Tenn. Code Ann. § 56-7-124 - Release of Information Relating to Physical or Mental Health of the Patient

The sale or marketing of information relating to the physical or mental health of an individual by any network providing health benefits is prohibited unless:

•         The patient has authorized the release of the information;
•         The information is released to an agent, contractor or corporate affiliate of the entity holding the information for a permitted use of the information;
•         The information is for research or audit purposes and does not readily identify the patient;
•         The information is transferred as part of an arrangement to assure the delivery of care, payment, health care or disease state management or oversight;
•         The information is released as part of a transfer of responsibility for the information;
•         The information is for case, disease or health management, drug utilization or quality review or outcomes research, designed to monitor utilization patterns, improve the quality of health care and delivery, assure compliance, control fraud, waste and abuse or contain costs and is released to any appropriate third parties.

Violation of the law is a Class C misdemeanor, and will be subject to a criminal penalty.  The insurance commissioner may also assess a penalty against each entity that violates the law.