TEFCA & QHINs

In one line

TEFCA is the attempt to replace hundreds of bilateral data-sharing contracts with one: sign the Common Agreement, connect through a designated QHIN, and you can reach every other participant in the country without negotiating a new agreement each time.

The three documents

Authority comes from section 4003 of the 21st Century Cures Act. TEFCA is built from three artefacts, and people conflate them constantly:

• Trusted Exchange Framework (TEF) — the principles. Standardization, openness and transparency, cooperation and non-discrimination, privacy, security and safety. Non-binding by itself; it sets the tone.
• Common Agreement — the actual legal contract every QHIN signs. It carries the baseline legal and technical obligations, and flows down to Participants and Subparticipants.
• QHIN Technical Framework (QTF) — the wire-level specification: transport, security, record location, message formats.

The Recognized Coordinating Entity (RCE) is The Sequoia Project, selected by ONC to author, implement and maintain the Common Agreement and to run QHIN designation and monitoring.

Common Agreement Version 2.1 was released in November 2024. The headline change in the version 2 series is the adoption of FHIR-based exchange, so participants can use TEFCA's governance, policy and directory services to scale FHIR API exchange nationally rather than only document query. Version numbers move; check the RCE site before you cite one in a contract.

The tiers

QHIN  <->  QHIN          (the backbone; QHINs talk to each other)
  |
Participant              (a health system, HIE, payer, public health agency)
  |
Subparticipant           (a practice, a vendor's customer, a regional HIE's members)

• QHIN — must be a US entity and complete a designation process that runs roughly a year. QHINs do not generally hold data; they route.
• Participant — connects to one QHIN.
• Subparticipant — connects through a Participant.

Obligations cascade down the chain by contract. A small clinic never signs the Common Agreement; it signs with its Subparticipant intermediary, which is bound upward.

The exchange purposes

TEFCA started with six defined Exchange Purposes. A request must state one, and the responding side's duty to respond depends on which:

Exchange Purpose	Typical use
Treatment	A clinician pulling outside records at the point of care
Payment	Claims adjudication, risk adjustment support
Health Care Operations	Quality measurement, care coordination programmes
Public Health	Reporting to and querying from public health agencies
Government Benefits Determination	Disability and benefits adjudication
Individual Access Services (IAS)	A person getting their own records through an app

Individual Access Services is the one to watch if you build consumer apps: it is TEFCA's answer to "let a patient assemble their own record from every provider who ever saw them," and it carries extra privacy and transparency obligations for the IAS provider.

Who the QHINs are

As of the review date the RCE lists eleven designated QHINs: CommonWell Alliance, eClinicalWorks (Prismanet), eHealth Exchange, Epic (Nexus), Health Gorilla, Kno2, Konza Health, MedAllies, Netsmart, Oracle Health Information Network, and Surescripts Health Information Network. The list grows; check the RCE page rather than quoting a count.

Look at that list carefully and you will see the shape of the US market: two EHR vendors, two existing national networks, a pharmacy network, a behavioural health vendor, and several independent exchange platforms. Whose QHIN you connect through is partly a technology decision and largely a "who already has your data" decision.

How it relates to Carequality and CommonWell

This trips up almost everyone, because the names overlap.

• Carequality is a framework — a set of policies and a common agreement (lowercase) that lets networks and vendors interoperate. It is not a network itself. For years it was the de facto national fabric for document query.
• CommonWell Health Alliance is a network whose members exchange through shared services. CommonWell has long been reachable via Carequality.
• TEFCA is the federal successor concept: same idea, but with a government-recognised coordinating entity, a formal designation process, and legal weight behind it.

CommonWell became a designated QHIN, so its members can reach TEFCA through it. Carequality is not sunsetting abruptly — it has publicly framed its direction as alignment and convergence with TEFCA, updating its own framework and dispute-resolution processes while implementers add TEFCA to their strategy. For the next several years, expect most large organisations to be on both, with traffic gradually shifting.

The regulatory hook

TEFCA is voluntary. Two things give it pull anyway.

HTI-2 (final, 16 December 2024) codified TEFCA-related provisions into ASTP/ONC's regulations, giving the framework a durable place in federal rules rather than living purely in contract.

HTI-1 added a TEFCA Manner Exception at 45 CFR 171.403 to the information blocking rules: in defined circumstances, an actor may satisfy a request only via TEFCA without that counting as blocking. Note the direction of travel — the proposed HTI-5 rule would remove that exception. It is a proposal, not law, but it tells you the government no longer thinks TEFCA needs a regulatory carrot.

What to actually do with this

If you are architecting exchange for a US provider or payer, TEFCA is a routing and legal decision, not a data-model one. Your FHIR profiles, C-CDA templates and terminology work do not change because you joined a QHIN. What changes is the number of contracts you have to sign to reach a new counterparty — which, when you have thousands of counterparties, is the whole problem.