Tenn. Code Ann. § 50-1-306 - Authorization of patient to market or sell medical information

No employer or his agent, contractor or employee may market or sell medical information that directly identifies an employee, unless the employee has authorized the release of the information in written, electronic or other form indicating the person’s consent.  Medical information includes:

1. Lists of employees or family members receiving health insurance;
2. Records for medical services provided or paid for by the employer for purposes unrelated to:
   1. The provision of health care to the employee or family members receiving insurance;
   2. Payment for health care to the employee or family members receiving health insurance; or
   3. The administration of any health plan or program offered by the plan.

A violation of this law is punishable as a misdemeanor.