time bomb for how public records are handled, set to go off on January 1, 2026. The new law amends O.C.G.A. Section 50-18-72, which dictates exemptions under the Georgia Open Records Act. The big change is a new, explicit rule for de-identifying personal info in public employee injury records. Before this, the statute’s exemption for medical records was so broad and vague about what “de-identified” meant that it caused constant arguments and inconsistent enforcement between agencies like the Roswell Police Department and Fulton County Public Works.

The new language in O.C.G.A. Section 50-18-72(a)(20) forces the issue. It states that if a piece of a public employee’s medical record, including anything tied to workers’ compensation claims or on-the-job injuries, is requested under the Open Records Act, it *must* be released if it can be reasonably de-identified. This means agencies’ old trick of withholding an entire file because it contains some protected health information (PHI) is over. Now, they have an active duty to redact or anonymize the specific identifiers and release the rest of the information. It’s a huge shift in workload, forcing public bodies to process data requests instead of just denying them.

The motivation behind HB 101 was to find a working compromise between government transparency and personal privacy. Lawmakers saw that the public was getting more interested in workplace safety trends inside government agencies, but they also had to protect the privacy of individual employees who get hurt. This amendment provides a clear process for disclosing data that’s supposed to serve both of those interests.

Who is Affected by the New De-identification Requirements?

This law applies to every single state, county, and city government agency in Georgia. For Roswell, that means every department, from the City Manager’s Office to Roswell Fire-Rescue, must get in line. If you maintain any records of employee injuries, workers’ comp claims, or related medical info, you’re on the hook. This includes:

• City of Roswell Departments: Human Resources, Police, Fire, Public Works, Parks and Recreation, and Administrative Services.
• Fulton County Agencies: Any department that operates inside Roswell, like the Fulton County Sheriff’s Office, Fulton County Public Health, and other county offices.
• Local Public Schools: The Fulton County School System has to follow these rules for its employees working in Roswell, especially for injury reporting and record requests.

The people who will feel this most are in records management, human resources, legal, and risk management. They’re the ones who will have to actually build and run the new de-identification protocols. Injured employees are also affected, of course, as their medical details will now go through this new process if someone from the public files a request. It’s important for these departments to get that “de-identification” isn’t just taking a black marker to a name. It’s a systematic process for scrubbing out all possible identifiers.

Defining De-identification: What Needs to Be Removed?

While the new amendment doesn’t mention HIPAA by name, it’s basically importing the HIPAA Privacy Rule’s definition of de-identified health information. That’s your standard for compliance. For a record to be considered de-identified, it must be stripped of information that could identify a person, and there can be no reasonable basis to believe the remaining data could be used to figure out who that person is. This means getting rid of 18 specific identifiers. For an employee injury record, you have to carefully remove or anonymize:

1. Names
2. All geographic subdivisions smaller than a state (e.g., street address, city, county, precinct, ZIP code, and their equivalent geocodes)
3. All elements of dates (except year) directly related to an individual, including birth date, admission date, discharge date, date of death. And all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older
4. Telephone numbers
5. Fax numbers
6. Email addresses
7. Social Security numbers
8. Medical record numbers
9. Health plan beneficiary numbers
10. Account numbers
11. Certificate/license numbers
12. Vehicle identifiers and serial numbers, including license plate numbers
13. Device identifiers and serial numbers
14. Web Universal Resource Locators (URLs)
15. Internet Protocol (IP) address numbers
16. Biometric identifiers, including finger and voice prints
17. Full face photographic images and any comparable images
18. Any other unique identifying number, characteristic, or code

Practically speaking, the most common places public agencies slip up are with dates and smaller geographic identifiers. For instance, removing a name but leaving the exact date of injury and the specific department can easily identify an employee in a smaller agency through simple deduction. The goal is to make the person truly anonymous while keeping the useful data about the injury itself, like the type of injury, what happened (a slip and fall on city property), and the department, as long as it doesn’t accidentally point back to the individual. This demands a real de-identification protocol, often involving statistical analysis for small datasets, that goes far beyond a simple checklist.

Concrete Steps for Roswell Public Sector Entities to Ensure Compliance

To be ready for the January 1, 2026, deadline, Roswell city departments and Fulton County agencies need to start making changes right away. Here’s a plan:

1. Establish a De-identification Policy and Protocol

You need a written policy that says exactly how employee injury records will be de-identified before they’re released. This document should list the identifiers to be removed, the redaction methods (blacking out, anonymizing, data aggregation), and the review process. A strong policy also needs to define who has the authority to make the final call on tough de-identification decisions, a responsibility that requires senior-level commitment.

2. Designate a Privacy Officer or Lead

Someone has to be in charge of HB 101 compliance. This privacy officer will develop the protocols, train staff, and be the point person for any complex requests. In a small department, this could be the HR director or legal liaison. A bigger department might need someone in a dedicated role. Whoever it’s needs to know both the Georgia Open Records Act and general privacy principles inside and out.

3. Conduct Complete Staff Training

The people in HR, legal, risk management, and records management need to be trained on these new requirements. Training has to cover the details of O.C.G.A. Section 50-18-72(a)(20), the 18 identifiers, how to actually do redactions, and what happens if you get it wrong. You need this training done by mid-2025 so you have half a year to work out the kinks before the law takes effect. The Georgia Municipal Association (GMA) or the Association County Commissioners of Georgia (ACCG) will likely have workshops on this.

4. Review and Update Record Request Procedures

Look at your current process for handling Open Records Act requests, especially for employee injury data. You’ll probably need to update your request forms, your internal workflow for processing them, and the letters you send to requesters explaining the redactions. Being upfront about why you’re blacking things out can prevent a lot of arguments with requesters down the road.

5. Implement Technology Solutions (Where Applicable)

If you handle tons of records, redaction software can be a big help. These tools can automatically flag common PHI, which cuts down on manual work and reduces human error. But no software is perfect. It can speed up the process, but you still need a person to do a final review to catch things the software missed, because context is everything.

6. Consult Legal Counsel

With all the legal nuance, you need to talk to your lawyers, especially ones who are experts in government law and privacy rules. An attorney can help you write a compliant policy, give you advice on weird de-identification problems, and defend the agency if you get sued. Figuring out what “reasonably de-identified” really means in a specific situation is exactly what you pay lawyers for.

Potential Penalties for Non-Compliance

If you don’t follow the de-identification rules in O.C.G.A. Section 50-18-72, there will be serious consequences. The Georgia Open Records Act already allows for penalties. O.C.G.A. Section 50-18-73(b) says a public agency that acts in bad faith by denying access to records can face a civil penalty of up to $1,000 for a first offense and $2,500 for later ones. With this new amendment creating a specific duty to de-identify and release information, you can bet agencies are going to be under a lot more scrutiny.

And it’s not just the statutory fines. Failing to comply can lead to expensive lawsuits. A person or group denied access to records they’re entitled to can sue in Fulton County Superior Court to force you to release them, and if they win, you could be on the hook for their attorney’s fees. Even worse, if your de-identification is sloppy and you accidentally release private employee health information, the agency could be sued by its own employees for invasion of privacy. A single data handling screw-up can easily become a years-long legal and public relations disaster that destroys public trust in your agency.

This new amendment to O.C.G.A. Section 50-18-72 completely changes the responsibilities of Roswell’s public agencies when it comes to employee injury privacy. It’s no longer about withholding records. It’s about actively de-identifying them. This requires a much more careful approach to records management. Agencies have to move now to get strong policies, staff training, and expert advice in place to be ready for the January 1, 2026, deadline. It’s the only way to protect both employee privacy and government transparency.