TEFCA, the Trusted Exchange Framework and Common Agreement, connects US health information networks through Qualified Health Information Networks, or QHINs. It went live in December 2023. For most of its first two years, health tech teams could reasonably treat it as background. In 2026 it became something product and data architects need to plan around.
What changed this year
- Volume. ASTP's February 2026 update reported more than 70,000 sites and more than 474 million documents shared since go-live1. Becker's, citing HHS, described nearly 500 million records exchanged by February 2026, up from around 10 million in January 20252. The counting methods differ, but the direction is unmistakable.
- New uses. The Social Security Administration announced in February that it was connecting through a QHIN to speed up disability decisions3, and Becker's reported it went live that spring under a government benefits determination exchange purpose24.
- Enforcement. Becker's also reported a March 2026 federal court order permanently barring a telehealth company, accused of requesting records under false treatment claims, from requesting records through TEFCA or Carequality2.
The enforcement action matters as much as the volume. A network that acts against misuse is one that health systems will trust with more data, and one where product teams must be able to prove their purpose for every request.
Exchange purposes are the design centre
Every TEFCA transaction carries a code identifying its exchange purpose: treatment, payment, health care operations, public health or individual access services, with room for more1. For a product team, that means purpose is not a policy document; it is a field on every request, and it has to be true.
| If your product does | Likely exchange purpose | What you need to prove |
|---|---|---|
| Care coordination for clinicians | Treatment | A real treatment relationship for each patient queried |
| Consumer health records apps | Individual Access Services | Strong identity verification and patient authorisation |
| Quality or population analytics for providers | Health care operations | Acting for a covered entity within its operations |
| Public health reporting support | Public health | Authority and scope of the public health use |
Confirm the specifics against the current Common Agreement and standard operating procedures with counsel. The architectural point holds regardless: purpose has to be captured, enforced and auditable per request.
The FHIR roadmap
TEFCA started with document-based exchange. Its FHIR roadmap describes a staged move towards FHIR, from FHIR content over existing protocols through to FHIR-based exchange facilitated by QHINs5. Summaries differ in how they number the stages, so read the current roadmap from the Recognized Coordinating Entity before planning against it.
For architects, the practical advice is the same either way: build on FHIR internally now. Documents arriving today should land in a pipeline that can also accept FHIR resources tomorrow, using the patterns in FHIR Bulk Data pipelines and FHIR to OMOP.
What I would build now
- A purpose-aware request layer that attaches and checks the exchange purpose for every outbound query, with the evidence that justifies it.
- Audit trails that would satisfy a QHIN: who requested what, for which patient, under which purpose, and what came back.
- Document ingestion with structure, extracting coded data from clinical documents into a governed store rather than keeping them as opaque files.
- Identity and patient matching treated as first-class problems, since record location across networks depends on them.
- Controls on downstream AI use, so data received for one purpose isn't silently reused for another, in line with HIPAA security expectations.
Who should pay attention
Digital health vendors whose products depend on records from many providers, consumer health apps, payers and anyone building clinical AI that needs longitudinal data. Commentary on QHIN expansion suggests the network is becoming a practical route to data that used to need many point-to-point integrations6. The teams that design for purpose, audit and FHIR now will find it much easier to connect when their customers ask.
How I can help
I design interoperability and data platforms for health tech companies and providers, from purpose-aware exchange to analytics and clinical AI. See healthcare data architecture, or analyse your challenge and bring the result to a call.
- 1TEFCA updates presentationASTP/ONC, HealthIT.gov · 19 Feb 2026
- 2What's new with TEFCA in 2026Becker's Hospital Review · 2026
- 3Social Security Administration joins the TEFCA network to speed up disability benefits decisionsUS Social Security Administration · 11 Feb 2026
- 4
- 5
- 6TEFCA in 2026: what QHIN expansion means for digital health vendors and providersWireless-Life Sciences Alliance · Jan 2026