Trusted Exchange Framework and Common Agreement (TEFCA) and Health Information Exchanges (HIEs) FAQ and Talking Points

Updated February 27, 2023

1. What is TEFCA?

TEFCA is a government-endorsed approach for a nation-wide “network of networks” to enable interstate data sharing of health information for specific Exchange Purposes. The Trusted Exchange Framework (the “TEF” is a non-binding policy document developed by ONC that articulates foundational principles for trusted data exchange, while the Common Agreement (the “CA”) is a binding legal agreement to ensure the legal provenance, privacy, and security of the data for all organizations participating in TEFCA.

The TEF is available here: The Trusted Exchange Framework (TEF): Principles for Trusted Exchange (January 2022). 

The CA is available here: Common Agreement for Nationwide Health Information Interoperability, Version 1 (January 2022).

2. Where does TEFCA fit into the larger national network infrastructure?

TEFCA is similar to other national networks that include a standardized agreement, including Carequality, eHealthExchange, and Patient-Centered Data Homes. Unlike these arrangements, TEFCA is government-endorsed; in 2016, the CURES Act required the Office of the National Coordinator for Health Information Technology (ONC) to create and publish this framework.

3. What is the RCE?

The RCE is the Recognized Coordinating Entity, the body charged with operationalizing, implementing, and administering TEFCA and monitoring QHINs. Currently, ONC is contracted with The Sequoia Project to be the RCE.

4. What is a QHIN?

A QHIN is a Qualified Health Information Network. QHINs connect directly to and govern their Participants’ data sharing within the CA framework. Participants may, likewise, have Subparticipants. Subparticipants may, in turn, have Downstream Subparticipants. The QHINs are connected to their Participants, who are connected to their Subparticipants, and so on down the line. QHINs are also connected to other QHINs. This “network of networks” enables scalable data sharing across the country. Entities must apply to be QHINs and are “Designated” by the RCE.

The QHIN application process first opened in October 2022 and is on-going.  Currently, there are no Designated QHINs; however, as of February 2023, six organizations have had their applications accepted to move into the technical testing phase of the onboarding and Designation process.

5. What is an SOP?

SOPs are the Standard Operating Procedures that provide further detail on the implementation of TEFCA; these SOPs are published by the RCE. QHINs, Participants, and Subparticipants are all required to comply with the SOPs that are considered applicable to them.  Each SOP is labeled to indicate the respective group(s) to which it applied. SOPs will continue to evolve in the future, allowing TEFCA to become more robust without affecting the underlying CA.

6. What is the QTF?

The QTF is the QHIN Technical Framework.  The QTF articulates the technical specifications and functional requirements necessary to enable QHIN-to-QHIN exchange, including certain high-level requirements that QHINs must support within their network (i.e., among their participants and subparticipants).  This document is made legally binding through the CA.  The QTF is available here: Qualified Health Information Network (QHIN) Technical Framework (QTF), Version 1.0 (January 2022).

7. What is a “Flow-Down”?

Under the CA, certain terms and conditions of the agreement must also apply, or “flow-down,” to QHIN Participants and Subparticipants. Agreements must expressly include these flow-down terms, which can be found here: Sample Flow-Down Terms with User Guide (sequoiaproject.org).  These terms are also labeled as “Required Flow-Down(s)” within the CA.

8. In how many QHINs may I participate?

Per the CA, an entity may only be a Participant/Subparticipant in one QHIN.

9. Are HIEs required to participate in TEFCA?

No one is required to participate in TEFCA, including HIEs. However, participation may be beneficial for the reasons discussed further below.

10. Are providers or payers required to participate in TEFCA?

No one is required to participate in TEFCA, including providers and payers. However, government agencies may incentivize participation. For example, eligible hospitals and Critical Access Hospitals that participate in the Promoting Interoperability Program in 2023 may report TEFCA participation as a health information exchange measure. These programs also incentivize and provide points for other types of bi-directional exchange, including participation in HIEs.

11. What will TEFCA accomplish?

The long-term benefits of TEFCA are yet to be seen; however, the hope is that a government-endorsed exchange framework will encourage more robust health data sharing. A primary goal of TEFCA is to facilitate exchange for a broader range of lawful purposes and among a more diverse group of participants. Specifically, TEFCA aims to impact public health data sharing—not just clinical and payment data sharing—in the near future, as more SOPs are published. Additionally, TEFCA enables a “push capability,” which will likely provide a pathway for provider reporting to public health and other governmental entities.

12. How will TEFCA impact HIEs?

TEFCA may impact the business model of HIEs that only provide similar value and services as QHINs. However, there are numerous ways in which HIEs are well positioned to provide additional value, as further discussed below. HIEs will likely need to educate their participants about TEFCA–what it does, what it does not do, and how HIEs continue to provide value above and beyond network-of-networks connection and data sharing.

13. Once TEFCA is an operational framework, will HIEs continue to provide value to their customers? How so?

For HIEs that provide services beyond network-of-networks connection and data sharing, a future network-of-networks under TEFCA will not replace the value that HIE customers derive from participating in an HIE. In fact, the value such HIEs provide to their customers will likely increase for the following reasons:

• Local Governance and Privacy Protections. State and local laws vary across the country, as do localized privacy concerns and protections. As a federal framework, TEFCA does not take these local laws into account, except to condition all exchange on compliance with “Applicable Law” (including applicable state law). Therefore, HIEs need to continue to enforce localized privacy protections and downstream permitted uses for participants and patients to feel comfortable sharing data.
• Granular Consent.  Similar to privacy protections, HIEs manage granular consent (e.g., consent regarding behavioral health records, Part 2 data, HIV status, etc.) to allow specific data sharing from specific patients, according to state laws and regulations and consistent with patient choice.
• Advanced Patient Matching and Identity Resolution. Currently, the patient-matching rates for national networks are significantly lower than that of local HIEs. HIEs have years of data and technological solutions that enable advanced patient-matching at the local level.
• Public Health. HIEs with existing relationships with their state and local health departments provide a logical “on-ramp” for public health agencies to participate in TEFCA. Most public health agencies do not have the technical capabilities to become a QHIN. In addition, unlike many providers and payers, who will likely have access to a QHIN through their existing electronic medical records (EMR) system, public health agencies will generally not have this built-in option for QHIN connectivity. These agencies can utilize their HIEs that are QHINs or participants of a QHIN for their connection points. 
• Equity and Rural Connections. As noted above, many providers and payers will likely have TEFCA connectivity though their EMR systems, as several of the large EMR companies have announced their QHIN intentions. Many smaller and/or rural providers, however, may not have access to these EMR systems. These providers, then, would not be eligible for the government incentives previously discussed unless they participate in electronic health information exchange through another means. HIEs that are QHINs or participants of a QHIN could provide this connection point.
• Research and Other Authorization-Based Disclosures. TEFCA does not currently permit the exchange of information via a QHIN’s connectivity services for research or other authorization-based purposes. (See below for additional information regarding the permitted exchange purposes under TEFCA.)   
• Data and Analytics. While TEFCA enables data exchange, it does not produce health data or analytics that can inform treatment interventions or population health initiatives. Many HIEs provide these services, targeted to the local needs and interests of their participants.

14. What exchange purposes are permitted/required under TEFCA?

The current Exchange Purposes under TEFCA are: Treatment, Payment, Health Care Operations, Public Health, Government Benefits Determination, and Individual Access Services (each as defined under the CA). QHINs, Participants, and Subparticipants are permitted to exchange data for any and all of these authorized Exchange Purposes, consistent with applicable laws.

At this time, QHINs, Participants, and Subparticipants are generally required* to respond to requests for Treatment and Individual Access Services. (*Note that there are certain narrow exceptions specified in the CA.) The RCE will require responses for other Exchange Purposes over time.

While responses are currently only required for certain Exchange Purposes, QHINs must support responding for all TEFCA Exchange Purposes. In other words, because all of the Exchange Purposes are permitted under TEFCA, a QHIN must be capable of relaying a response based on any and all such Exchange Purposes.

15. What should I consider in deciding whether to apply to be a QHIN or become a participant of a QHIN?

HIEs should ask themselves the following questions when deciding whether to participate in TEFCA, either as a QHIN or participant of a QHIN:

• Can I legally and operationally comply with the QHIN/flow-down terms (discussed above)? If not now, what additional resources and capabilities are needed, and what is the timeline and cost for meeting those requirements?
• If some of my HIE participants do not want to participate in TEFCA or are participating through another QHIN, am I able to manage that from a technical, operational, contractual, and governance standpoint?
• Is there added value for my customers/HIE participants if I provide an on-ramp to TEFCA?
• What additional value could I bring to my customers/HIE participants if I participate in TEFCA?
• Could my participation in TEFCA enable a pathway for my local public health agencies to exchange data?
• Would I help to alleviate equity issues in my state/region by participating in TEFCA?