Tennessee Code Title 50. Employer and Employee § 50-1-306

(a) As used in this section, “medical information” includes lists of employees or family members receiving health insurance. “Medical information” does not include information that does not identify the patient.

(b) It is unlawful for any employer, or an agent, contractor or employee of an employer, to market or sell medical information that directly identifies an employee, unless the patient has authorized the release in written, electronic or other form that indicates the patient's consent, including records for medical services provided or paid for by the employer for purposes unrelated to:

(c) A violation of this section shall be punished as a Class C misdemeanor.

(d) This section shall not apply to information for which the employee or family member has executed a voluntary waiver or release.