TEFCA / QHINs (federal framework)

TEFCA is the federal government's framework for nationwide health-record exchange. Ten designated QHINs connect to one another under a single Common Agreement: CommonWell, eClinicalWorks, eHealth Exchange, Epic Nexus, Health Gorilla, KONZA, Medallies, Netsmart, Oracle Health and Surescripts. One of its permitted purposes is 'Individual Access Services': a consumer app can query the national networks for your records at your request. The catch is that HHS says once records are sent to an app you chose, and that app isn't a HIPAA covered entity or business associate, the records are 'no longer subject to the protections of the HIPAA Rules.' TEFCA's procedures put their own privacy, consent and incident-notice requirements on IAS providers instead. Those are contract terms enforced through the network, not federal law, and individuals can't enforce them directly. TEFCA's founding principles are explicitly 'non-binding.'

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-10-15

Primary source. www.healthit.gov/topic/interoperability/policy/trusted-exchange-framework-and-common-agreement-tefca — Unverified - heuristic first draft.

Arbitration

Not applicable (framework). Check each IAS app's own terms.

Data sharing

National query-based exchange of clinical records among QHINs and their participants. The IAS purpose lets consumer-facing apps pull records. Once records reach a non-HIPAA app, HIPAA no longer applies (HHS). The protections that remain are TEFCA contract terms and, for apps, FTC and state law.

Contacts

Privacy contact. rce@sequoiaproject.org

Legal notice. Not applicable (federal framework). RCE contact: rce@sequoiaproject.org

Mailing address. Not recorded.