Hodges, Judge. Zafreen Nayani sued Neena Bhatia and Amina Hassanali (collectively, ‘the defendants”) alleging that Bhatia, in concert with Hassanali, improperly accessed Nayani’s medical records without authorization. The State Court of DeKalb County granted the defendants’ motion for summary judgment and Nayani appeals, arguing that the trial court improperly concluded that she failed to present evidence of damages as required for claims of invasion of privacy and violation of the Georgia Computer Systems Protection Act; failed to present sufficient evidence of civil conspiracy; and was not entitled to attorney fees under OCGA § 13-6-11 and punitive damages. For the following reasons, we affirm the trial court’s judgment in part, reverse in part, and remand this case for further proceedings. Our standard of review for motions for summary judgment is well-settled: Summary judgment is appropriate when there is no genuine issue of material fact and the movant is entitled to judgment as a matter of law. In reviewing the grant or denial of a motion for summary judgment, we apply a de novo standard of review, and we view the evidence, and all reasonable conclusions and inferences drawn from it, in the light most favorable to the nonmovant. (Citation omitted.) Grizzle v. Norsworthy, 292 Ga. App. 303, 303-304 (664 SE2d 296) (2008). So viewed, the record reveals[1] that nurse practitioner Bhatia began working at Amina Medical, a medical practice owned by Hassanali and Nayani’s husband, Kamal Nayani, in September 2018. Bhatia also worked at Sugarloaf Urgent and Primary Care, a medical practice in which Nayani had a one-half ownership interest. On April 3, 2019, as part of a brewing business dispute, Hassanali locked Nayani and her husband out of the Amina medical practice.[2] Thereafter, on April 10, 2019, while Bhatia was working at the Amina location, an employee at the Sugarloaf location noted that Nayani’s medical file was open. Electronic data suggested that Bhatia, or someone using her login credentials, had accessed Nayani’s medical records.[3] Nayani testified that she had not given Bhatia permission to access her records and had never been seen by Bhatia as a patient. When Nayani confronted Bhatia in a recorded telephone conversation, Bhatia flatly denied accessing the records. In unverified discovery responses, however, Bhatia stated that she had accessed the records at Nayani’s “prompting, in [Nayani's] presence, and with [Nayani's] permission.”[4] Nayani then sued Bhatia and Hassanali for civil conspiracy, violation of the Georgia Computer Systems Protection Act (“GCSPA”), invasion of privacy, negligence, attorney fees, and punitive damages. In large part, the trial court granted the defendants’ motion, concluding that Nayani: (1) “did not claim an injury serious enough to meet the threshold justifying a claim of tortious invasion of privacy[;]” (2) failed to “ plead or prove any physical or monetary injury or injury to her property” as required by OCGA § 16-9-93 (c) to show a GCSPA violation; (3) failed to present any evidence of negligence against Hassanali; and (4) provided “no evidence for Defendant Hassanali’s involvement in the alleged access of [Nayani's] medical records[,]” resulting in the dismissal of her claim for civil conspiracy. The trial court denied Bhatia’s motion as to Nayani’s claim of negligence against her, noting that “ questions of fact remain for the jury whether . . . Defendant Bhatia accessed [Nayani's] medical record and whether . . . she had permission to do so[.]” The trial court also granted the defendants’ motion as to Nayani’s claims for attorney fees and punitive damages. This appeal follows. 1. Nayani first contends that the trial court erred in granting the defendants summary judgment on her claim of invasion of privacy because she did not “claim an injury serious enough to meet the threshold justifying a claim of tortious invasion of privacy[.]” Although Nayani did not identify any specific monetary damages or damage to her property, she may yet be entitled to either nominal damages under OCGA § 51-12-4 or damages for injury to her “ peace, happiness, or feelings” pursuant to OCGA § 51-12-6. As a result, we reverse the trial court’s order granting the defendants summary judgment as to invasion of privacy. Georgia law incorporates “four disparate torts under the common name of invasion of privacy.” (Citation and punctuation omitted.) Bullard v. MRA Holding, 292 Ga. 748, 751 (2) (740 SE2d 622) (2013). Of those four torts, the one that is relevant to this case is the alleged “intrusion upon the plaintiff’s seclusion or solitude, or into [her] private affairs[.]” (Citation omitted.) Id. “ The ‘unreasonable intrusion’ aspect of the invasion of privacy involves a prying or intrusion, which would be offensive or objectionable to a reasonable person, into a person’s private concerns.” Yarbray v. S. Bell Tel. & Telegraph Co., 261 Ga. 703, 705 (409 SE2d 835) (1991). “[A] patient’s medical information, as reflected in the records maintained by his or her medical providers, is certainly a matter which a reasonable person would consider to be private.” King v. State, 272 Ga. 788, 790 (1) (535 SE2d 492) (2000); see also Baker v. Wellstar Health Systems, 288 Ga. 336, 338 (2) (703 SE2d 601) (2010) (“Though HIPAA preempts Georgia law in its imposition of procedural requirements, the substantive right to medical privacy under Georgia law endures.”);[5] King, 272 Ga. at 790 (1) (“Medical records are within the right of privacy afforded by the Federal Constitution. Because Georgia recognizes an even broader concept of privacy, the personal medical records of this state’s citizens clearly are protected by that right as guaranteed by our constitution.”). In addition, commentary to the Restatement (Second) of Torts suggests that invasion of privacy may be by some other form of investigation or examination into [the plaintiff's] private concerns, as by opening [her] private and personal mail, searching [her] safe or [her] wallet, examining [her] private bank account, or compelling [her] by a forged court order to permit an inspection of [her] personal documents. (Emphasis supplied.) § 652B (Comment (b)); see also King, 272 Ga. at 790 (1) (“We believe that medical records are entitled to more privacy than bank records and phone records.”) (citation and punctuation omitted); Anderson v. Mergenhagen, 283 Ga. App. 546, 552 (2) (642 SE2d 105) (2007) (“Georgia law does not require physical intrusion to establish a claim of invasion of privacy.”). Of particular note, “[t]he intrusion itself makes the defendant subject to liability, even though there is no publication or other use of any kind of the photograph or information outlined.” Restatement (Second) of Torts, § 652B (Comment (b)). In granting the defendants’ summary judgment motion on Nayani’s claim of invasion of privacy, the trial court stated only that “while [Nayani's] medical records, shared or not, may well be considered private information, . . . she did not claim an injury serious enough to meet the threshold justifying a claim of tortious invasion of privacy[.]“[6] Presumably, the absence of an “injury” to which the trial court referred was a lack of general damages. “General damages are those which the law presumes to flow from a tortious act and may be awarded without proof of any specific amount to compensate plaintiff for the injury done him.” (Citation and punctuation omitted.) Callahan v. Panfel, 195 Ga. App. 891, 893 (4) (395 SE2d 80) (1990). It is true that Nayani could not provide any information demonstrating that her reputation had been impacted by the alleged breach. She also acknowledged that her business had not been impacted and that she had not suffered any monetary loss as a result of the alleged invasion of privacy. However, the absence of any specific monetary damages or damage to Nayani’s property interests does not end our inquiry. Two additional damages provisions are implicated in this case. First, of course, “[d]amages are given as compensation for injury; generally, such compensation is the measure of damages where an injury is of a character capable of being estimated in money.” OCGA § 51-12-4. However, “[i]f an injury is small or the mitigating circumstances are strong, nominal damages only are given.” Id.; cf. Callahan, 195 Ga. App. at 893 (4) (“The law infers some damage from the invasion of a property right and if no evidence is given of any particular amount of loss, declares the right by awarding what it terms nominal damages.”) (citation and punctuation omitted). Second, “[i]n a tort action in which the entire injury is to the peace, happiness, or feelings of the plaintiff, no measure of damages can be prescribed except the enlightened consciences of impartial jurors.” OCGA § 51-12-6. “But this statute may be invoked only where the entire injury is to the peace, happiness, and feelings of the complainant, not to her purse.” (Citation and punctuation omitted; emphasis in original.) Dierkes v. Crawford Orthodontic Care, 284 Ga. App. 96, 101 (4) (643 SE2d 364) (2007). Moreover, “[i]f damages for mental pain and suffering sought under this section are not accompanied by physical or pecuniary loss, recovery is allowed only if the conduct complained of was malicious, wilful or wanton.” (Citation and punctuation omitted.) Sletto v. Hosp. Auth. of Houston County, 239 Ga. App. 203, 204 (1) (521 SE2d 199) (1999); see also Dierkes, 284 Ga. App. at 101 (4).[7] As it relates to Nayani’s claim of invasion of privacy, in which she effectively admits that she has not demonstrated general damages, Georgia law allows for the remedy of either nominal damages under OCGA § 51-12-4 or damages for injury to “peace, happiness, and feelings” pursuant to OCGA § 51-12-6 — but not both. See Dierkes, 284 Ga. App. at 101 (4). Although the record is not clear as to the form of damages Nayani is seeking, in that she has asked for both nominal damages and “peace, happiness, and feelings” damages,[8] we reverse the trial court’s order granting the defendants’ motion for summary judgment on Nayani’s claim of invasion of privacy because, contrary to the court’s order, Georgia law allows for either nominal damages or OCGA § 51-12-6 damages if invasion of privacy is proven.[9] 2. Next, Nayani argues that the trial court erred in awarding summary judgment to the defendants on her claim for violation of the GCSPA (OCGA § 16-9-93 (c)). Again, we agree. “Any person who uses a computer or computer network with the intention of examining any . . . medical . . . or any other financial or personal data relating to any other person with knowledge that such examination is without authority shall be guilty of the crime of computer invasion of privacy.” OCGA § 16-9-93 (c). In addition to the criminal penalties for violation of the statute, OCGA § 16-9-93 (g) (1) also provides a civil remedy by stating that “[a]ny person whose property or person is injured by reason of a violation of any provision of this article may sue therefor and recover for any damages sustained and the costs of suit.” Here, the trial court determined that, [w]hile it is unclear whether either [d]efendant had permission to access [Nayani's] medical records,[[10]] Defendants rightfully argue that [Nayani] did not, as required by OCGA § 16-9-93 (c), plead or prove any physical or monetary injury or injury to her property. Therefore, summary judgment is granted with regard to that claim. At the outset, we note that, pursuant to OCGA § 16-9-93 (g) (1), a plaintiff may recover “any damages sustained” resulting from a violation of OCGA § 16-9-93 (c). To that end, the Supreme Court of Georgia recently held that OCGA § 16-9-93 (g) (1) “does not limit the generality of the term ‘damages’ to the specific forms of compensatory damages listed therein[.]” (Citation and punctuation omitted; emphasis supplied.) Lyman v. Cellchem Intl., 300 Ga. 475, 477 (796 SE2d 255) (2017) (concluding that “the legislature did not intend for ‘punitive damages’ to be among the types of damages that may be recovered under OCGA § 16993 (g) (1)”). With no limitation on the category of compensatory damages available for a violation of OCGA § 16-9-93 (c), the damages we discussed in Division 1 are likewise available for Nayani’s cause of action for violation of the GCSPA. See OCGA §§ 51-12-4, 51-12-6.[11] Accordingly, consistent with our holding in Division 1, we likewise conclude that the trial court erred in granting the defendants’ motion for summary judgment as to Nayani’s GCSPA claim due to her purported lack of damages, as either nominal damages or OCGA § 51-12-6 damages are available for her claim if proven.[12] 3. Nayani next asserts that sufficient circumstantial evidence existed to support her claim of civil conspiracy and to overcome the defendants’ summary judgment motion. Although we agree with the trial court’s decision, we do so for different reasons. See, e.g., City of Gainesville v. Dodd, 275 Ga. 834, 835 (573 SE2d 369) (2002) (reiterating that “an appellate court will affirm a judgment if it is correct for any reason, even if that reason is different than the reason upon which the trial court relied”). Under Georgia law, “[a] conspiracy is a combination of two or more persons to accomplish an unlawful end or to accomplish a lawful end by unlawful means.” (Citation and punctuation omitted.) Patel v. Diplomat 1419VA Hotels, 358 Ga. App. 732, 742 (4) (856 SE2d 340) (2021). To recover damages for a civil conspiracy claim, a plaintiff must show that two or more persons, acting in concert, engaged in conduct that constitutes a tort. Absent the underlying tort, there can be no liability for civil conspiracy. . . . Moreover, . . . more than one person is necessary to form a conspiracy. (Citation and punctuation omitted.) Id. In addition, the law does not authorize a finding that conspiracy exists merely because of some speculative suspicion and while the question of conspiracy is generally one for a jury, the mere fact that conspiracy has been alleged does not require submission of the question to a jury where there is no evidence of record that the alleged conspirators either positively or tacitly came to a mutual understanding to accomplish an unlawful end or to accomplish a lawful end by an unlawful means. First Fed. Sav. Bank v. Hart, 185 Ga. App. 304, 305-306 (2) (363 SE2d 832) (1987). (a) Conspiracy – Negligence. Relevant to this issue, we first note that the trial court granted Hassalani summary judgment on Nayani’s claim for negligence.[13] Immediately thereafter, the trial court stated Accordingly, the civil conspiracy claim fails. [Nayani] has provided no evidence for Defendant Hassanali’s involvement in the alleged access of [Nayani's] medical records. . . . [Nayani's] allegations that Defendant Hassanali . . . “directed” Defendant Bhatia or “acted in concert” with her are purely speculative and not supported by any evidence. (Emphasis supplied.) In view of Hassanali’s dismissal, Bhatia could not be found to have conspired alone. See Patel, 358 Ga. App. at 742 (4). But more fundamentally, “[a]n allegation of a conspiracy to commit negligence is a non sequitur.” Holland v. Sanfax Corp., 106 Ga. App. 1, 6 (2) (126 SE2d 442) (1962); see also R. R. R. Partnership v. Investguard, 219 Ga. App. 34, 35 (463 SE2d 735) (1995) (“There can be no conspiracy without a purpose, express or implied, to do something unlawful, oppressive, or immoral[.]“) (citation and punctuation omitted). For these reasons, the trial court’s order granting the defendants’ motion for summary judgment, as it relates to Nayani’s claim of conspiracy to commit negligence, is affirmed. (b) Conspiracy – Violation of GCSPA and Invasion of Privacy. With regard to Nayani’s remaining claims of conspiracy, we likewise affirm the trial court’s judgment. In this case, Nayani generally alleged that the defendants “agreed to do the torts complained of . . ., or else to do some lawful act by methods which constitute a tort.” In response to the defendants’ summary judgment motion, Nayani claimed only that Bhatia accessed Nayani’s medical records at Hassanali’s medical office, where Bhatia and Hassanali worked together; that Hassanali had previously asked Nayani about her medical history and had asked to be her doctor; and that the alleged breach occurred one week after Hassanali became embroiled in a business dispute with her business partner and Nayani’s husband, Kamal Nayani.[14] The circumstantial evidence pointed to by [Nayani] from which [she] claims a conspiracy may be inferred is purely speculative. An inference cannot be based upon evidence which is too uncertain or speculative or which raises merely a conjecture or possibility. (Citation omitted.) Zions First Nat. Bank v. Macke, 316 Ga. App. 744, 751 (3) (730 SE2d 462) (2012). While these disparate facts may be sufficient to arouse suspicions, these facts, even when viewed in a light most favorable to Nayani, fall well short of demonstrating that Bhatia and Hassanali “positively or tacitly came to a mutual understanding to accomplish an unlawful end or to accomplish a lawful end by an unlawful means.” First Fed. Sav. Bank, 185 Ga. App. at 305-306 (2);[15] see, e.g., Roberts v. Lane, 210 Ga. App. 10, 12 (1) (435 SE2d 227) (1993) (“There is ample evidence to sustain a finding that the Robertses share animosity for Lane and the Robertson children. There is no evidence showing that Barbara Roberts entered into a conspiracy with her husband to impugn Lane and the Robertson children by accusing them of criminal acts.”). As a result, we affirm the trial court’s order granting the defendants’ motion for summary judgment on Nayani’s claim of civil conspiracy with respect to the invasion of privacy and GCSPA violation claims. 4. Finally, Nayani contends the trial court erred in granting the defendants summary judgment on her claims of OCGA § 13-6-11 attorney fees and punitive damages. The trial court concluded that, “[b]ecause no tort claim survives against Defendant Hassanali, and neither punitive damages nor attorney fees attach to Defendant Bhatia’s potential negligence claim, Defendants are entitled to summary judgment on [Nayani's] respective claims.” We can agree with only a small portion of the trial court’s statement. (a) Invasion of Privacy. In Division 1, we concluded that the trial court erroneously granted the defendants’ summary judgment motion as to Nayani’s claim for invasion of privacy based upon a purported lack of damages. In light of our decision reviving Nayani’s cause of action, subject to the trial court’s review on remand, her claims for attorney fees and punitive damages arising from the alleged invasion of privacy are again viable. See, e.g., Jordan v. Kimpton Hotel and Restaurant Group, 368 Ga. App. 750, 760 (3) (g) (890 SE2d 417) (2023). That portion of the trial court’s order is therefore reversed. (b) Violation of GCSPA. However, with regard to Nayani’s claim of violation of the GCSPA, we reach a different conclusion. Our Supreme Court has held that punitive damages are not available for causes of action alleging violations of OCGA § 16-9-93 (c).[16] See Lyman, 300 Ga. at 477 (concluding that “the legislature did not intend for ‘punitive damages’ to be among the types of damages that may be recovered under OCGA § 16993 (g) (1)”). However, “[a]n award of attorney fees under OCGA § 13611 is a compensatory damages award” and, as such, may be available to Nayani on this claim. Davis v. Whitford Properties, 282 Ga. App. 143, 148 (3) (637 SE2d 849) (2006). Since we have revived Nayani’s claim for violation of the GCSPA, her claim for attorney fees is likewise revived. See, e.g., Jordan, 368 Ga. App. at 760 (3) (g). Therefore, we affirm the trial court’s order granting the defendants’ summary judgment motion on the issue of punitive damages for her GCSPA violation claim, but reverse the order as it relates to attorney fees for her claim. (c) Negligence. Because Nayani’s claim of negligence against Bhatia is proceeding, it would be inappropriate to dismiss Nayani’s claims for OCGA § 13-6-11 attorney fees and punitive damages at this stage. See Collins v. Athens Orthopedic Clinic, 356 Ga. App. 776, 782 (5) (849 SE2d 213) (2020). Therefore, that portion of the trial court’s order is reversed.[17] In sum, we affirm the trial court’s judgment granting the defendants’ motion for summary judgment as to Nayani’s claims for civil conspiracy and for punitive damages based upon the alleged GCSPA violation. We reverse the trial court’s order granting summary judgment to the defendants on Nayani’s claims for a GCSPA violation and for invasion of privacy. And because we reverse summary judgment in the defendants’ favor on those claims, we likewise reverse the court’s grant of summary judgment as to Nayani’s claim for OCGA § 13-6-11 attorney fees related to the GCSPA violation and her claims for attorney fees and punitive damages for invasion of privacy. Finally, because it would be inappropriate at this stage, we reverse that portion of the trial court’s order granting the defendants’ summary judgment motion as to attorney fees and punitive damages arising from Nayani’s claim for negligence against Bhatia. Therefore, we affirm the trial court’s judgment in part, reverse in part, and remand this case for further proceedings. Judgment affirmed in part and reversed in part, and case remanded. Miller, P. J., concurs, and Mercier, C.J., concurs in judgment only.
