The Trusted Exchange Framework and Common Agreement (TEFCA), led by the Office of the National Coordinator for Health Information Technology (ONC), establishes a unified legal and technical structure to support secure, standards-based health information exchange.
TEFCA is intended to address the top challenges of interoperability in healthcare with a scalable national framework that enables consistent exchange across diverse networks and systems.
As of 2025, TEFCA is in active implementation. Several Qualified Health Information Networks (QHINs) are operational, and healthcare providers, payors, and public health agencies are aligning their infrastructure with TEFCA’s privacy, security, and data use requirements.
Trusted Exchange Framework and Common Agreement (TEFCA) FAQ
As TEFCA implementation expands, healthcare organizations across the country are asking how it works, who it affects, and why it matters. Let’s dive into some of the most common questions about the framework:
• What is TEFCA?
The Trusted Exchange Framework and Common Agreement (TEFCA) establishes principles, legal requirements, and technical standards to support the secure and scalable exchange of electronic health information.
• Who created TEFCA?
The ONC developed TEFCA, and The Sequoia Project is the Recognized Coordinating Entity (RCE). The Sequoia Project also oversees Carequality, a separate interoperability framework that connects over 600,000 providers.
• Who participates in TEFCA?
TEFCA participants include Qualified Health Information Networks (QHINs), which serve as central exchange nodes. Organizations that connect through QHINs include hospitals, clinics, EHR vendors, payors, and public health entities.
• What are QHINs, and how are they selected?
Qualified Health Information Networks (QHINs) are designated entities responsible for facilitating nationwide data exchange under TEFCA. To become a QHIN, an organization must undergo a rigorous application and onboarding process led by the Recognized Coordinating Entity (RCE) and demonstrate compliance with technical and governance requirements.
• How does TEFCA differ from existing health information exchanges?
Unlike regional or vendor-specific health information exchanges (HIEs), TEFCA creates a single, national framework. It aims to unify existing networks under a common legal and technical structure, enabling seamless exchange between previously disconnected systems.
• What is required to participate in TEFCA?
Participating entities must enter into the Common Agreement, a legal framework that defines rules for data privacy, security, and permitted uses. Participants must also follow detailed Standard Operating Procedures (SOPs) issued by the RCE, which govern data exchange and access.
• Why does TEFCA matter?
By enabling organizations to connect once to a QHIN and exchange data with all other participants, TEFCA reduces the need for individual agreements, lowers administrative overhead, and supports compliance with privacy and access standards.
• When will TEFCA be fully operational?
TEFCA is being implemented in phases. As of 2025, several QHINs are operational, and many healthcare organizations are actively aligning their systems. While there is no fixed end date for full adoption, federal and industry momentum is accelerating TEFCA’s nationwide rollout.
TEFCA Deep Dive
The Trusted Exchange Framework and Common Agreement defines how health information should be shared across networks that previously operated independently.
The following sections detail the framework’s foundational principles, legal structure, operational procedures, permitted uses, and evolving technical requirements.
Principles That Shape the Framework
TEFCA is grounded in six guiding principles that influence every policy decision, technical requirement, and enforcement mechanism within the framework. The six guiding principles include:
Standardization: Promote the use of recognized technical standards and best practices to ensure consistency across participants.
Transparency: Clearly document and communicate policies, system capabilities, and participant responsibilities.
Cooperation and Non-Discrimination: Enable fair and open participation for all qualified entities, including competitors.
Privacy, Security, and Patient Safety: Require strong safeguards to protect data integrity and patient confidentiality.
Access: Ensure individuals and their authorized representatives can securely obtain their health records.
Data-Driven Accountability: Support data exchange for population-level analysis and public health improvement, consistent with legal and ethical guidelines.
Legal and Contractual Foundation
The Common Agreement serves as the legal and operational cornerstone of TEFCA.
Every QHIN must sign this agreement, and its terms flow down to connected participants. It outlines key obligations in areas such as permitted use, data security, dispute resolution, and system interoperability.
Organizations that do not comply with these terms risk suspension or removal from the network, which would disconnect them from national data exchange.
The Recognized Coordinating Entity (The Sequoia Project) is responsible for managing updates to the agreement, which are developed through a public comment process and stakeholder engagement.
Role of Standard Operating Procedures
While the Common Agreement outlines high-level responsibilities, Standard Operating Procedures (SOPs) provide practical guidance for day-to-day operations.
The RCE has provided SOPs about:
- Exchange Purposes (XP) Implementation
- Privacy and Security
- Governance
These documents provide detailed guidance on how QHINs and their participants must execute functions like identity verification, data formatting, and security event reporting.
The RCE updates these documents to reflect industry changes. Participants are expected to adopt revisions promptly and integrate them into their compliance workflows.
Violations of SOPs are treated as breaches of the Common Agreement.
Strict Rules on Data Use: Permitted Purposes
TEFCA authorizes data exchange only for six clearly defined purposes under the Common Agreement. These include:
- Treatment: Sharing information to support clinical care coordination and decision-making.
- Payment: Accessing data for billing, eligibility, and utilization management.
- Healthcare Operations: Supporting internal functions such as quality assessment, care planning, and audits.
- Public Health: Reporting data to agencies for surveillance, case tracking, and investigation.
- Government Benefits Determination: Providing data for eligibility verification and program enrollment.
- Individual Access Services: Enabling patients or authorized representatives to retrieve their medical records.
Each purpose has specific requirements for documentation, validation, and authorization. For example, public health queries may require agency credentials, while individual access requests must include identity verification and proof of consent.
FHIR in TEFCA for Nationwide Interoperability
To advance modern, API-based data exchange, The Sequoia Project is incorporating the Fast Healthcare Interoperability Resources (FHIR) standard into the TEFCA infrastructure.
Version 2 of the FHIR Roadmap for TEFCA Exchange highlights this roadmap, in four stages:
- FHIR Content Support: QHINs may broker FHIR payloads over existing IHE protocols, but without standardized FHIR API integration.
- QHIN-Facilitated FHIR Exchange: QHINs begin enabling FHIR API exchanges between participants using shared services such as endpoint directories and record locators.
- QHIN-to-QHIN FHIR Exchange: QHINs begin using FHIR APIs to directly exchange data across networks, supplementing non-FHIR systems internally.
- End-to-End FHIR Exchange: Full FHIR-based exchange occurs seamlessly across QHINs and their networks, including routing between participants and subparticipants.
This evolution supports secure, scalable, and standardized data sharing, and positions TEFCA to keep pace with federal mandates and the broader health IT market.
TEFCA’s Role in National Interoperability
TEFCA is shaping the structure of health information exchange across the United States. Several QHINs have completed onboarding, and a growing number of healthcare organizations are using TEFCA connections for operational data sharing.
Major entities such as Epic Nexus, eHealth Exchange, and eClinicalWorks have committed to adopting TEFCA’s framework.
Under the TEFCA model, organizations connect to a single QHIN rather than managing numerous separate integrations. The result is a more streamlined, predictable environment for exchanging clinical and administrative data across organizations.
- Clinical providers are using TEFCA-enabled exchange to retrieve patient records from other systems with improved reliability and speed to supports better care coordination.
- Payors are incorporating TEFCA-based exchange into utilization management and quality reporting workflows for more consistent access to clinical documentation.
- Public health agencies are using TEFCA for individual-level data queries to improve reporting timelines and increase access to structured clinical information.
TEFCA’s structure is based on legal enforceability and technical interoperability. The operational model, technical specifications, and oversight mechanisms are shaping the future state of interoperability for both clinical and non-clinical stakeholders.
Carequality VS TEFCA
Carequality is a framework created and managed by The Sequoia Project, which is also the RCE for TEFCA. While these two frameworks aim to support health information exchange, they differ significantly in scope, governance, and legal structure.
Carequality is a private-sector interoperability framework developed and managed by The Sequoia Project. It provides a standardized set of legal agreements, technical specifications, and operational policies that enable trusted data sharing between networks and systems.
TEFCA is a federally endorsed policy initiative led by the ONC and implemented by The Sequoia Project as the Recognized Coordinating Entity (RCE). TEFCA is designed to unify existing networks like Carequality under a common legal and technical framework to scale interoperability nationwide.
In essence, Carequality operates as one of several existing networks that TEFCA seeks to federate under a single national architecture. While Carequality focuses on network-to-network connectivity within the private sector, TEFCA establishes a regulatory and contractual foundation for universal, cross-network exchange involving both public and private entities.
According to a 2024 update, Carequality supports the exchange of 940 million documents every month. Carequality connects over 45 networks with more than 600,000 providers, 50,000 clinics, and 4,200 hospitals.
Carequality has publicly committed to aligning its policies and infrastructure with TEFCA.
How ChartRequest Supports Interoperability in Healthcare
ChartRequest is a release of information solution designed to simplify and modernize the exchange of medical records across all EMR systems.
Through integration with Carequality, the ChartRequest network includes over 78,000 verified healthcare organizations across the United States.
In addition to technical interoperability, ChartRequest supports regulatory compliance by embedding key privacy, security, and authorization controls into its workflows. These features help healthcare providers meet legal obligations while reducing administrative burden and turnaround times for medical record fulfillment.
