Tennessee Code Title 49. Education § 49-6-2702

(b) An LEA may disclose information contained in a student's education record to appropriate parties, including members of the threat assessment team and the members' respective agencies, in the event of an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals. Any disclosure under this subsection (b) must comply with the Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. 1232g), § 10-7-504, the Data Accessibility, Transparency and Accountability Act, compiled in chapter 1, part 7 of this title, and all other relevant state and federal privacy laws. This section does not limit an LEA's ability to disclose information to the fullest extent otherwise permitted by state or federal law.

(c) Agencies, entities, and individuals subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (42 U.S.C. § 1320d et seq.) may disclose information contained in a medical record to the threat assessment team if the agency, entity, or individual believes that the disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. Any disclosure under this subsection (c) must comply with HIPAA. Nothing in this subsection (c) limits an agency's, entity's or individual's ability to disclose information to the fullest extent otherwise permitted by state or federal law.

(d) The threat assessment team shall certify to any agency or individual providing confidential information that the information will not be disclosed to any other party, except as provided by law. The agency providing the information to the threat assessment team shall retain ownership of the information provided, and such information remains subject to any confidentiality laws applicable to the agency. The provision of information to the threat assessment team does not waive any applicable confidentiality standards. Confidential information may be shared with the threat assessment team only as necessary to protect the safety of the individual or others. Nothing in this part compels an agency or individual to share records or information unless required by law.