TEFCA in 2026: What Healthtech Companies Can Actually Do

In 2026, a healthtech company can use TEFCA to query patient records nationally for treatment, payment, operations, public health, benefits determination or individual access, by joining one of 11 designated QHINs as a participant or subparticipant. Treatment queries work best today; individual access responses are still uneven. Pick the exchange purpose first, then the QHIN.

TEFCA, the Trusted Exchange Framework and Common Agreement, went live in December 2023. Three years later it has real volume: The Sequoia Project, which runs it as the Recognized Coordinating Entity, reports more than 2 billion documents shared and more than 24,500 organizations live. For healthtech founders and CTOs the question is no longer whether TEFCA is real, but what your product can actually do with it, through which door, and with which caveats.

What is TEFCA, in one paragraph?

TEFCA is a federal framework, required by the 21st Century Cures Act, that lets health information networks connect to each other under one legal agreement and one technical framework. Qualified Health Information Networks (QHINs) connect to each other; participants connect to a QHIN; subparticipants connect through a participant. One connection gives you national reach instead of dozens of point-to-point agreements.

The governing documents are the Common Agreement (current version 2.1, released November 2024), the QHIN Technical Framework and a set of standard operating procedures (SOPs). ASTP/ONC oversees the program; HTI-2, effective January 15, 2025, put TEFCA governance into federal regulation.

Who are the QHINs in 2026?

There are 11 designated QHINs: CommonWell Health Alliance, eClinicalWorks, eHealth Exchange, Epic Nexus, Health Gorilla, Kno2, KONZA, MedAllies, Netsmart, Oracle Health Information Network and Surescripts. The RCE accepts applications on a rolling basis, so check its list before you commit.

Dates are from ASTP/ONC's TEFCA history fact sheet; the current roster is on the RCE's designated QHINs page. Federal participation is growing: ASTP reported the Indian Health Service, the Consumer Product Safety Commission and the Social Security Administration signing QHIN agreements, and HHS announced on November 5, 2026 that the Department of Veterans Affairs and the Department of War joined the network.

What can you use TEFCA for? The six exchange purposes

Every TEFCA transaction must carry an exchange purpose code. There are six authorized purposes: Treatment, Payment, Health Care Operations, Public Health, Individual Access Services, and Government Benefits Determination. Several have narrower sub-purposes, such as HEDIS reporting or electronic case reporting.

Source: the ASTP/ONC TEFCA update of February 19, 2026, which also lists the SOP versions in force: Exchange Purposes SOP 5.0 (January 2026), Facilitated FHIR Implementation SOP 2.0 (March 8, 2026) and IAS Provider Requirements SOP 2.1 (March 17, 2026).

The key design question: are you a HIPAA covered entity or business associate acting for one (treatment, payment, operations), or are you serving the patient directly (individual access)? The answer decides your legal obligations and which data holders must answer you.

Can a consumer health app use TEFCA for individual access?

Yes, as an Individual Access Services provider, but it is the hardest path today. The app must agree to TEFCA's IAS terms and transparency requirements, verify the patient's identity to a high assurance level, and accept that not every responder returns data yet. ASTP has a 2026 workstream specifically to increase trusted responses to IAS queries.

The engineering reality:

• Identity proofing. The IAS workstream is defining consistent IAL2 identity assurance and the demographic data to send with a query, so responders can match the person with enough confidence to respond. Budget for an identity-proofing vendor and a drop-off in your onboarding funnel.
• Matching. Even with verified identity, record matching across responders is probabilistic. Show patients where data came from and what is missing.
• Privacy obligations. IAS providers that are not HIPAA covered entities still take on TEFCA privacy and security obligations and must explain their data practices to users. Under the updated SOP, individuals get more transparency into their sharing choices.
• Uneven responses. Plan the product so partial records are still useful, and pair TEFCA with other sources (patient-authorized FHIR APIs) where coverage is thin.

How does a healthtech company actually join TEFCA?

Most companies join as a participant of a QHIN or as a subparticipant through a network, EHR vendor or HIE that is already connected. Becoming a QHIN yourself is a multi-year infrastructure commitment that only makes sense for networks. ASTP's process for participants: define your use case, pick a QHIN or intermediary, sign the terms of participation, finish technical and compliance onboarding, get listed in the RCE directory, then exchange.

• Through your EHR vendor. If your customers' EHR is already a QHIN participant, you may get TEFCA access as a feature. Fastest, least control.
• Through a QHIN directly. Signing with a QHIN that offers developer-friendly APIs gives you control over workflows and data handling. Compare their FHIR support, pricing, onboarding time and which exchange purposes they support for companies like yours.
• Through an HIE or network. Useful if you are regional or need the HIE's other services.

What to ask a QHIN before you sign

• Which exchange purposes will you support for a company like ours, and which responders are obligated to answer them?
• Do you offer facilitated FHIR today, or only document query and retrieve? Which FHIR resources, and at what rate limits?
• How long does onboarding take from signed terms to first production query, and what testing is required?
• How do you handle patient matching, and what demographic data do you need with each query?
• What logging and reporting will you give us for our own audits?

What about fees?

RCE materials on the Common Agreement state that QHINs may not charge other QHINs for exchange, while QHINs may charge their participants. In practice QHINs and intermediaries set their own commercial terms. In practice your cost is whatever your QHIN or intermediary charges, so get pricing in writing and compare. We did not find a published, current fee schedule across QHINs.

Is TEFCA FHIR-based now?

Partly. Most volume is still document exchange (C-CDA documents over IHE-style query and retrieve). Common Agreement version 2 introduced facilitated FHIR exchange, and the Facilitated FHIR Implementation SOP 2.0 took effect in March 2026 with added technical specifications and support for dynamic registration, authentication and authorization until 2027.

What this means for your architecture:

• Expect documents first. Build a pipeline that parses C-CDA into your data model, de-duplicates across sources and tracks provenance. This is where most of the work is.
• Use FHIR where your QHIN supports it. Facilitated FHIR lets you request specific resources after discovery, which is far easier to consume than documents.
• Keep provenance. Record which organization and QHIN every resource came from, and when. Clinicians and auditors will ask.

If you plan to put an AI agent on top of TEFCA data, normalize it to FHIR first and expose it through narrow tools; we cover that pattern in FHIR + MCP: connecting AI agents to EHR data safely.

How does TEFCA relate to information blocking rules?

The information blocking rules include a TEFCA-related exception that lets actors who are TEFCA participants fulfill some requests through TEFCA instead of the requested manner. HTI-5 proposed removing that "TEFCA manner" exception, but the October 2026 HTI-5 final rule did not finalize any of the information blocking changes, so the existing rules still apply.

Enforcement is also real now: OIG can impose penalties of up to $1 million per violation on developers and networks, and providers face Medicare disincentives. We cover the details in information blocking penalties in 2026.

Should your healthtech product use TEFCA?

Use it if you need records from many organizations you do not have direct relationships with, for a purpose TEFCA supports, and you can handle documents. Skip it, for now, if you only need data from a few known EHRs, where direct FHIR integrations are simpler, or if your use case does not fit an exchange purpose.

Whichever route, the data you get is PHI. Your product needs the same controls as any HIPAA system; see our HIPAA-compliant software development guide and security approach.

How BeevR builds this

We build the parts that sit between a TEFCA connection and a usable product: C-CDA and FHIR ingestion, record matching and de-duplication, provenance tracking, consent and exchange-purpose checks on every query, and audit logs your compliance team can read. When an AI layer is in scope, we normalize to FHIR first and give the agent narrow, purpose-bound tools. BeevR signs a BAA as a business associate, and processing can run inside your own AWS account.

We run a multi-tenant EHR live across four US clinics at about 300 patients a day. We work in fixed-price phases from $10K per phase, demo every Friday, and you own the code. See our EHR integration services, or book a 30-minute call to test whether TEFCA fits your use case.