HIPAA Compliance in Nashville: A 2026 Guide for Practices

What HIPAA Compliance in Nashville Looks Like in 2026

HIPAA compliance in Nashville is the same federal law every U.S. practice follows. What's different here is the setting. Middle Tennessee is home to some of the largest healthcare companies in the country, and it has also been home to some of the largest healthcare data breaches ever reported. This guide covers what the law requires, how Tennessee state law fits in, what the local breaches can teach a small practice, and what federal regulators are focused on right now.

It's written for independent practices, dental offices, specialty clinics, behavioral health providers, and the many health-tech companies around Nashville that handle patient data for someone else.

Why Nashville Healthcare Organizations Face Extra Scrutiny

Healthcare is Nashville's biggest industry. The Nashville Health Care Council's 2025 Annual Economic Report put the local healthcare industry's economic impact at $72.1 billion, supporting 372,160 jobs and more than 8,000 healthcare businesses in the region. That concentration of patient data, vendors, and payment infrastructure makes the area a big target.

Three incidents from the past few years show how that plays out:

• Change Healthcare (February 2024). The Nashville-headquartered claims clearinghouse was hit by ransomware that disrupted claims processing and patient care across the country for months. UnitedHealth Group later put the final count of affected individuals at 192.7 million.
• HCA Healthcare (July 2023). Hackers took data from an external storage location HCA used to automate email formatting, affecting about 11.27 million patients in 20 states. A federal court gave final approval to a $35 million class-action settlement in late 2025.
• Ascension Saint Thomas (May 2024). A ransomware attack on the Ascension system forced some hospitals to divert ambulances, and Middle Tennessee patients were hit by delays across Saint Thomas facilities.

You don't need to be the size of HCA to learn from these. Most of the failures behind them (vendor dependency, forgotten data stores, no workable downtime plan) show up in 10-person practices too.

What HIPAA Actually Requires of a Nashville Practice

HIPAA applies to covered entities (providers who bill electronically, health plans, and clearinghouses) and to business associates, which covers any vendor that creates, receives, stores, or transmits protected health information (PHI) for a covered entity. If you run a billing company, an IT managed service provider, or a SaaS product used by clinics in Brentwood or Franklin, you're almost certainly a business associate with direct liability.

The obligations fall under three main rules:

• The Privacy Rule controls how PHI may be used and disclosed, and gives patients rights such as access to their records.
• The Security Rule requires administrative, physical, and technical safeguards for electronic PHI (ePHI). This is where the risk analysis requirement lives.
• The Breach Notification Rule requires notifying affected individuals within 60 days of discovering a breach, along with HHS and, for breaches affecting more than 500 residents of a state, the media.

Of the three, the Security Rule's requirement for an "accurate and thorough" risk analysis is where most practices get caught out. We'll come back to why.

How Tennessee Law Interacts With HIPAA

Tennessee doesn't have its own version of HIPAA, but several state laws sit alongside it.

Tennessee's Breach Notification Statute

Tenn. Code § 47-18-2107 requires businesses to notify affected Tennessee residents no later than 45 days after discovering a breach of personal information. A 2017 amendment exempted entities subject to HIPAA, so a covered practice that follows the HIPAA Breach Notification Rule for PHI incidents is generally covered.

There's a catch that trips up a lot of offices. The HIPAA exemption is tied to PHI. If attackers take your employee HR files or payroll data, that information may not be PHI, and Tennessee's 45-day clock and its other requirements (including notifying consumer reporting agencies when more than 1,000 people are notified at once) may still apply. Talk to your attorney about how this applies to your specific data.

The Tennessee Information Protection Act (TIPA)

TIPA, Tennessee's consumer privacy law, took effect on July 1, 2025. It applies to businesses with more than $25 million in annual revenue that process data on at least 175,000 Tennessee consumers (or 25,000 if more than half their revenue comes from selling personal data). Information already regulated under HIPAA is exempt.

For most independent practices, TIPA won't apply. It matters more for Nashville's larger health-tech and digital health companies, which often hold a mix of PHI and non-PHI consumer data, such as marketing lists or data from a wellness app. The HIPAA exemption covers the PHI but not necessarily the rest.

State Attorney General Enforcement

Under the HITECH Act, state attorneys general can bring civil actions for HIPAA violations affecting their residents. So OCR isn't the only regulator a Tennessee practice needs to think about.

What Local Breaches Teach Smaller Practices

Your Vendors Are Part of Your Risk

Many Tennessee practices that never had a single system compromised still couldn't submit claims or check eligibility during the Change Healthcare outage. HIPAA requires a business associate agreement (BAA) with each vendor that touches PHI, but a signed BAA doesn't keep your revenue flowing when that vendor goes down. You need an inventory of vendors that handle PHI, current BAAs, and a plan for what you'll do if a key vendor is offline for weeks.

Downtime Planning Has to Be Practical

During the Ascension attack, staff had to fall back on manual processes. HIPAA's contingency planning standard requires data backup, disaster recovery, and emergency mode operation plans. For a small practice, that means knowing how you'll check in patients, look up medication lists, and document visits on paper, and actually testing whether your backups restore.

Data You Forgot About Is Still Your Data

The HCA breach involved a storage location used to automate email formatting. It wasn't the EHR, but it held patient data. Old file shares, exported spreadsheets, retired laptops, and test databases tend to get left out of risk assessments. They're still in scope if they hold ePHI.

Where OCR Enforcement Is Focused in 2026

The HHS Office for Civil Rights (OCR) launched its Risk Analysis Initiative in October 2024. It targets organizations that never conducted an accurate, thorough risk analysis, and it has produced a steady run of settlements since then. In its January 2026 cybersecurity newsletter, OCR said the initiative will expand to cover risk management. In other words, OCR will look at whether you actually fixed the problems your assessment found, not just whether a report exists.

The fines are real, even for smaller organizations. As of January 28, 2026, HIPAA civil monetary penalties range from $145 to $2,190,294 per violation depending on culpability, with an annual cap of $2,190,294 for identical violations. Settlements under the risk analysis initiative have usually come with multi-year corrective action plans on top of the payment.

The Pending Security Rule Update

OCR proposed a major overhaul of the Security Rule in December 2024, published in the Federal Register in January 2025. The proposal would make many currently "addressable" safeguards mandatory, including:

• Multi-factor authentication and encryption of ePHI at rest and in transit
• A written technology asset inventory and network map
• Vulnerability scanning at least every six months and penetration testing at least annually
• The ability to restore certain critical systems within 72 hours

In July 2026, HHS moved its target date for the final rule to July 2027. That's a delay, not a cancellation. The practices in the best position will be the ones who treat the proposal as a preview of where requirements are headed and budget for it now instead of scrambling after publication.

A HIPAA Compliance Checklist for Nashville Practices

Use this as a working list, not a one-time exercise:

1. Complete a documented security risk analysis that covers every system holding ePHI, including cloud apps, phones, medical devices, and old data stores.
2. Build a risk management plan that assigns an owner and deadline to each finding. This is the part OCR now checks.
3. Inventory your business associates and confirm each one has a current, signed BAA.
4. Turn on multi-factor authentication for email, the EHR, remote access, and any administrator accounts.
5. Test your backups by restoring from them, and keep at least one copy offline or immutable.
6. Write a downtime procedure staff can follow on paper, and run through it once a year.
7. Train your workforce on phishing and PHI handling, and keep records of who was trained and when.
8. Map your breach response for both HIPAA (PHI) and Tennessee's statute (non-PHI such as employee data), including who calls your attorney and cyber insurer.
9. Review policies annually and whenever you add a new system, location, or major vendor.

When to Bring in an Outside HIPAA Risk Assessment

Plenty of practices try to handle the risk analysis themselves with the free HHS Security Risk Assessment Tool. That tool can help structure the questions, but it won't scan your network, find an unpatched server in the back office, or tell you whether your firewall configuration matches what your IT vendor says it is. Those technical gaps are where attackers get in, and they're what OCR investigators ask about after a breach.

An outside assessment makes sense if you've never had one, if you've had a recent incident, if you've added locations or systems, or if nobody on staff has a security background. PolySec does in-person HIPAA security risk assessments for healthcare practices. That includes on-site vulnerability and network scanning, a review of your policies and BAAs, an audit-ready findings report, and a remediation roadmap with ongoing support to close the gaps. That last piece is the documented risk management OCR now expects. You can see how the process works at polysec.tech.

Frequently Asked Questions About HIPAA Compliance in Nashville

Does Tennessee have its own HIPAA law?

No. HIPAA is federal and applies the same way in Tennessee as everywhere else. Tennessee has a data breach notification statute that generally defers to HIPAA for PHI, and a consumer privacy law (TIPA) that exempts HIPAA-regulated information. Where a state law gives patients stronger privacy protections than HIPAA, the stricter law usually controls.

How often should a Nashville practice do a HIPAA risk assessment?

The current Security Rule requires risk analysis to be ongoing and updated as your environment changes, but it doesn't set a fixed interval. Annually is the common standard. You should also do one after significant changes such as a new EHR, a new office, or a security incident. The proposed Security Rule update would formalize a 12-month review cycle.

Who enforces HIPAA in Tennessee?

The HHS Office for Civil Rights is the main federal enforcer. The Tennessee Attorney General can also bring HIPAA actions on behalf of state residents under the HITECH Act, and patients have filed class-action lawsuits under state law after breaches, as the HCA and Ascension cases show.

Is my Nashville health-tech startup subject to HIPAA?

If you create, receive, maintain, or transmit PHI on behalf of a covered entity, you're a business associate and directly liable under the Security Rule. A consumer app that collects health data directly from users, with no covered entity involved, may fall outside HIPAA. In that case, other laws like TIPA or FTC rules could apply instead.

What if a breach affects fewer than 500 patients?

You still notify each affected individual within 60 days of discovery. Breaches under 500 people can be logged and reported to HHS within 60 days after the end of the calendar year in which they were discovered, rather than immediately.

Your Next Steps

Nashville practices are surrounded by vendors and systems that have already been breached, which means your own risk depends as much on who you connect to as on what you run in-house. The single most useful thing you can do this quarter is get an accurate risk analysis on paper, then start closing the findings one by one with documented owners and dates. That record is your best protection with both attackers and regulators. If you'd rather have that assessment done for you on-site, PolySec can walk you through what it would cover for your practice.