Health record rights in Tennessee: what state law adds
In Tennessee, as of October 3, 2026, your OK is needed before at least some businesses outside HIPAA share your health data; you get a copy of your record faster than HIPAA requires, and free in some cases; we found no law on the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue only in a narrow case; breach notices need not cover medical or health insurance information; and no rule we look for on AI in care is in force. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Same answer in 31 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Yes, at least for some businesses. A law in force requires your OK before they use or share your health data (opt-in).
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
TIPA in force since July 1, 2025 requires consent to process sensitive data, including a mental or physical health diagnosis. It is a comprehensive law with revenue and volume thresholds, not a dedicated consumer health data law.
Tennessee Information Protection Act, controller duties (sensitive data consent). 2023 Tenn. Pub. Ch. 408 (HB1181), Sec. 2, new section 47-18-3204(a)(6) as numbered in the act (codified in Tenn. Code Ann. Title 47, Ch. 18, Part 33)
In force · effective · read October 3, 2026 · source(publications.tnsosfiles.com, reached from wapp.capitol.tn.gov)
Not process sensitive data concerning a consumer without obtaining the consumer's consent
Who it binds, in our words: Persons doing business in Tennessee that "Exceed twenty-five million dollars ($25,000,000) in revenue" and either derive over 50% of revenue from selling data of 25,000 consumers or, "During a calendar year, control or process personal information of at least one hundred seventy-five thousand (175,000) consumers". HIPAA PHI is exempt.
Tennessee Information Protection Act, definition of sensitive data. 2023 Tenn. Pub. Ch. 408 (HB1181), Sec. 2, new section 47-18-3201(26) as numbered in the act (codified in Tenn. Code Ann. Title 47, Ch. 18, Part 33)
In force · effective · read October 3, 2026 · source(publications.tnsosfiles.com, reached from wapp.capitol.tn.gov)
Personal information revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status
Who it binds, in our words: Same thresholds as 47-18-3202.
Genetic Information Privacy Act, disclosure to insurers and employers. Tenn. Code Ann. 47-18-4905, enacted by 2023 Pub. Ch. 324 (HB1310)
In force · effective · read October 3, 2026 · source(publications.tnsosfiles.com, reached from wapp.capitol.tn.gov)
A direct-to-consumer genetic testing company shall not disclose a consumer's genetic data without first obtaining the consumer's written consent to:
Who it binds, in our words: Direct-to-consumer genetic testing companies only. The act also requires "Separate express consent" for transfer to third parties other than vendors.
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
Yes, both. A deadline shorter than 30 days, and a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Both elements in force. Providers must give copies within 10 working days, shorter than HIPAA's 30 days. Hospitals must give indigent Social Security claimants a free copy. SB0432 (2025), proposing 20 working days, did not pass.
Deadline in the law: 10 days.
Free copy: Hospital records for an indigent person, or the person's attorney or representative, to support a Social Security Act claim or appeal, with a recent application or denial attached (68-11-304(a)(2)(B)). One free copy of the same records.
Fee rule: Providers (63-2-102, 2024 Pub. Ch. 737): paper copies "Twenty-five dollars ($25.00) for paper copies of medical records five (5) pages or less in length" and "Fifty cents (50¢) per page for each page copied after the first five (5) pages", plus mailing.
Fee rule: Providers: patient's own electronic copy "governed by the Health Insurance Portability and Accountability Act" (labor, supplies, postage).
Fee rule: Providers: other requesters' electronic copies $25 for 10 pages or less, then 25 cents per page up to $90; Social Security disability records a flat $20 when produced electronically.
Fee rule: Hospitals (68-11-304(a)(2)(A), 2025 Pub. Ch. 339): paper $25 for 5 pages or less, 50 cents per page after; patient's own electronic copy governed by HIPAA; other requesters "a flat fee of ninety dollars ($90.00)" for electronic records.
Fee rule: No fee for copies requested by the department of health for a complaint, inspection, or survey.
Goes beyond the federal floor: yes.
Release of medical records by health care providers, 10 working day deadline. Tenn. Code Ann. 63-2-101(a)(1), as substituted by 2024 Pub. Ch. 831, Section 2
In force · effective · read October 3, 2026 · source(publications.tnsosfiles.com, reached from wapp.capitol.tn.gov)
a health care provider shall provide to a patient or a patient's authorized representative a copy of such patient's medical records within ten (10) working days of receipt of a written request by the patient or the patient's authorized representative
Who it binds, in our words: Health care providers under Title 63. Ten working days. The same act adds a 10 working day rule to 68-11-1809.
Hospital records, no charge to indigent person for Social Security claim or appeal. Tenn. Code Ann. 68-11-304(a)(2)(B), as substituted by 2006 Pub. Ch. 691, Section 1
In force · effective · read October 3, 2026 · source(capitol.tn.gov, reached from wapp.capitol.tn.gov)
a hospital may not impose a charge on an indigent person for furnishing to such person, or such person's attorney or authorized representative, a health record or part thereof concerning such patient for the purpose of supporting a claim or appeal under any provision of the Social Security Act
Who it binds, in our words: Hospitals. Request must include a recent Social Security benefits application or denial. Legal aid and pro bono clients are presumed indigent.
Costs of reproduction, copying or mailing of records (providers). Tenn. Code Ann. 63-2-102(a), as substituted by 2024 Pub. Ch. 737, Section 1
In force · effective · read October 3, 2026 · source(publications.tnsosfiles.com, reached from wapp.capitol.tn.gov)
The reasonable fees for fulfilling a patient's request for the patient's own records are governed by the Health Insurance Portability and Accountability Act
Who it binds, in our words: Health care providers and their third-party release of information vendors. Per-page caps apply to paper copies.
Hospital record fees (paper and electronic). Tenn. Code Ann. 68-11-304(a)(2)(A), as substituted by 2025 Pub. Ch. 339, Section 1
In force · effective · read October 3, 2026 · source(publications.tnsosfiles.com, reached from wapp.capitol.tn.gov)
The fee for all electronic medical records must be a flat fee of ninety dollars ($90.00)
Who it binds, in our words: Hospitals, for requesters other than the patient. The patient's own electronic copy is governed by HIPAA.
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No Tennessee statute or rule on HIE consent found, and no current state-designated HIE policy found. The Lexis code site needs JavaScript, so searches ran on capitol.tn.gov and tn.gov. Regional HIEs such as etHIN publish their own opt-out policies.
How we searched (October 3, 2026): the official code search for health information exchange, health information exchange consent, health information exchange opt-out, HIE designated Tennessee. Agency pages checked: tn.gov.
Second check by a separate agent: confirmed.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
39-15-219(s)(1) makes the completed forms confidential and not public records. 39-15-203(d) also makes abortion records and reports confidential, but its enacting act was not opened. No court order staying 39-15-219 was found.
Final disposition of fetal remains, confidentiality of completed forms. Tenn. Code Ann. 39-15-219(s)(1), enacted by 2021 Pub. Ch. 348 (HB1181), Section 1
In force · effective · read October 3, 2026 · source(publications.tnsosfiles.com, reached from wapp.capitol.tn.gov)
A completed form described in subdivision (m)(1) is confidential and is not a public record open for inspection.
Who it binds, in our words: Forms on the disposition of fetal remains, which the physician keeps in the patient's medical record.
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
33-3-103 bars disclosure of Title 33 service records except as Part 3 allows. Current text matches the 2000 act. That act's general effective date was March 1, 2001.
Confidentiality of mental health records. Tenn. Code Ann. 33-3-103, enacted by 2000 Pub. Ch. 947 (HB3004), Section 1
In force · effective · read October 3, 2026 · source(capitol.tn.gov)
All applications, certificates, records, reports, legal documents, and pleadings made and all information provided or received in connection with services applied for, provided under, or regulated under this title and directly or indirectly identifying a service recipient or former service recipient shall be kept confidential
Who it binds, in our words: Services under Title 33 (mental health, substance use, intellectual and developmental disability). 33-3-104 sets consent by a recipient aged 16 or over.
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
68-10-113 limits release of health department STD records, including HIV, even on subpoena or court order. The Department of Health manual requires specific written authorization for HIV-AIDS information.
Confidentiality of sexually transmitted disease records and information. Tenn. Code Ann. 68-10-113 (Acts 1988, ch. 695; 1992, ch. 887)
In force · current version date not confirmed · read October 3, 2026 · source(tn.gov)
All records and information held by the department or a local health department relating to known or suspected cases of sexually transmitted disease shall be strictly confidential. Such information shall not be released or made public upon subpoena, court order, discovery, search warrant or otherwise
Who it binds, in our words: Department of Health and local health departments. Effective date not set: the 1992 amending act could not be opened online.
Department of Health HIPAA Policies and Procedures Manual, HIV-AIDS disclosure exception. Tennessee Department of Health HIPAA Policies and Procedures Manual (revised July 21, 2025), applying Tenn. Code Ann. 68-10-113
In force · effective · read October 3, 2026 · source(tn.gov)
HIV-AIDS information may not be disclosed to anyone without the specific written authorization of the client.
Who it binds, in our words: Department of Health. The manual states 68-10-113 covers "STD related medical records (including HIV)".
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The 2023 Genetic Information Privacy Act requires separate express consent for transfers and written consent before disclosure to insurers or employers. The Attorney General's consumer affairs division enforces it.
Genetic Information Privacy Act, consent requirements. Tenn. Code Ann. 47-18-4904(a)(3)(A), enacted by 2023 Pub. Ch. 324 (HB1310)
In force · effective · read October 3, 2026 · source(publications.tnsosfiles.com, reached from wapp.capitol.tn.gov)
Separate express consent for: (i) The transfer or disclosure of the consumer's genetic data to a person other than the company's vendors and service providers
Who it binds, in our words: Direct-to-consumer genetic testing companies.
Genetic Information Privacy Act, disclosure to insurers and employers. Tenn. Code Ann. 47-18-4905, enacted by 2023 Pub. Ch. 324 (HB1310)
In force · effective · read October 3, 2026 · source(publications.tnsosfiles.com, reached from wapp.capitol.tn.gov)
A direct-to-consumer genetic testing company shall not disclose a consumer's genetic data without first obtaining the consumer's written consent to:
Who it binds, in our words: Disclosure to health, life or long-term care insurers, or to the consumer's employer.
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Level 1 rests on the breach-only civil action. 68-11-1504 may allow suits for disclosing patient identifying information, but only a lead was found. The 1996 act was not online, so it was not scored. TIPA and GIPA lack private suits.
"Level" is the step on our rulebook's scale for this question. 0 means nothing beyond HIPAA. Higher means the law gives you more here.
Damages a court may award: None stated. Breach law allows a civil action to recover damages and an injunction.
Release of personal consumer information (breach notification), civil action. Tenn. Code Ann. 47-18-2107(h), as substituted by 2017 Pub. Ch. 91 (SB547)
In force · effective · read October 3, 2026 · source(publications.tnsosfiles.com, reached from wapp.capitol.tn.gov)
Any customer of an information holder who is a person or business entity, but who is not an agency of this state or any political subdivision of this state, and who is injured by a violation of this section, may institute a civil action to recover damages
Who it binds, in our words: Breach notification duties only. HIPAA-subject information holders are excluded from the section.
Tennessee Information Protection Act, no private right of action. Tenn. Code Ann. 47-18-3212(e), enacted by 2023 Pub. Ch. 408 (HB1181)
In force · effective · read October 3, 2026 · source(publications.tnsosfiles.com, reached from wapp.capitol.tn.gov)
A violation of this part shall not serve as the basis for, or be subject to, a private right of action
Who it binds, in our words: TIPA, including its sensitive data consent rule. Attorney General enforcement only.
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
No. The breach notice law covers neither medical nor health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The definition lists Social Security, driver license and financial account numbers only. Medical and health insurance information are not included. HIPAA-subject holders are excluded outright, recorded as hipaaDeemedCompliant true.
Deadline to tell people: No later than 45 days from discovery or notification of the breach.
No duty found to tell the attorney general or a regulator.
A business that follows HIPAA's breach rules is treated as following this law.
Release of personal consumer information, definition of personal information. Tenn. Code Ann. 47-18-2107(a)(4), as substituted by 2017 Pub. Ch. 91 (SB547)
In force · effective · read October 3, 2026 · source(publications.tnsosfiles.com, reached from wapp.capitol.tn.gov)
Means an individual's first name or first initial and last name, in combination with any one (1) or more of the following data elements: (i) Social security number; (ii) Driver license number; or
Who it binds, in our words: Information holders doing business in Tennessee and state agencies. The third element is financial account or card numbers with access codes.
Release of personal consumer information, notice deadline. Tenn. Code Ann. 47-18-2107(b), as substituted by 2017 Pub. Ch. 91 (SB547)
In force · effective · read October 3, 2026 · source(publications.tnsosfiles.com, reached from wapp.capitol.tn.gov)
The disclosure must be made no later than forty-five (45) days from the discovery or notification of the breach of system security
Who it binds, in our words: Notice to affected residents. Consumer reporting agencies are told when over 1,000 persons are notified. No AG notice requirement found.
Release of personal consumer information, HIPAA and GLBA exclusion. Tenn. Code Ann. 47-18-2107(i), as substituted by 2017 Pub. Ch. 91 (SB547)
In force · effective · read October 3, 2026 · source(publications.tnsosfiles.com, reached from wapp.capitol.tn.gov)
This section does not apply to any information holder that is subject to:
Who it binds, in our words: Excludes holders subject to GLBA Title V or HIPAA as expanded by HITECH.
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
No. A law is in force, but it has none of the three rules.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Only a marketing prohibition is in force. SB1261 on AI in utilization review was not enacted. HB2619/SB2155 on human review of AI-flagged denials failed in the Senate on April 7, 2026.
You must be told when AI is used in your care: not found.
A licensed clinician decides, not AI alone: not found.
You can reach a human, or have a human review the decision: not found.
Related limit on AI (recorded, not counted in the answer): Tenn. Code Ann. 33-1-205(a) (2026 Pub. Ch. 647, effective July 1, 2026): "A person who develops or deploys an artificial intelligence system shall not advertise or represent to the public that such system is or is able to act as a qualified mental health professional"
Artificial intelligence may not be represented as a qualified mental health professional. Tenn. Code Ann. 33-1-205, enacted by 2026 Pub. Ch. 647 (SB1580)
In force · effective · read October 3, 2026 · source(publications.tnsosfiles.com, reached from wapp.capitol.tn.gov)
A person who develops or deploys an artificial intelligence system shall not advertise or represent to the public that such system is or is able to act as a qualified mental health professional
Who it binds, in our words: Developers and deployers of AI systems. Violation is a Tennessee Consumer Protection Act violation, with a $5,000 civil penalty per violation.
Second check by a separate agent: confirmed.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
11.3%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
92.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
85.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
11.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$64,035 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
3.6%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
5.3%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
7.5%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
11.5%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
