Trusted Exchange Framework and Common Agreement (TEFCA)

ONC released Version 2.0 of the Common Agreement on April 22, 2024. Common Agreement Version 2.0 updates Common Agreement Version 1.1, published in November 2023, and includes enhancements and updates to require support for Health Level Seven (HL7^®) Fast Healthcare Interoperability Resources (FHIR^®) based transactions. The Common Agreement includes an exhibit, the Participant and Subparticipant Terms of Participation (ToP), that sets forth the requirements each Participant and Subparticipant must agree to and comply with to participate in TEFCA. The Common Agreement and ToPs incorporate all applicable standard operating procedures (SOPs) and the Qualified Health Information Network Technical Framework (QTF). View the release notes for Common Agreement Version 2.0

The Trusted Exchange Framework and Common Agreement^TM (TEFCA^TM) has 3 goals: (1) to establish a universal governance, policy, and technical floor for nationwide interoperability; (2) to simplify connectivity for organizations to securely exchange information to improve patient care, enhance the welfare of populations, and generate health care value; and (3) to enable individuals to gather their health care information.

TEFCA Components

Common Agreement

The Common Agreement is the agreement that the Recognized Coordinating Entity® (RCE^TM) signs with each Qualified Health Information Network^TM (QHIN^TM). It defines the baseline legal and technical requirements for secure information sharing on a nationwide scale. The Common Agreement also establishes the infrastructure model and governing approach to enable users in different health information networks (HINs) to securely share information with each other—all under commonly agreed-to expectations and regardless of which network they happen to be in. 

Release Notes for Common Agreement Version 2.0

• Implementation Date of the Common Agreement Version 2 is 60 days following publication in the Federal Register (June 30, 2024)
• After the Implementation Date, the Common Agreement Effective Date is the date the RCE and Signatory execute the Common Agreement
• Details in the following sections of the Common Agreement have moved to SOPs:
     3) Governing Approach
     6) Cooperation
     8) RCE Directory Service
     9) TEFCA Exchange Activities
     10) Individual Access Services
     12) Security

New Addition of required encryption for Individually Identifiable Information in transit and at rest for all Non-HIPAA Entities (NHEs); applies same requirements that are already in place for IAS Providers to also be applicable to NHEs.

New Static Participant/Subparticipant Terms of Participation (ToP)

New Definition of TEFCA Exchange governs all transactions identified by a unique TEFCA Exchange Purpose (XP) Code.

• These transactions could occur QHIN-to-QHIN, within QHINs, or across Participants and Subparticipants of different QHINs

Trusted Exchange Framework

The Trusted Exchange Framework is a common set of principles designed to facilitate trust between HINs and by which HINs voluntarily elect to abide to enable widespread information exchange. These principles are standardization; openness and transparency; cooperation and non-discrimination; privacy, security, and safety; access; equity; and public health.

QHIN Technical Framework (QTF)

The QTF [PDF - 1034 KB] focuses on the technical components for exchange among QHINs, including patient identity resolution, authentication, and performance measurement. The QTF requirements are incorporated by reference into the Common Agreement. An updated version of the QTF will be made available soon to accompany Common Agreement Version 2.0.

TEFCA Organizations

Recognized Coordinating Entity (RCE)

The RCE developed, updates, implements, and maintains the Common Agreement. It is also responsible for soliciting and reviewing applications from HINs seeking QHIN status and administering the QHIN designation and monitoring processes. The Sequoia Project currently serves as ONC’s RCE under a contract with ONC.

Qualified Health Information Network (QHIN)

A QHIN is a HIN that is a U.S. Entity that has completed the QHIN application, onboarding, and designation process and is a party to the Common Agreement countersigned by the RCE. QHINs have the technical capabilities and organizational attributes to connect HINs on a nationwide scale. Participants and Subparticipants will be able to choose their QHIN and will be able to share information with all other connected entities regardless of which QHIN organization they choose.

TEFCA Exchange

TEFCA Exchange Purposes

Currently, TEFCA will support exchange for the following Exchange Purposes:

• Treatment;
• Payment;
• Health Care Operations;
• Public Health;
• Government Benefits Determination;
• and Individual Access Services (IAS).

This means organizations connected to TEFCA are optionally allowed to request for or respond to any of these purposes. 

Privacy and Security

The Common Agreement requires strong privacy and security protections for all entities who elect to participate in TEFCA, including entities not covered by HIPAA. Most connected entities will be HIPAA Covered Entities or Business Associates of Covered Entities and thus will already be required to comply with HIPAA privacy and security requirements. The Common Agreement requires each non-HIPAA entity that participates in TEFCA to protect individually identifiable information that it reasonably believes is TEFCA Information in substantially the same manner that HIPAA Covered Entities protect Protected Health Information (PHI), including having to comply with the HIPAA Security Rule and most provisions of the HIPAA Privacy Rule as if they were covered by the HIPAA Rules.

To view all TEFCA documents, register for educational sessions, and review requirements for QHIN designation, please visit the RCE website at RCE.SequoiaProject.org.

TEFCA Implementation

On December 12, 2023, HHS Secretary Xavier Becerra, HHS Deputy Secretary Andrea Palm, National Coordinator for Health Information Technology Micky Tripathi, and other federal leaders celebrated TEFCA exchange becoming operational at a Common Agreement signing event at HHS headquarters.

View the current list of organizations that have completed the rigorous TEFCA onboarding process and have been officially designated as QHINs

Entities considering seeking QHIN status can review the requirements and determine whether they would like to apply. Check out ONC’s Recognized Coordinating Entity’s website for more information about the application process.

Publication of the Trusted Exchange Framework and the Common Agreement

Section 4003(b) of the 21st Century Cures Act requires the National Coordinator to publish the Trusted Exchange Framework and the Common Agreement on its public Internet website and in the Federal Register. In accordance with Section 4003(b), links to the Trusted Exchange Framework and the Common Agreement are below. ONC submitted the same version of the Common Agreement Version 2.0 that is posted here to the Office of the Federal Register (OFR). It was published on May 1, 2024. View the Common Agreement Version 2.0 on the Federal Register