Atlanta's card processors and Medicaid plans both live on partner APIs. Somebody has to hold the keys.
Georgia calls itself Transaction Alley for a reason, and most of its Medicaid members get care through private managed care plans. Both businesses run on partner APIs. So most Atlanta conversations we have start with one question. Once a token, a certificate or a member record leaves the core system, who owns it?
- Customer Identity (CIAM)Cybersecurity
- Secrets & Certificate LifecycleCybersecurity
- Machine & Workload IdentityCybersecurity
- API IntegrationApplication Services
- Healthcare Payer Platforms (Facets)Enterprise Platforms
- Data IntegrationData & Analytics
- Identity Threat Detection & ResponseCybersecurity
In Atlanta we work with payment processors, fintechs, health plans and logistics companies.
The work covers customer identity, API and machine credentials, payer platforms such as TriZetto Facets, and governed data pipelines. For payers, that includes the FHIR APIs the CMS interoperability rule requires. For processors, it means secrets rotation and access control across partner integrations. We're headquartered in Frisco, Texas, serve Georgia clients remotely and visit for workshops and launches.
Cohash is based in Frisco, Texas, with no Atlanta office. We work with Georgia organizations remotely and travel in for discovery, design workshops and go-live weekends.
- rules
- Georgia breach notification, O.C.G.A. §10-1-912Georgia HB 156 , cyber incident reportingCMS Interoperability and Prior Authorization Final Rule
What's specific about Atlanta
Each figure comes from a public source, linked on the card.
More than 260 fintech companies are in Georgia as of 2025, the state's economic development department says, citing the Technology Association of Georgia. It credits the cluster of payment processors for Atlanta's nickname, Transaction Alley.
source ↗ 02Georgia Medicaid managed care runs through just three contracted care management organizations. The Department of Community Health's list as of March 2025 names them as Amerigroup, CareSource and Peach State.
source ↗ 03 106.3 millionHartsfield-Jackson ranked first in the world for 2025 passenger traffic with 106.3 million travelers, according to ACI World's preliminary rankings.
source ↗ 04 646,100Trade, transportation and utilities make up about 646,100 of the Atlanta metro's roughly 3.1 million nonfarm jobs, going by BLS data for September 2026 (preliminary).
source ↗ 05The FTC brought its case over the 2017 Equifax breach in the Northern District of Georgia, home court of the credit bureau, which is based in Atlanta.
source ↗Who we work with in Atlanta, and the rules they work under
-
Payment processing and fintech
Processors connect to banks, card networks, ISOs and thousands of merchants, and each link carries an API key, a certificate or an SFTP account. The incidents we worry about start with a forgotten credential in a partner integration. We inventory machine identities, put owners and expiry dates on each one, and move secrets into a vault with automated rotation.
-
Medicaid and commercial health plans
Plans running Facets or a similar core now have to expose member and claims data through FHIR APIs, to patients, to providers and to other payers. The identity question is who gets to call each API, and how consent gets recorded. We design that authorization layer and the data pipelines sitting behind it.
-
Logistics and aviation
Large hourly and contractor workforces at carriers, freight forwarders and airline suppliers work on shared devices. Driver and partner apps often blur customer and workforce identity. We pull them apart, give frontline staff passwordless sign-in and tighten who can reach shipment and passenger data.
-
Utilities and state agencies
HB 156 makes Georgia agencies and utilities report cyber incidents to the state. The first question after an incident is which accounts were involved, and you want that answer in hours. So we put the effort into privileged access logs and identity threat detection.
-
Georgia breach notification, O.C.G.A. §10-1-912 ↗
Information brokers and data collectors must notify Georgia residents without unreasonable delay. A vendor holding data for them must report a breach within 24 hours of discovery. Breaches affecting more than 10,000 residents also require notice to the nationwide consumer reporting agencies.
-
Georgia HB 156 (2021), cyber incident reporting ↗
State agencies and utilities report qualifying cyberattacks through the Georgia Emergency Management and Homeland Security Agency portal, to its director. For state agencies, GTA guidance asks for that report within an hour of recognizing an incident.
-
CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) ↗
Applies to Medicaid managed care plans among other payers, so it reaches Georgia's CMOs. Operational prior authorization provisions began 1 January 2026, and the Patient Access, Provider Access, Payer-to-Payer and Prior Authorization API requirements apply primarily from 1 January 2027.
Most requested in Atlanta
The services clients in Atlanta ask us for most.
01We're a payment processor sitting on hundreds of partner API keys. Where do we even start?
With an inventory. We pull credentials from code repositories, CI pipelines, vaults and partner onboarding records, then match each to an owner and a partner contract. Rotation and short-lived tokens come after you know what exists.
02Can you build the CMS-0057-F APIs on top of Facets?
We build the extraction from Facets, the FHIR mapping and the authorization layer, on whichever FHIR server or interoperability platform you've picked. The timeline comes down to two questions we ask early. How clean is the data in your core system? And how much of the Patient Access API from the earlier rule did you already build?
03Does Georgia have a 30-day breach deadline like some states?
Georgia doesn't give you a day count for telling residents. The statute says "most expedient time possible and without unreasonable delay." The 24-hour rule is for a vendor telling the data owner. Check with counsel, since other states' deadlines kick in if you hold their residents' data too.
04Do you work with PCI DSS requirements?
On the identity side, yes. MFA into the cardholder data environment, unique IDs, access reviews and service account controls map directly to PCI DSS requirements 7 and 8. We do not act as a QSA.
05Can frontline logistics staff use passwordless sign-in on shared devices?
Usually. A badge works, or a FIDO2 key, or a short PIN with device trust. Which one depends on whether devices are shared per shift or assigned to people, and on what your handheld and scanner vendors support.
2c6ae88f - 01Georgia Department of Economic Development, Fintechgeorgia.org ↗
- 02Georgia DCH, Medicaid Managed Caredch.georgia.gov ↗
- 03ACI World, busiest airports 2025 (April 2026)aci.aero ↗
- 04BLS, Atlanta-Sandy Springs-Roswell economy at a glancebls.gov ↗
- 05FTC v. Equifax case pageftc.gov ↗
- 06O.C.G.A. §10-1-912 (Justia)law.justia.com ↗
- 07Georgia Technology Authority, cyber incident reportinggta.georgia.gov ↗
- 08PCI Security Standards Council document librarypcisecuritystandards.org ↗
- 09CMS, Interoperability and Prior Authorization Final Rulecms.gov ↗
Tell us what you're running. We'll tell you what we'd do first.
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it