Tennessee Health Privacy Rights

Private Right of Action: Tennessee stands out because its courts have recognized that patients can sue for unauthorized disclosure of medical information under the doctrine of breach of physician-patient confidentiality. Also, Tennessee statute T.C.A. § 68-11-150 makes it explicit that patient records are confidential and improper disclosure can lead to liability. This means Tennessee patients have a state-backed right to keep their records private and can seek damages if a provider divulges information improperly (e.g., a nurse gossiping about a patient's condition could result in a lawsuit).

Access: Tennessee law echoes HIPAA in requiring providers to furnish records to patients; no shorter deadline is specified (so 30 days, now 15 under new HIPAA, applies).

Mental Health: Tennessee's laws on mental health records generally require patient consent for release of psychotherapy notes and communications, similar to HIPAA but reinforced by state code.

Drug Testing: TN has specific consent requirements for releasing drug/alcohol test results, giving patients rights over who can see those.

General: Aside from the ability to sue, TN's substantive rules align with HIPAA (consent needed for non-TPO disclosures, etc.). Breach notification in TN is aligned with standard practice (notice expediently, state AG notification if many affected).