TEFCA

The Trusted Exchange Framework and Common Agreement is the federal framework, created under the 21st Century Cures Act, for nationwide exchange of electronic health information. The Office of the National Coordinator (now the Assistant Secretary for Technology Policy) sets policy, and The Sequoia Project, as Recognized Coordinating Entity, administers it.

Networks that meet the requirements sign the Common Agreement and are designated Qualified Health Information Networks; the first QHINs were designated in December 2023. Health systems, vendors, and payers join as Participants or Subparticipants by signing flow-down agreements with a QHIN.

A QHIN must be a U.S. entity, complete the application and onboarding process (about twelve months, including a twelve-month provisional period), pass conformance testing against the QHIN Technical Framework, and hold third-party security certification; the RCE has designated HITRUST r2 as the accepted certification.

In writing, a QHIN needs the signed Common Agreement, its governance and participation policies, privacy and security policies meeting the Common Agreement and applicable standard operating procedures, the security certification report, incident response and breach notification procedures, and records showing compliance with the exchange purposes and individual access rules.