AI Healthcare Regulations in Tennessee: A Comprehensive Guide

Quick Answer: Current State of AI Healthcare Regulation in Tennessee

Tennessee has not passed comprehensive legislation specifically governing AI in healthcare. There is no Tennessee AI Healthcare Act, no state-level equivalent of the EU AI Act, and no dedicated agency tasked with AI oversight in clinical settings.

Regulation stems from a layered framework of existing laws:

• Federal FDA regulation of AI and machine learning (ML) tools that qualify as medical devices
• HIPAA as the baseline for any AI system that touches protected health information (PHI)
• The Tennessee Medical Practice Act (T.C.A. Title 63, Chapter 6), which governs who can practice medicine and how tasks can be delegated
• The Tennessee Consumer Protection Act (T.C.A. Title 47, Chapter 18, Part 1), which can reach deceptive or harmful AI products
• Professional licensing board rules from bodies like the Tennessee Board of Medical Examiners

Hospitals deploying AI diagnostic tools in Tennessee are subject to FDA clearance, HIPAA security, state medical practice standards, and general tort liability. These frameworks, not designed for AI, create ambiguity. Professional ethical guidelines offer direction but lack legal force.

Federal Framework: FDA's Role in AI/ML Medical Devices

The FDA is the most consequential regulator for AI tools used in clinical decision-making in Tennessee. If an AI system meets the definition of Software as a Medical Device (SaMD), it requires FDA oversight regardless of where it is deployed.

What Counts as a Medical Device

The FDA defines SaMD as software intended to diagnose, treat, cure, mitigate, or prevent disease. An AI tool flagging a suspicious mammogram lesion is SaMD; a scheduling bot is not. This distinction is critical for regulatory classification.

Premarket Review Pathways

Most AI/ML diagnostic tools clear through 510(k) or De Novo. A cross-sectional analysis of FDA-authorized oncology AI/ML devices found that the clinical evidence supporting many of these authorizations varies considerably in depth and study design (Litt H et al., Journal of Cancer Policy, 2026 [PMID 42025919]). Tennessee providers procuring oncology AI tools should request the FDA authorization summary and the underlying clinical evidence, not just the clearance letter.

In orthopedics, the picture is similarly uneven. A 2025 review found that few FDA-approved AI/ML orthopedic devices have EU MDR equivalents or peer-reviewed validation studies, raising questions about how broadly applicable the supporting data actually is (Bracken A et al., Clinical Orthopaedics and Related Research, 2025 [PMID 41955753]).

Total Product Lifecycle and Predetermined Change Control Plans

The FDA's Total Product Lifecycle (TPLC) approach recognizes that AI algorithms evolve through retraining. For continuously learning algorithms, the FDA developed Predetermined Change Control Plans (PCCPs), allowing manufacturers to specify algorithm changes without new premarket applications. Tennessee health systems procuring AI tools should verify if vendors have approved PCCPs and their scope.

Generalizability and Validation Challenges

AI/ML algorithms may perform well on training data but poorly on demographically or clinically diverse populations. Research on wearable-enabled algorithms for blood volume decompensation estimation shows transfer learning can improve generalizability, but this remains an active development area (Tangolar D et al., Computers in Biology and Medicine, 2026 [PMID 41955753]). Tennessee providers serving diverse rural and urban populations should ask vendors about algorithm validation and patient populations used.

Administrative AI vs. Clinical AI

The FDA does not regulate AI for purely administrative functions like billing or scheduling. Regulatory burden applies when software influences clinical decisions. This distinction is not always clear. An AI tool summarizing a patient chart is likely administrative; one recommending a drug dose based on that summary is clinical. For clarity, consult the FDA's Digital Health Center of Excellence or regulatory counsel before deployment.

The FDA's Digital Health Software Precertification (Pre-Cert) Pilot Program, which aimed to streamline review for software developers with strong quality systems, concluded its pilot phase without becoming a formal regulatory pathway. As of this writing, the FDA has not established a successor program. Consult the FDA's Digital Health Center of Excellence for current guidance on streamlined review options.

Tennessee's Existing Laws Applicable to AI in Healthcare

Tennessee Medical Practice Act (T.C.A. Title 63, Chapter 6)

The Medical Practice Act defines the practice of medicine and sets the conditions under which licensed physicians can delegate clinical tasks. AI does not hold a medical license. When an AI system performs a function that would otherwise require a licensed clinician, such as interpreting a diagnostic image or generating a treatment recommendation, the supervising physician retains legal responsibility for that output.

The Act does not explicitly address AI, but its delegation and supervision requirements apply directly. A physician who blindly accepts an AI recommendation without independent clinical judgment may practice below the standard of care, creating licensing and liability exposure.

Tennessee Board of Medical Examiners

The Tennessee Board of Medical Examiners (TBME) licenses and disciplines physicians in the state. As of this writing, the TBME has not issued a specific advisory or rule addressing AI use in clinical practice. Consult the TBME directly at (615) 532-3202 or through the Tennessee Department of Health's website for any updated guidance. Rule 0880-02-.14 governs unprofessional conduct and could apply to AI misuse that results in patient harm.

Tennessee Health Information Privacy

Tennessee does not have a comprehensive consumer health data privacy law equivalent to Washington State's My Health MY Data Act. State-level health privacy is primarily governed by T.C.A. Title 68, Chapter 11, Part 15, which addresses hospital records and patient access, but does not create a broad AI-specific data governance regime. HIPAA (45 CFR Parts 160, 162, and 164) remains the controlling standard for PHI in AI systems.

Tennessee Consumer Protection Act (T.C.A. Title 47, Chapter 18, Part 1)

The Tennessee Consumer Protection Act prohibits unfair or deceptive trade practices. An AI vendor making false claims about its tool's accuracy, FDA clearance, or clinical validation could face liability. Healthcare providers relying on such misrepresentations and passing them to patients may also have exposure. This act provides an enforcement mechanism even without AI-specific law.

Tort Liability for AI Errors

Tennessee follows general negligence principles. If an AI system contributes to patient harm, liability analysis will focus on whether the provider met the applicable standard of care, whether the AI vendor's product was defective under products liability doctrine, and whether informed consent was obtained. Tennessee courts have not yet produced significant case law specifically on AI medical liability, so practitioners should watch developments in other jurisdictions as leading indicators.

Informed Consent

Tennessee's informed consent requirements (T.C.A. § 29-26-118) mandate patients receive material information about proposed treatments. Whether AI use in diagnosis or treatment planning requires disclosure is unsettled. Disclosing AI's material role in a clinical decision is a conservative and ethically sound practice, aligning with emerging professional standards.

Data Privacy, Security, and Bias in Tennessee AI Healthcare

HIPAA as the Baseline

Any AI system in Tennessee that creates, receives, maintains, or transmits PHI is subject to HIPAA's Privacy Rule and Security Rule (45 CFR Parts 160, 16