EHR & Health Data Systems · Health Data Network / HIE · Structural / no discrete incident
Carequality (The Sequoia Project)
Headline
Carequality isn't a database. It's a shared rulebook that lets EHR vendors and data networks such as Epic, Particle Health and Health Gorilla request patient records from each other nationwide without signing a…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Carequality isn't a database. It's a shared rulebook that lets EHR vendors and data networks such as Epic, Particle Health and Health Gorilla request patient records from each other nationwide without signing a separate contract with each one. The weak point is trust in the requester's stated purpose. Requests are typically marked 'treatment,' and a record holder has limited ability to check that. In April 2024 Epic stopped answering some record requests from Particle Health's customers on Carequality, and Particle called that a violation of Carequality's terms. In 2025–2026 Epic sued Health Gorilla, alleging records were pulled through these networks for purposes other than treatment. Health Gorilla's press release says its motion to dismiss argues the plaintiffs bypassed mandatory contractual dispute-resolution procedures, and that the suit relies on facts from a process involving Carequality, the TEFCA network administrator, and several large health providers (Health Gorilla's own characterization). Carequality's own privacy policy covers only website and membership data and doesn't address the patient data that moves under its framework. Patients have no direct relationship and no visible opt-out.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-10-15
Primary source. www.particlehealth.com/blog/particle-addresses-disruption-on-carequality-network — Unverified - heuristic first draft.
Terms
Arbitration
None found (no consumer terms).
Data sharing
Framework for record exchange among implementers; patient data is not held centrally per the materials reviewed. The privacy policy addresses only website, member and billing data. Purpose-of-use claims such as 'treatment' are largely self-asserted by requesters, which the Epic, Particle and Health Gorilla disputes illustrate.
Fees and billing
None (no consumer billing).
Contacts
Privacy contact. admin@carequality.org; 571-418-7747
Legal notice. Carequality, 8300 Boone Blvd, Ste 500, Vienna, VA 22182 (per privacy policy)
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
Sources
| Source | Claim | Tier | Status | Quote |
|---|---|---|---|---|
| Organization homepage · 2026 carequality.org/ | whole row | Unassigned | confirmed | “an interoperability framework enabling nationwide care coordination” Quote basis: not recorded. |
| Organization privacy policy · 2026-08-10 carequality.org/privacy-policy/ | whole row | Unassigned | confirmed | “all references to Carequality include sequoiaproject.org” Quote basis: not recorded. |
| Company blog (party to dispute) · 2024-04-09 www.particlehealth.com/blog/particle-addresses-disruption-on-carequality-network | whole row | Unassigned | confirmed | “this unilateral action is a violation of Carequality's terms and conditions” Quote basis: not recorded. |
| Company press release (party to dispute) · 2026-02-26 www.businesswire.com/news/home/20260226940871/en/Health-Gorilla-Files-Motion-to-Dismiss-Reaffirming-Confidence-in-Interoperability-System | whole row | Unassigned | confirmed | “Carequality and TEFCA protect patients by ensuring clinicians have the information they need at the point of care” Quote basis: not recorded. |
| Regulator (ONC/ASTP) · 2026-09-03 www.healthit.gov/topic/interoperability/policy/trusted-exchange-framework-and-common-agreement-tefca | whole row | Unassigned | confirmed | “currently serves as RCE under a 5-year contract with ONC awarded in August 2023” Quote basis: not recorded. |
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy https://carequality.org/privacy-policy/ | Not fetched yet | NOT CONFIRMED |
| Terms of service None published (no terms-of-use link found on carequality.org) | Not fetched yet | NOT CONFIRMED |
| Website https://carequality.org | Not fetched yet | — |
| Primary source https://www.particlehealth.com/blog/particle-addresses-disruption-on-carequality-network Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
Headquarters on file: VA. Provisions of VCDPA on file:
| Provision | Type | Source |
|---|---|---|
| Applicability Threshold Va. Code § 59.1-576 | threshold | source |
| Right to Confirm and Access Va. Code § 59.1-577(A)(1) | hard | source |
| Right to Correction Va. Code § 59.1-577(A)(2) | hard | source |
| Right to Deletion Va. Code § 59.1-577(A)(3) | hard | source |
| Right to Data Portability Va. Code § 59.1-577(A)(4) | hard | source |
| Right to Opt Out of Sale, Targeted Advertising, and Profiling Va. Code § 59.1-577(A)(5) | hard | source |
| Right to Appeal Denied Request Va. Code § 59.1-577(C) | hard | source |
| Sensitive Data — Opt-In Consent Required Va. Code § 59.1-578(A)(5); § 59.1-575 (definitions) | hard | source |
| Privacy Notice Requirements Va. Code § 59.1-578(C) | hard | source |
| Processor Contract Requirements Va. Code § 59.1-579(B) | hard | source |
| Data Protection Assessment Va. Code § 59.1-580 | hard | source |
| Enforcement — AG Only; Civil Penalties Va. Code § 59.1-584 | hard | source |