What TEFCA Is and Why It Matters Now
The Trusted Exchange Framework and Common Agreement (TEFCA) is a national infrastructure for health information exchange established by the Office of the National Coordinator for Health Information Technology under authority of the 21st Century Cures Act. TEFCA creates a single set of governance rules, technical requirements, and legal agreements that allow health information networks to interoperate with each other at national scale.
Prior to TEFCA, health information exchange in the United States was fragmented across dozens of regional and national networks, each with its own participation agreements, technical standards, and governance policies. A hospital system connected to one health information exchange could not easily share data with a patient's new provider if that provider was connected to a different network. TEFCA addresses this by requiring Qualified Health Information Networks (QHINs) to connect with each other and adopt common technical and governance standards.
In 2026, TEFCA has moved from policy aspiration to operational infrastructure. Multiple QHINs are live, the FHIR-based exchange pathways are defined, and CMS reimbursement policies are beginning to reference TEFCA participation as a factor in value-based care program compliance. Organizations that have not yet assessed their TEFCA participation strategy are making a strategic choice by inaction.
QHIN Participation: What It Requires
A Qualified Health Information Network is an organization that has been designated by the ONC-appointed Recognized Coordinating Entity (RCE) to operate as a national exchange hub under TEFCA. QHINs must sign the Common Agreement with the RCE, meet technical capability requirements, agree to governance policies including query response obligations, and maintain the infrastructure necessary to route queries and responses between their participants and other QHINs.
Most health systems and payers will participate in TEFCA as Participants or Subparticipants connected to a QHIN, rather than applying to become QHINs themselves. Becoming a QHIN carries substantial technical, legal, and operational obligations. For most organizations, the strategic question is which QHIN to connect to and what exchange use cases to prioritize.
QHIN selection matters because different QHINs serve different participant communities and have different technical capabilities. A QHIN with strong representation among ambulatory practices may be the right choice for a health system focused on care coordination. A QHIN with deep payer participation may be more relevant for a managed care organization focused on claims-clinical data reconciliation.
FHIR Exchange Under TEFCA: The Technical Requirements
TEFCA defines two primary exchange modalities. The first is query-based exchange, where a participant queries the network for a patient's health data from other participants. The second is message-based exchange, which supports directed communication such as referral notifications and care transition alerts. TEFCA has progressively added FHIR-based exchange as a required capability alongside the existing IHE-based exchange profiles.
The FHIR exchange specification under TEFCA requires that QHINs and their participants support FHIR R4 APIs with specific implementation guide profiles. The Individual Access Services pathway allows patients to access their own data through third-party applications using SMART on FHIR. The Treatment, Payment, and Healthcare Operations pathways define the permitted purposes for query-based exchange and the data elements that must be returned.
Health systems implementing FHIR APIs for TEFCA exchange must align their FHIR server configurations with the applicable profiles and ensure that their patient matching logic meets TEFCA's identity matching requirements. The Common Agreement establishes specific requirements for patient identity verification that differ from the more permissive approaches used in some regional health information exchange contexts.
Implementation Guidance for Health Systems and Payers
The first practical step for any organization assessing TEFCA participation is determining whether their existing health information exchange relationships and FHIR API infrastructure can support TEFCA-compliant exchange without significant rearchitecting. Many organizations that have implemented CMS-mandated FHIR APIs already have the technical building blocks; the gap is typically in patient matching, consent management, and connection to a QHIN.
Payer organizations face a specific consideration around the TEFCA Individual Access Services pathway. CMS has indicated that the Individual Access Services pathway under TEFCA is a permissible mechanism for members to direct their data to third-party applications — which intersects with the payer obligations established by CMS-0057-F. Payers that implement CMS-0057-F APIs should assess whether QHIN participation through TEFCA provides a compliant pathway for certain member data access use cases.
Health systems with existing relationships to regional health information exchanges should assess whether those exchanges have achieved or are pursuing QHIN designation. Connecting through an existing exchange partner that becomes a QHIN is typically the lowest-friction TEFCA participation pathway. For systems without existing HIE relationships, direct QHIN connection requires selecting a QHIN, executing the participation agreement, and configuring the technical integration layer.