HHS aims to strengthen TEFCA through greater oversight, QHIN reviews

HHS' Office of the National Coordinator for Health Information Technology announced new steps to strengthen the TEFCA federal health data-sharing network, including plans to conduct additional reviews of Qualified Health Information Networks.

TEFCA, which launched in December 2023, established a trusted exchange framework and a common agreement to facilitate secure health data exchange. TEFCA uses a network-of-networks approach that designates organizations as QHINs, which route and exchange EHRs nationwide. QHINs include eHealth Exchange, Epic Nexus, Health Gorilla, and, more recently, Oracle Health.

According to the HHS press release, the TEFCA network has expanded rapidly, with the number of health records exchanged through the network growing from 10 million to more than 1 billion in less than a year.

"Exchange across the TEFCA network is just getting started," said Thomas Keane, M.D., national coordinator for health IT, in the press release. "ONC is executing against its mission to ensure the network is secure and that the quality of data exchanged allows for better clinical outcomes."

To strengthen TEFCA, the ONC has awarded a new contract to enhance network oversight and verify that organizations participating in TEFCA follow required policies and procedures. The press release did not state who the contract was awarded to.

In addition, ONC will conduct additional reviews of QHINs and their participants to ensure compliance with TEFCA's rules and operating requirements.

"As ONC identifies any behaviors on the network that are potentially civilly or criminally actionable, including information blocking and fraud, we will refer them to the appropriate Executive Branch agencies for investigation, including the HHS Office for Civil Rights, HHS Office of Inspector General, and the Department of Justice," Keane stated.

The announcement comes as disputes over healthcare interoperability grow. Earlier this year, Epic and other healthcare providers sued the interoperability platform Health Gorilla and several of its clients, alleging that the companies exploited frameworks such as TEFCA and Carequality to access medical records and use them for financial gain. While Health Gorilla continues to deny the allegations, one defendant, GuardDog Telehealth, admitted to improper record sharing and entered into a settlement. 

Additionally, Epic is facing two lawsuits alleging it curbs EHR data access and "monopolizes" the EHR industry.

In today's announcement, HHS Secretary Robert F. Kennedy, Jr. underscored that the goal behind strengthening TEFCA is to put "patients in control of their health information, improve care coordination, and ensure health data moves securely where it is needed."

Paula M. Stannard, director of the HHS Office for Civil Rights, further stated that individuals who believe the right to access their health information has been denied or their data has not been kept secure can file complaints with OCR.

"As HHS advances the exchange of health information through TEFCA, the Office for Civil Rights serves a critical law enforcement function through the enforcement of the HIPAA Rules," said Stannard in the press release. "Americans' health information must remain confidential and secure, yet readily accessible by them."

Anuja Vaidya has covered the healthcare industry since 2012. She currently covers healthcare IT and innovation, including artificial intelligence, digital healthcare, EHRs and interoperability.