What a provider can and can't say in Tennessee
The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.
Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]
Review-response rule by practice type
| Practice category | HIPAA status | Applies without HIPAA? | Review-response rule source |
|---|---|---|---|
| Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Yes - applies to licensed providers regardless of HIPAA status | Givens covenant; BME unprofessional conduct; no board order located |
| Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Partly: Givens covenant (dental grounds not read) | Givens covenant; BME unprofessional conduct; no board order located |
| General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Yes - applies to licensed providers regardless of HIPAA status | Givens covenant; BME unprofessional conduct; no board order located |
| Medical med spa | Depends; cash-only med spas often not covered | Partly: Givens covenant and BME discipline reach physicians; PPPA facility-only | Givens covenant; BME unprofessional conduct; no board order located |
| Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | No | Givens covenant; BME unprofessional conduct; no board order located |
- Consumer privacy and health data law: Tennessee has a consumer privacy law in force (TIPA ($25 million revenue and a data-volume threshold)). It exempts HIPAA-covered practices as a whole (an entity-level exemption). [TN-001, TN-002]
- Data breach notification: Its data breach notification law does not list medical information as a trigger on its own, so a breach involving only charts or photos may not require state notice (HIPAA breach rules still apply to HIPAA covered entities). Information holders subject to HIPAA are excluded.† [TN-005]
- Patient confidentiality duties: Patient confidentiality duties come mainly from a facility statute and contract (Givens) and board.† [TN-003, TN-004]
- Patient confidentiality duties: The licensing-board discipline ground for confidentiality breaches appears to be a general professional-conduct ground (Tenn. Code 63-6-214(b)(1)), but its text was not read in this research (a gap). Separately, the Tennessee Supreme Court has recognized an implied duty of confidentiality in the contract for medical care.† [TN-004, U-98]
- Lawsuits by individuals: Patients may be able to sue in some situations (PPPA facilities; Givens).† [TN-003, TN-004]
- Photos, names and likeness: A statute limits using a person's name or likeness in advertising without consent (47-25-1105 ELVIS Act).† [TN-003, TN-010]
- Med spa rules: Med spas: there is med-spa-specific law (Med-spa-specific statute plus registration rule).† [TN-006, TN-007]
- Enforcement located: Strongest state enforcement evidence located: official enforcement against comparable conduct (E1) (med spa compliance action, Hampton 2026; no privacy enforcement located). Not finding enforcement does not mean none exists. [TN-009]
- Research notes and gaps: Tennessee code text was read on an unofficial website and should be confirmed against the official code. [U-95]
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources:
- [TN-001] 2023 Tenn. Pub. Acts ch. 408 (HB 1181), secs. 1-6; Tenn. Code 47-18-3201(26), -3202, -3210 Sec. 6 (effective date) (https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf)
- [TN-002] Tenn. Code 47-18-3212; -3213 (per PC 408 text) (https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf)
- [TN-003] Tenn. Code 68-11-1502; 68-11-1503(a)-(c); 68-11-1504 (https://law.justia.com/codes/tennessee/title-68/health/chapter-11/part-15/section-68-11-1503/)
- [TN-004] Givens v. Mullikin ex rel. McElwaney, 75 S.W.3d 383 (Tenn. 2002) (https://caselaw.findlaw.com/court/tn-supreme-court/1000183.html)
- [TN-005] Tenn. Code 47-18-2107(a)(4), (b), (g), (h), (i)(2) (https://law.justia.com/codes/tennessee/title-47/chapter-18/part-21/section-47-18-2107/)
- [TN-006] Tenn. Code 63-1-153(a)-(c); 63-6-105(a)-(b) (https://law.justia.com/codes/tennessee/title-63/chapter-1/part-1/section-63-1-153/)
- [TN-007] Tenn. Comp. R. & Regs. 0880-02-.24(1)-(5); 0880-02-.02 (fee); 0880-02-.14(10) (https://publications.tnsosfiles.com/rules/0880/0880-02.20250617.pdf)
- [TN-009] In re Samuel Hampton, M.D. (TN Lic. 62072) DAR April 2026, Board of Medical Examiners (https://www.tn.gov/content/dam/tn/health/dar/April-2026.pdf)
- [TN-010] Tenn. Code 47-25-1105(a)-(b) (https://law.justia.com/codes/tennessee/title-47/chapter-25/part-11/section-47-25-1105/)
*Educational information, not legal advice. Last reviewed October 22, 2026.*
State comparison
All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.
| Tennessee (TN) | Cosmetic/plastic surgery | Depends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are not | Patient's Privacy Protection Act 68-11-1501 et seq. (licensed facilities only); Givens implied covenant; BME 63-6-214(b)(1) unprofessional conduct | Yes - applies to licensed providers regardless of HIPAA status | TIPA (47-18-3201), eff. 2025-07-01: ENTITY-level HIPAA CE/BA exemption; $25M revenue AND 175k/25k+50%; sensitive data needs consent | 47-18-2107: medical info NOT covered; <=45 days; HIPAA-subject holders excluded entirely | Givens covenant; BME unprofessional conduct; no board order located | HIPAA if covered; 68-11-1503(a)(2) image policy (facilities); 47-25-1105 consent for ads | Personal Rights Protection Act 47-25-1105 (ELVIS Act 2024): prior consent; civil + Class A misdemeanor | Yes: PPPA invasion-of-privacy damages (facilities); Givens contract claim; breach-law customer action (non-HIPAA) | Board of Medical Examiners, Board of Osteopathic Examination, Board of Dentistry, Dept. of Health, AG | TIPA up to $7,500/violation (treble if willful); BME Type A $500-$1,000 | E1 med spa compliance (BME Hampton 2026, registration lapse); E4 for privacy | Medium-High | 2026-10-22 |
| Tennessee (TN) | Cosmetic dentistry | Usually yes if it files any electronic dental claims; cash-only dental is not | Patient's Privacy Protection Act 68-11-1501 et seq. (licensed facilities only); Givens implied covenant; BME 63-6-214(b)(1) unprofessional conduct | Partly: Givens covenant (dental grounds not read) | TIPA (47-18-3201), eff. 2025-07-01: ENTITY-level HIPAA CE/BA exemption; $25M revenue AND 175k/25k+50%; sensitive data needs consent | 47-18-2107: medical info NOT covered; <=45 days; HIPAA-subject holders excluded entirely | Givens covenant; BME unprofessional conduct; no board order located | HIPAA if covered; 68-11-1503(a)(2) image policy (facilities); 47-25-1105 consent for ads | Personal Rights Protection Act 47-25-1105 (ELVIS Act 2024): prior consent; civil + Class A misdemeanor | Yes: PPPA invasion-of-privacy damages (facilities); Givens contract claim; breach-law customer action (non-HIPAA) | Board of Medical Examiners, Board of Osteopathic Examination, Board of Dentistry, Dept. of Health, AG | TIPA up to $7,500/violation (treble if willful); BME Type A $500-$1,000 | E1 med spa compliance (BME Hampton 2026, registration lapse); E4 for privacy | Medium-High | 2026-10-22 |
| Tennessee (TN) | General medical/dermatology (elective cosmetic) | Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patients | Patient's Privacy Protection Act 68-11-1501 et seq. (licensed facilities only); Givens implied covenant; BME 63-6-214(b)(1) unprofessional conduct | Yes - applies to licensed providers regardless of HIPAA status | TIPA (47-18-3201), eff. 2025-07-01: ENTITY-level HIPAA CE/BA exemption; $25M revenue AND 175k/25k+50%; sensitive data needs consent | 47-18-2107: medical info NOT covered; <=45 days; HIPAA-subject holders excluded entirely | Givens covenant; BME unprofessional conduct; no board order located | HIPAA if covered; 68-11-1503(a)(2) image policy (facilities); 47-25-1105 consent for ads | Personal Rights Protection Act 47-25-1105 (ELVIS Act 2024): prior consent; civil + Class A misdemeanor | Yes: PPPA invasion-of-privacy damages (facilities); Givens contract claim; breach-law customer action (non-HIPAA) | Board of Medical Examiners, Board of Osteopathic Examination, Board of Dentistry, Dept. of Health, AG | TIPA up to $7,500/violation (treble if willful); BME Type A $500-$1,000 | E1 med spa compliance (BME Hampton 2026, registration lapse); E4 for privacy | Medium-High | 2026-10-22 |
| Tennessee (TN) | Medical med spa | Depends; cash-only med spas often not covered | Patient's Privacy Protection Act 68-11-1501 et seq. (licensed facilities only); Givens implied covenant; BME 63-6-214(b)(1) unprofessional conduct | Partly: Givens covenant and BME discipline reach physicians; PPPA facility-only | TIPA (47-18-3201), eff. 2025-07-01: ENTITY-level HIPAA CE/BA exemption; $25M revenue AND 175k/25k+50%; sensitive data needs consent | 47-18-2107: medical info NOT covered; <=45 days; HIPAA-subject holders excluded entirely | Givens covenant; BME unprofessional conduct; no board order located | HIPAA if covered; 68-11-1503(a)(2) image policy (facilities); 47-25-1105 consent for ads | Personal Rights Protection Act 47-25-1105 (ELVIS Act 2024): prior consent; civil + Class A misdemeanor | Yes: PPPA invasion-of-privacy damages (facilities); Givens contract claim; breach-law customer action (non-HIPAA) | Board of Medical Examiners, Board of Osteopathic Examination, Board of Dentistry, Dept. of Health, AG | TIPA up to $7,500/violation (treble if willful); BME Type A $500-$1,000 | E1 med spa compliance (BME Hampton 2026, registration lapse); E4 for privacy | Medium-High | 2026-10-22 |
| Tennessee (TN) | Nonmedical aesthetic business | Generally no (not a health care provider billing electronically) | Patient's Privacy Protection Act 68-11-1501 et seq. (licensed facilities only); Givens implied covenant; BME 63-6-214(b)(1) unprofessional conduct | No | TIPA (47-18-3201), eff. 2025-07-01: ENTITY-level HIPAA CE/BA exemption; $25M revenue AND 175k/25k+50%; sensitive data needs consent | 47-18-2107: medical info NOT covered; <=45 days; HIPAA-subject holders excluded entirely | Givens covenant; BME unprofessional conduct; no board order located | HIPAA if covered; 68-11-1503(a)(2) image policy (facilities); 47-25-1105 consent for ads | Personal Rights Protection Act 47-25-1105 (ELVIS Act 2024): prior consent; civil + Class A misdemeanor | Yes: PPPA invasion-of-privacy damages (facilities); Givens contract claim; breach-law customer action (non-HIPAA) | Board of Medical Examiners, Board of Osteopathic Examination, Board of Dentistry, Dept. of Health, AG | TIPA up to $7,500/violation (treble if willful); BME Type A $500-$1,000 | E1 med spa compliance (BME Hampton 2026, registration lapse); E4 for privacy | Medium-High | 2026-10-22 |
Cases this research tied to this jurisdiction
Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.
Tennessee Board of Medical Examiners: Samuel Hampton, M.D.
Tennessee Board of Medical Examiners · TN (state licensing) · Action in March 2026
- Provider type
- Physician (med spa medical director)
- Relevant facts
- Failed for about 12 months to renew the registration of the med spa he directed
- Legal issues
- Tenn. Comp. R. & Regs. 0880-02-.24(5) (operating without registration = unprofessional conduct)
- Holding, findings, allegations or settlement terms
- Board action per official monthly summary
- Consequences recorded
- Reprimand; $600 civil penalties; costs up to $2,000
- Procedural status
- Final (per DAR; order not read)
- Precedential?
- No
- Why it is in this research
- Med spa registration duty is enforced against the medical director
Tennessee EMS Board: Nicholas Knight (AEMT)
Tennessee Emergency Medical Services Board · TN (state licensing) · Suspension from 2025-09-17
- Provider type
- Advanced EMT
- Relevant facts
- Admitted taking graphic images during emergency care and sharing two photos with at least one unauthorized person
- Legal issues
- Tenn. Code 68-140-311(a); Tenn. Comp. R. & Regs. 1200-12-01-.17(4) (violating confidentiality is unethical conduct)
- Holding, findings, allegations or settlement terms
- Agreed order per official summary (admission)
- Consequences recorded
- One-month suspension; three years' probation; HIPAA and ethics courses
- Procedural status
- Final (per DAR; order not read)
- Precedential?
- No
- Why it is in this research
- Board treated sharing patient photos as a confidentiality violation (not cosmetic; EMS)
Givens v. Mullikin ex rel. McElwaney
Tennessee Supreme Court · TN · 2002
- Provider type
- Physician; defense counsel
- Relevant facts
- Defense counsel obtained a patient's information through informal contacts with a treating physician
- Legal issues
- Implied covenant of confidentiality; inducement of breach
- Holding, findings, allegations or settlement terms
- Judicial holding (per summaries): covenant implied in contracts for medical care; informal disclosure to opposing counsel can breach it; inducement claim may lie; some claims failed for lack of cognizable damages
- Consequences recorded
- Mixed (per summaries)
- Procedural status
- Final (precedent)
- Precedential?
- Yes (state supreme court)
- Why it is in this research
- Common-law exposure for disclosures outside the record (application inferred)
Related pages
Topics
† Marked statements rely in part on a copy of the source hosted on an unofficial website, or on a finding this research rated lower confidence. Check the official source before relying on them.
Sources
TN-001. 2023 Tenn. Pub. Acts ch. 408 (HB 1181), secs. 1-6; Tenn. Code 47-18-3201(26), -3202, -3210
Tennessee Information Protection Act (TIPA), Tenn. Code 47-18-3201 et seq., effective July 1, 2025. Applies to persons with revenue over $25 million that control or process data of at least 175,000 consumers, or of 25,000 consumers with over 50% of gross revenue from selling personal information. Exempts at ENTITY level a HIPAA covered entity or business associate governed by the HHS privacy, security and breach rules, and at DATA level protected health information. Sensitive data (including mental or physical health diagnosis, and biometric data used to identify) may not be processed without consent.
Statute (session law) · Explicit · High · Revenue threshold AND volume threshold both required, so most single-site practices and med spas fall outside TIPA (inference). Biometric data excludes photographs.
TN-002. Tenn. Code 47-18-3212; -3213 (per PC 408 text)
TIPA enforcement: the Attorney General and Reporter has exclusive enforcement; 60 days' written notice and opportunity to cure before an action; civil penalty up to $7,500 per violation; treble damages for willful or knowing violations; attorney fees and costs; no private right of action (including class actions).
Statute (session law) · Explicit · High · Maximum, not typical. 47-18-3213 adds an affirmative defense for a written privacy program conforming to the NIST Privacy Framework (as read). Section numbers from the session law.
TN-005. Tenn. Code 47-18-2107(a)(4), (b), (g), (h), (i)(2)
Breach law: 'personal information' = name plus SSN, driver license number, or financial account/card number with code; medical information is NOT covered. Notice no later than 45 days after discovery; consumer reporting agencies if more than 1,000; a person or business customer injured may sue for damages and injunction. The section does NOT apply to information holders subject to HIPAA (as expanded by HITECH).
Statute · Explicit · Medium-High · Secondary host. HIPAA-covered practices are outside the state breach statute entirely; HHS breach rule governs them.
https://law.justia.com/codes/tennessee/title-47/chapter-18/part-21/section-47-18-2107/
TN-003. Tenn. Code 68-11-1502; 68-11-1503(a)-(c); 68-11-1504
Patient's Privacy Protection Act: every patient of a health care facility licensed by the Board for Licensing Health Care Facilities has a right to privacy; the patient's name, address and other identifying information may not be divulged except listed purposes and may not be sold; providers must have a policy limiting use of records, images, videos or pictures for medical education, with written authorization when reasonably possible; any violation is an invasion of the patient's right to privacy, and civil actions for damages for invasion of privacy are available.
Statute · Explicit · Medium-High · Secondary host (Justia); official Tennessee Code is Lexis-hosted. Scope limited to licensed FACILITIES (hospitals, ASTCs etc.); whether a physician office or med spa is covered is doubtful (inference; U-71).
https://law.justia.com/codes/tennessee/title-68/health/chapter-11/part-15/section-68-11-1503/
TN-004. Givens v. Mullikin ex rel. McElwaney, 75 S.W.3d 383 (Tenn. 2002)
Tennessee Supreme Court: a contract for medical care implies a covenant of confidentiality; a physician's unauthorized informal disclosure of medical information to an adverse party's counsel can breach it; a third party who induces the breach may be liable.
Judicial decision · Holding per summaries (official tncourts.gov copy behind a browser check; not read) · Medium · Common-law exposure for review replies that disclose patient information (application inferred).
https://caselaw.findlaw.com/court/tn-supreme-court/1000183.html
TN-010. Tenn. Code 47-25-1105(a)-(b)
Personal Rights Protection Act (as amended by the 2024 ELVIS Act): knowingly using an individual's name, photograph, voice or likeness in any medium for advertising or solicitation without prior consent is civilly actionable and a Class A misdemeanor; distributing unauthorized voice or likeness is also actionable.
Statute · Explicit · Medium-High · Before/after photos and testimonials in ads need prior consent (application inferred). Remedies section 47-25-1106 not read.
https://law.justia.com/codes/tennessee/title-47/chapter-25/part-11/section-47-25-1105/
TN-006. Tenn. Code 63-1-153(a)-(c); 63-6-105(a)-(b)
Medical spa law: a 'medical spa' is any entity offering or performing cosmetic medical services (any service using a biologic or synthetic material, chemical, mechanical device or displaced energy that alters or is capable of altering living tissue to improve appearance), excluding a physician-owned practice; it must display the medical director's name and board-certification status at the site and in advertising. The Board of Medical Examiners maintains an online registry that also includes physician-owned practices holding themselves out as med spas or primarily performing elective cosmetic services.
Statute · Explicit · Medium-High · Secondary host for statute text; implementing rule read from the official Secretary of State PDF (TN-007).
https://law.justia.com/codes/tennessee/title-63/chapter-1/part-1/section-63-1-153/
TN-007. Tenn. Comp. R. & Regs. 0880-02-.24(1)-(5); 0880-02-.02 (fee); 0880-02-.14(10)
BME rule: any medical spa offering cosmetic medical services must register before operating (annual, $175 fee), naming a medical director or supervising physician with an active Tennessee license and practice who attests to responsibility for the cosmetic services; operation without current registration is unprofessional conduct by the director and any supervising physician. Separately, any practice-of-medicine procedure performed with a laser is the practice of medicine and must be under physician supervision.
Regulation · Explicit · High · Laser rule requires 'supervision' without defining on-site presence in the text read.
https://publications.tnsosfiles.com/rules/0880/0880-02.20250617.pdf
TN-009. In re Samuel Hampton, M.D. (TN Lic. 62072)
Tennessee Department of Health Disciplinary Action Report (actions taken March 2026): BME reprimanded a physician who failed for about 12 months to renew registration of the med spa for which he was medical director; $600 civil penalties plus costs up to $2,000.
Enforcement (licensing; agreed/consent action per monthly report) · Explicit (official monthly summary; order not read) · High · Med spa compliance enforcement, not privacy.
F-007. 45 CFR 164.502(a)
Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.
Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
F-024. HHS OCR resolution agreements
OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).
Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
F-003. 45 CFR 160.103
PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.
Regulation · Explicit · High
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
U-98. U-98 · Open
Residual recurring gaps (consolidates remainders of U-61, U-70, U-79, U-88): dental-board confidentiality grounds not read in ID, NM, AL, KY, LA, MS, AR, OK, TN, KS, NE, WV, VT, NH, ME, RI, AK and NV (NAC 631); likeness statutes not read in AL (6-5-770), KY (391.170), OK (12 O.S. 1449), IN (IC 32-36), NV (597.770), MI and MO; common-law likeness/confidentiality torts not researched where marked in the matrix. (Med spa rules for the 16 previously unresearched jurisdictions were classified in final phase part 2: see U-99 for sources still needing official text.)
High priority · All
U-95. U-95 · Open
Claims and cases that remain unverifiable from official sources (bot checks, outages or no public record): Ohio bill status (legislature.ohio.gov connection failed); Tausinga (no docket found); OSBMLS v. Larson final order; TN, AR, MS and GA code text (Justia hosts; tnsosfiles 403); KS-005 rule text (KSBHA 403); MS-004 rule; NM-001 (NMOneSource 403); WV rule 11-1A-12.1.f (LII host); Hawaii HRS text after 2017 (capitol.hawaii.gov Cloudflare, not circumvented); DC B26-0525 status; Aspen Dental final approval order; Cancelmo docket entries (PACERMonitor mirror); basis of the Amazon Ads SDK termination; case-law reproductions on secondary hosts.
High priority · All