O.C.G.A. § 45-12-151 (2019)

(a) No later than September 1, 2019, the office shall establish an operational Georgia Data Analytic Center capable of securely receiving, maintaining, and transmitting data in accordance with this part and with the HIPAA privacy and security standards applicable to this part. The office may employ staff to assist with carrying out the functions associated with the establishment and maintenance of the GDAC Project.

(b) The office shall ensure the procurement of hardware, software, and a data base system capable of performing analytics at scale and capable of evaluating all data to the extent required to carry out the purposes of the GDAC Project pursuant to this part. Further, the office shall procure sufficient management services to develop and maintain the system.

(c) Notwithstanding any provision of this part to the contrary, the GDAC Project shall seek to receive and maintain individually identifiable data but transmit de-identified data wherever possible and shall only receive, maintain, and transmit individually identifiable information if permitted by this Code section and other applicable law and if the information is in a form and format that are secured to prevent disclosure of individually identifiable information.