Trusted Exchange Framework and Common Agreement (TEFCA)

Key facts

Legal basis

21st Century Cures Act (2016), Section 4003(b)

Overseen by

ASTP/ONC (formerly ONC), HHS

Day-to-day governance

Recognized Coordinating Entity (RCE): The Sequoia Project

Network hubs

Qualified Health Information Networks (QHINs)

Participation

Voluntary

What is TEFCA?

Before TEFCA, nationwide exchange ran through separate networks with their own contracts, so a hospital often joined several networks to reach its partners. The 21st Century Cures Act directed the Office of the National Coordinator for Health IT (ONC), now ASTP/ONC, to create a common framework so that joining one network could provide nationwide reach.

TEFCA has two parts. The Trusted Exchange Framework is a set of non-binding principles. The Common Agreement is a legal contract between the Recognized Coordinating Entity (RCE) and each Qualified Health Information Network (QHIN), with required terms that flow down to participating organizations.

ONC published the first Common Agreement in January 2022, and TEFCA exchange went live when the first QHINs were designated in December 2023. Common Agreement Version 2.0, released in 2024, added support for FHIR-based exchange.

How TEFCA exchange works

TEFCA is a network of networks with three tiers:

• QHINs connect to one another under the QHIN Technical Framework and route queries, responses and messages between networks.
• Participants, such as health systems, HIEs and health IT developers, sign agreements with a QHIN.
• Subparticipants, such as clinics using a developer's platform, connect through a participant.
• Every exchange must serve an authorized exchange purpose: treatment, payment, health care operations, public health, government benefits determination or individual access services.

Why TEFCA matters

TEFCA changes who can reach clinical data and how:

• Providers: CMS lets hospitals and MIPS clinicians satisfy the Promoting Interoperability Health Information Exchange objective by participating in TEFCA.
• Payers and public health agencies: defined exchange purposes create a route to clinical data beyond treatment use.
• Patients and app developers: individual access services let consumer apps request records through TEFCA, subject to identity verification.
• Health IT strategy: developers and HIEs are deciding whether to become QHINs, participants or neither, which reshapes network competition.

Common misconceptions about TEFCA

TEFCA does not create a national repository of patient records. Data stays with the organizations that hold it and moves only in response to queries or messages.

Participation is voluntary. No federal rule requires providers to join, although CMS programs give reporting credit for doing so.