HIPAA Compliance in Tennessee: State Healthcare Privacy

Tennessee Medical Records Confidentiality - Tenn. Code Ann. § 68-11-302

Tennessee's comprehensive medical records law requires:

• Healthcare providers must maintain complete and accurate medical records
• Records must be retained for minimum 5 years following last patient encounter
• Minors' records must be retained until age 19 or 5 years after last visit, whichever is longer
• Patients have right to inspect and receive copies of their records
• Copies must be provided within 15 business days of request
• Reasonable copying fees may be charged (not exceeding actual costs)
• Healthcare facilities must maintain access logs documenting all record reviews
• Security measures must prevent unauthorized access and disclosure

Tennessee Breach Notification Law - Tenn. Code Ann. § 47-18-2107

Tennessee's breach notification law establishes notification requirements:

• Notification required "without unreasonable delay" (interpreted as 45 days in Tennessee)
• Attorney General must be notified for breaches affecting 500+ Tennessee residents
• Affected individuals must be notified via US mail or email
• Notification must describe personal information involved
• Notification must include investigation findings and remediation measures
• Credit monitoring must be offered when financial information is compromised
• Notification must describe steps to protect identity and prevent fraud
• Breach investigation must be thorough and well-documented

Tennessee Patient Privacy Rights - Tenn. Code Ann. § 68-11-302.1

Tennessee law establishes specific patient privacy protections:

• Right to request restrictions on disclosure of health information
• Special protections for mental health and psychotherapy records
• Right to receive accounting of all disclosures
• Right to request amendments to medical records
• Special protections for substance abuse treatment records
• Genetic information receives heightened privacy protection
• Right to obtain records in electronic format when available
• Deceased patient records protected for 5 years post-death

Notification Timeline & Process

Tennessee's breach notification law requires timely notification with specific procedures:

1. Immediately investigate breach upon discovery
2. Assess scope and identify affected Tennessee residents
3. Notify affected individuals within 45 days of discovery
4. Simultaneously notify Tennessee Attorney General (500+ residents)
5. Notification must be written via first-class mail or email (with prior consent)
6. If contact is impossible, publish notice in major newspapers
7. Document all notification efforts and maintain records
8. Preserve breach investigation file for 3 years minimum

Required Notification Content

• Date of breach and date of discovery
• Description of personal information involved in the breach
• Description of breach investigation and findings
• Measures being taken to prevent future breaches
• Steps individuals should take to protect themselves
• Contact information for incident response team
• Information about offered credit monitoring services
• Details about fraud alert and security freeze options

Medical Records Management & Patient Rights

• Implement 15-business-day response system for medical record requests
• Maintain comprehensive access logs for all medical record reviews
• Create separate access logs for mental health and substance abuse records
• Establish procedures for patient disclosure restrictions
• Track minors' records until age 19 for retention compliance
• Implement enhanced protections for genetic information
• Create procedures for medical record amendment requests
• Train staff on Tennessee-specific privacy requirements

Breach Response and Investigation

• Develop incident response plan with 24-hour activation capability
• Create breach assessment process to identify 500+ resident threshold
• Establish Tennessee Attorney General notification procedure
• Implement data flow mapping for breach source identification
• Create 45-day breach notification tracking system
• Maintain breach documentation for 3 years minimum
• Document all investigation findings and remediation steps
• Conduct annual breach response drills and training

• Audit current breach notification procedures against 45-day timeline
• Create Tennessee Attorney General notification process (500+ residents)
• Implement 15-business-day response system for medical record requests
• Update medical records retention schedules to 5 years minimum
• Track minors' records until age 19 for retention compliance
• Create separate access logs for mental health/substance abuse records
• Develop breach assessment process to identify 500+ resident threshold
• Establish data flow mapping for breach identification
• Create Tennessee-specific employee privacy training
• Conduct annual third-party security audit and breach documentation review