Tenn. Code Ann. § 68-1-118: Specific authorization required for release of information.

The department of health or any employee of the department of health shall not release information that is not specifically authorized by state or federal law to any insurance company, agency, company or firm, pertaining to the health of any person without the patient's consent, or, if a minor, the consent of the minor's parent, guardian or legal custodian, or pursuant to an appropriate court order.