Tennessee Healthcare Compliance Requirements

Tennessee healthcare practices operate under Tenn. Code §47-18-2107, the Tennessee data breach notification statute, layered with the Tennessee Identity Theft Deterrence Act. The statute imposes a 45-day outer notification limit on information holders generally, but §47-18-2107(i) provides that the section does not apply to an information holder subject to HIPAA as expanded by HITECH — so a covered medical practice is exempt from the state clock and HIPAA's own 60-day outer limit under 45 CFR §164.404 is the deadline that binds it. The Tennessee Attorney General's Consumer Protection Act lane — violations treated as unfair or deceptive acts, subject to the AG's full investigative subpoena power — follows the section, reaching the information holders it does cover rather than HIPAA-covered practices. Medical record retention sits at 10 years from last treatment under Tenn. Comp. R. & Regs. 1200-08-01-.08, with pediatric records held until age of majority plus 10 years. Tennessee is also a national leader in pharmacy-compounding regulation, with the Tennessee Board of Pharmacy enforcing rules that go beyond USP <795>/<797> for sterile and non-sterile compounding. Practices in Nashville, Memphis, Knoxville, and Chattanooga should account for the TN CSMD (Tennessee Controlled Substance Monitoring Database) every-Rx check requirement administered by the Tennessee Department of Health, and pain-management practices face additional Pain Management Clinic licensure requirements under the Tennessee Department of Health post-opioid-crisis regulatory framework. The Tennessee Bureau of Investigation handles certain healthcare-fraud investigations alongside the AG.

Tennessee sits in the more-active end of the regional pack for healthcare enforcement, though primarily through licensure rather than AG action. The Tennessee Board of Medical Examiners and the Tennessee Board of Pharmacy run active discipline lanes, particularly around pain-management and controlled-substance issues post-opioid crisis. The Tennessee Attorney General's office enforces §47-18-2107 under the Consumer Protection Act with no statutory penalty cap — civil penalties accrue per violation under the deceptive-acts framework — but §47-18-2107(i) carves HIPAA-covered information holders out of that section entirely, so for a covered practice the breach-notification duty is HIPAA's and the AG's remaining reach is its general consumer-protection authority rather than the state breach clock. Pain Management Clinic licensure under Tenn. Code §63-1-301 et seq. is the area where most outpatient practices feel the heaviest regulatory pressure, with the Tennessee Department of Health able to suspend licensure for documentation failures alone. Practices should expect that a PHI breach involving a controlled-substance prescription record will trigger both AG and licensure-board inquiries simultaneously.

Guides & Articles