In Tennessee, health care providers must keep all patient records strictly confidential and must have written policies in place to limit the use and disclosure of medical records, even if patient information is de-identified.1  In general, a provider may not sell or disclose a patient’s name or address, unless the disclosure is made to a government agency or a third party board for utilization, case management or peer review purposes.2  Additionally, patient information can be disclosed in response to a court ordered subpoena, or if requested by the Office of Inspector General.3  These requirements apply not simply to practitioners, but to hospitals4, nursing homes5, ambulatory surgical centers6, dentistry practices7, health maintenance organizations8, and laboratories as well9.

        Besides traditional patient medical records, the Tennessee requires that additional patient information that is disclosed to the state or third-parties be kept confidential as well.  This includes reporting of cancer cases to the state cancer registry10, information reported to the state stroke database11, vital records12, records of reported abortions13, reporting of birth defects14, reporting of sexually transmitted diseases15, reporting of incidents of abuse in health care facilities16, required reports to the state trauma registry17, traumatic brain injury reports18, information in the controlled substances database19, and data collected through communicable disease reports20.

        Finally, Tennessee also provides for the confidentiality of information submitted to peer review groups organized by health care facilities for patient safety and utilization study.21