Nashville companies run hospitals in other states from here. Their access model has to travel too.
Many hospital companies are managed from Nashville. A corporate team here may hold logins into facilities spread across many states, plus billing vendors, analytics platforms and new AI tools. Our first question in a Nashville engagement is usually how many of those accounts still belong to someone who needs them.
- Identity Governance & AdministrationCybersecurity
- Privileged Access ManagementCybersecurity
- Healthcare Provider PlatformsEnterprise Platforms
- Data Governance & AccessData & Analytics
- Data IntegrationData & Analytics
- AI Governance & SecurityAI & Machine Learning
- AI Agent IdentityCybersecurity
Our Nashville work is mostly with hospital management companies, health IT and revenue cycle vendors, and the music publishing and rights businesses on Music Row.
We do identity governance for multi-facility health systems, HIPAA-aligned data platforms, privileged access for shared billing systems, and governance for AI that touches patient or royalty data. Cohash works from Frisco, Texas, serves Tennessee clients remotely and flies in for workshops and launches.
Cohash has no Nashville office. Our US base is Frisco, Texas, and we run Tennessee projects remotely, flying into BNA for discovery sessions, design workshops and go-live support.
- rules
- Tennessee breach notification, Tenn. Code Ann. §47-18-2107Tennessee Information Protection ActHIPAA Security Rule, 45 CFR §164.312
What's specific about Nashville
Each figure comes from a public source, linked on the card.
The Nashville Health Care Council's 2025 economic impact study, produced with EY, puts the local health care industry at $72.1 billion in annual output and more than 370,000 jobs, with 17 publicly traded health care companies headquartered in Nashville.
source ↗ 02 2,600HCA Healthcare reports 189 hospitals and about 2,600 ambulatory sites of care in 19 states and the United Kingdom, as of 31 March 2026.
source ↗ 03 80,757The Nashville Area Chamber of Commerce's 2020 music industry report counted 80,757 jobs tied to music and entertainment in the Nashville area, and 21,878 direct music industry jobs in 2019, up 29% since 2012.
source ↗ 04 188,600BLS counts 188,600 education and health services jobs and 197,300 professional and business services jobs in the Nashville-Davidson-Murfreesboro-Franklin metro for September 2026 (preliminary), out of 1,204,600 nonfarm jobs.
source ↗Who we work with in Nashville, and the rules they work under
-
Hospital management companies
A Nashville corporate office often supports dozens of hospitals that each joined through an acquisition and kept their own directory, EHR build and local admins. We map those identity sources into one governance model, tie access to the facility and role, and run certification campaigns that a facility CFO can actually finish.
-
Health IT, revenue cycle and physician services
Billing and coding vendors sit inside their customers' EHRs and clearinghouses with service accounts and offshore support staff. That makes them a business associate with a large blast radius. We vault the shared credentials, record privileged sessions and give each customer a clean list of who touched their data.
-
Music publishing and rights management
Royalty statements, split sheets and catalog metadata pass between publishers, labels, PROs and distributors, usually as spreadsheets and SFTP drops. We build governed pipelines and a single catalog data model so a rights team can answer who is owed what without reconciling five exports by hand.
-
AI in clinical operations
Nashville operators are piloting AI for documentation, denials and scheduling. Each pilot needs an identity for the agent, a scoped data path into PHI and a log a compliance officer can review. We set those controls up before the pilot reaches a second facility.
-
Tennessee breach notification, Tenn. Code Ann. §47-18-2107 ↗
Residents must be told immediately and no later than 45 days after discovery, unless law enforcement needs a delay. A vendor holding data it does not own gets the same 45 days to tell the owner. Entities subject to HIPAA or GLBA Title V are carved out of this section, per the 2016 amendment (Public Chapter 692).
-
Tennessee Information Protection Act (Public Chapter 408, 2023) ↗
In force from 1 July 2025 for businesses with more than $25 million in revenue that handle data on at least 175,000 Tennessee consumers a year, or 25,000 if most revenue comes from selling data. HIPAA covered entities and business associates are exempt, and a written program that reasonably conforms to the NIST Privacy Framework is an affirmative defense.
-
HIPAA Security Rule, 45 CFR §164.312 ↗
The technical safeguards require access control with unique user identification, audit controls, integrity protection, person or entity authentication and transmission security for electronic PHI. These apply to hospital operators and to the business associates that serve them.
Most requested in Nashville
The services clients in Nashville ask us for most.
01We run hospitals in several states from Nashville. Whose breach law applies?
Usually more than one. As a HIPAA covered entity you follow the HIPAA breach rule, and Tennessee's own breach section carves HIPAA-regulated entities out. Your non-HIPAA affiliates, and residents of other states, can still pull in other statutes. We help you know which systems hold which residents' data. Counsel decides the notices.
02Does the Tennessee Information Protection Act cover our health system?
The covered entity and its business associate work are exempt. A consumer wellness app, a marketing database or a non-HIPAA subsidiary can fall inside it if it meets the revenue and volume thresholds. We inventory those data flows so your privacy team can make the call.
03Can you merge identity for hospitals we just acquired?
Yes. We usually connect the acquired directory and EHR accounts to your governance platform first, run an access review in the first 90 days and only then migrate sign-in. That order keeps clinicians working while you find the accounts nobody claims.
04How do you handle AI scribes and agents that read patient charts?
Each one gets its own identity, scoped access to the record types it needs and logging that ties every read to a patient encounter. We also write the review steps your compliance team uses before a tool moves to a new facility.
05Our publishing catalog lives in spreadsheets. Is that a data engineering problem or a rights problem?
Both, and we start with the data. A single model for works, writers, splits and recordings, fed by your distributor and PRO statements, makes the rights questions answerable. We do not give legal opinions on ownership.
More cities in Tennessee
b9cea539 - 01Nashville Health Care Council, 2025 economic impact studyhealthcarecouncil.com ↗
- 02HCA Healthcare, Abouthcahealthcare.com ↗
- 03Nashville Area Chamber of Commerce, Music Industry Report 2020nashvillechamber.com ↗
- 04BLS, Nashville-Davidson-Murfreesboro-Franklin economy at a glancebls.gov ↗
- 05Tennessee Public Chapter 692 (2016), amending §47-18-2107publications.tnsosfiles.com ↗
- 06Tennessee General Assembly, HB 1181 (Tennessee Information Protection Act)wapp.capitol.tn.gov ↗
- 07Tennessee Public Chapter 408 (2023), enrolled textpublications.tnsosfiles.com ↗
- 0845 CFR §164.312 (Cornell LII)law.cornell.edu ↗
Tell us what you're running. We'll tell you what we'd do first.
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it