What Is TEFCA? How Your Health Records Move Between Providers

If you see a primary care doctor, a couple of specialists and the occasional urgent care clinic, your health story is probably scattered across several record systems. Each new visit can mean filling out the same forms, re-explaining your history, or waiting while someone faxes records from another office.

TEFCA is the federal government’s answer to that problem. It doesn’t replace your doctor’s record system or create a single national database. Instead, it sets common rules so the networks your providers already use can find and request records from each other.

This guide explains what TEFCA is, how a record request actually travels, who’s connected, what it means for privacy, and what you can do to make it work for you.

What TEFCA stands for and where it came from

TEFCA stands for the Trusted Exchange Framework and Common Agreement. It has 2 parts:

• The Trusted Exchange Framework is a set of principles for how health information networks should share data: openly, securely and in a standardized way.
• The Common Agreement is the legal contract that networks sign. It spells out privacy, security and technical rules that everyone connected must follow.

The 21st Century Cures Act, signed in 2016, directed the National Coordinator for Health Information Technology to convene stakeholders and develop this framework, with the goal of full network-to-network exchange of health information. The Office of the National Coordinator (now part of the Assistant Secretary for Technology Policy, known as ASTP/ONC) released the framework and Version 1 of the Common Agreement in January 2022. Updated versions followed, including Version 2.0 in 2024, which brought in more support for the modern FHIR data standard.

In December 2024, HHS also published a final rule that placed the process for designating TEFCA networks into federal regulation at 45 CFR Part 172. That regulation describes TEFCA as a voluntary process.

How TEFCA works: networks of networks

Think of TEFCA like the system that lets you call someone on a different phone carrier. Each carrier runs its own network, but common agreements let calls connect.

Qualified health information networks (QHINs)

At the top are Qualified Health Information Networks, or QHINs. These are large networks that have been vetted and designated to connect directly with each other. The Recognized Coordinating Entity’s list currently shows 11 designated QHINs:

• CommonWell Health Alliance
• eClinicalWorks
• eHealth Exchange
• Epic Nexus
• Health Gorilla
• Kno2
• KONZA
• MedAllies
• Netsmart
• Oracle Health Information Network
• Surescripts Health Information Network

The list can change because applications are accepted on a rolling basis.

Participants and subparticipants

Below the QHINs are participants and subparticipants: hospitals, clinics, health plans, labs, public health agencies, technology vendors and patient apps. They connect through a QHIN, often by way of the EHR vendor or regional health information exchange they already use.

The Recognized Coordinating Entity

The Sequoia Project serves as the Recognized Coordinating Entity (RCE) under a contract with ASTP/ONC. It maintains the Common Agreement, runs the QHIN application and designation process, and monitors compliance. In August 2026, the RCE reported that more than 1.5 billion documents had been shared through TEFCA since exchange began in December 2023.

Key takeaway: TEFCA isn’t one big database. Your records stay where they are. TEFCA sets the rules that let one network ask another for them securely.

What happens when your records move

Here’s a simplified version of what happens when a new specialist looks for your history:

1. You check in. The specialist’s system has your name, date of birth and other identifying details.
2. A query goes out. The specialist’s EHR sends a request through its QHIN, saying it needs records for treatment.
3. QHINs pass the request along. The request reaches other QHINs, which route it to participants that may hold your records.
4. Systems match you. Each responding system checks whether it has a matching patient.
5. Records come back. Matching organizations return documents such as visit summaries, medication lists, allergies and lab results.
6. Your clinician reviews them. The records appear in the specialist’s system, ready to review before or during your visit.

Every request must state an approved reason, called an exchange purpose. The initial purposes are:

What TEFCA changes for patients who see many doctors

For most people, TEFCA works in the background. You’ll notice it mainly through fewer gaps and less paperwork.

• Records from other systems show up more often. A provider on a different EHR may still be able to find your history.
• Fewer repeated tests. When earlier results are available, clinicians may not need to reorder them.
• Better visits after a move or switch. Moving to a new city or changing doctors gets easier when records can follow you. Our guide on how to transfer medical records to a new doctor covers the steps when they don’t.
• Patient apps can pull your records. Through individual access services, approved apps can gather records from many providers into one place.

TEFCA doesn’t guarantee that everything is shared. Coverage depends on whether each of your providers participates, what data their systems can send, and whether your identity can be matched.

Individual access: getting your own records through TEFCA

One of TEFCA’s exchange purposes is aimed directly at you. Individual Access Services (IAS) let you use a connected app to request your records from TEFCA participants instead of logging into each provider’s portal separately.

The RCE describes 2 types of IAS providers:

• Bidirectional apps let you request your records and share them with other TEFCA participants, such as a doctor.
• Request-only apps let you request your records, but not share them through TEFCA.

IAS providers have to meet specific requirements under the Common Agreement and RCE policies, including verifying your identity through approved identity verification services, giving you a plain-language privacy and security notice, getting your express documented consent, encrypting your data in transit and at rest, and honoring your right to delete your information and export it, with certain exceptions.

That’s stronger than many consumer health apps, which often aren’t covered by HIPAA at all. Our guide on whether your health app is covered by HIPAA explains the difference. If you’d rather use your phone’s built-in health app, see how to add your medical records to Apple Health or Android Health Connect.

Privacy and security under TEFCA

TEFCA participants must follow HIPAA’s privacy and security rules plus applicable state and local laws. Under the Common Agreement, organizations that aren’t normally covered by HIPAA, such as some IAS providers, must still follow key HIPAA privacy provisions and the HIPAA Security Rule for TEFCA information.

A few points to know:

• Requests need a valid purpose. Organizations can’t query records just because they’re connected.
• Sensitive records may have extra protections. Some state laws and federal rules, such as those for substance use disorder treatment records, add restrictions.
• Opt-out options vary. The RCE’s public materials don’t describe a single national TEFCA opt-out. Your choices depend on your providers’ policies and your state’s laws, so ask your provider or your state’s health information exchange.

If you’re worried about a breach involving your records, our guide on what to do after a health data breach walks through next steps. This is not legal advice.

Where to start: make TEFCA work for you

You don’t have to sign up for TEFCA. But a few steps make it more likely your records follow you:

1. Keep your details consistent. Use the same legal name, date of birth, address and phone number at every provider. Record matching depends on it.
2. Update your demographics after a move or name change. Tell each provider and your health plan.
3. Ask your providers how they share records. “Can you pull my records from other systems?” is a fair question at check-in.
4. Use your patient portals. Review what’s in your record and correct errors. Our guide on how to use a patient portal explains how.
5. Request copies when it matters. Before a big appointment, don’t rely on exchange alone. Our guide on how to get copies of your medical records online shows how.
6. Consider a TEFCA-connected app carefully. Read its privacy notice and check whether it’s request-only or bidirectional before you connect.
7. Set up caregiver access. If you manage care for a parent or child, set up patient portal proxy access so you can see records too.

For terms like EHR, FHIR or health information exchange, see our glossary and our explainer on what an electronic health record is.

The bottom line

TEFCA is the national rulebook that lets health information networks connect, so your records can follow you between providers on different systems. It’s voluntary, it’s growing, and it doesn’t create a central database. For patients who see many doctors, the practical payoff is fewer missing records, fewer repeated forms and a growing set of apps that can gather your history in one place. Keep your details consistent and ask your providers how they share, and you’ll get the most out of it.

Sources

• ASTP/ONC: Trusted Exchange Framework and Common Agreement (TEFCA) — what TEFCA is, the RCE, QHINs and exchange purposes
• ASTP/ONC: 21st Century Cures Act Section 4003 — legal basis for the framework
• eCFR via Cornell LII: 45 CFR 172.100 — purpose of the TEFCA regulation and its voluntary process
• The Sequoia Project RCE: Designated QHINs — current list of QHINs
• The Sequoia Project RCE: TEFCA for Individuals — individual access services and app types
• The Sequoia Project RCE: Summary of Required Flow-Down Provisions — privacy, security, deletion and export requirements