Source notes
TEFCA in 2026: QHINs, individual access and what it means for small clinics
A plain-English update on TEFCA: the designated QHINs, the six exchange purposes, patient individual access, CMS Aligned Networks and information-blocking enforcement.
What TEFCA is
The Trusted Exchange Framework and Common Agreement (TEFCA) is the federal framework for exchanging health information between networks nationwide. Instead of every organization negotiating with every other, organizations join through a Qualified Health Information Network (QHIN), and QHINs exchange with each other under one set of rules.
The federal Assistant Secretary for Technology Policy (ASTP/ONC) sets the policy, and The Sequoia Project serves as the Recognized Coordinating Entity that designates QHINs and publishes operating procedures.
Sources: ASTP/ONC: TEFCA
The designated QHINs
The Recognized Coordinating Entity lists 11 designated QHINs, with more candidates onboarding. Many EHR vendors connect through one of them, so the QHIN your clinic uses is often decided by your EHR.
- CommonWell Alliance
- eClinicalWorks Prismanet
- eHealth Exchange
- Epic Nexus
- Health Gorilla
- Kno2
- Konza Health
- Medallies
- Netsmart
- Oracle Health Information Network
- Surescripts Health Information Network
Sources: Designated QHINs
Six exchange purposes, including individual access
TEFCA exchange is organized by purpose. ASTP/ONC lists six: treatment, payment, health care operations, public health, government benefits determination and individual access services. Individual access is the purpose that lets a patient, through an approved app, request their own records across the network.
An updated operating procedure for individual access took effect on August 3, 2026, setting identity-verification requirements for these requests and when participants must respond. For patients, the practical result is a more consistent route to records held by organizations they may have forgotten about.
Sources: ASTP/ONC: TEFCA exchange purposes · Individual Access Services SOP update
How much is actually flowing
Volume has grown quickly. In February 2026, ASTP/ONC reported that nearly 500 million health records had been exchanged through TEFCA, up from about 10 million in January 2025.
CMS Aligned Networks and “Kill the Clipboard”
In July 2025, CMS announced a Health Tech Ecosystem in which more than 60 companies pledged to support patient-centered data exchange. It has two main strands: the CMS Interoperability Framework, under which networks self-attest to become CMS Aligned Networks, and “Kill the Clipboard”, which aims to replace paper intake with QR codes, FHIR data and SMART Health Cards and Links.
CMS says numerous early adopters reached general availability in July 2026. For clinics, it is worth asking your EHR vendor and any intake-software vendor whether they have pledged and what that will change at check-in.
Sources: CMS: Health Tech Ecosystem announcement · CMS Interoperability Framework · CMS: Kill the Clipboard
Information blocking: enforcement has started
In September 2025, the HHS Office of Inspector General and ASTP/ONC issued a joint enforcement alert. Health IT developers, health information exchanges and networks can face civil money penalties of up to $1 million per violation; healthcare providers face disincentives through CMS programs instead. The alert said enforcement would prioritize cases involving patient harm or impaired care.
Rules still in motion
The HTI-4 final rule, covering e-prescribing and electronic prior authorization, took effect in October 2025. The HTI-5 proposal, which would remove many certification criteria, was still pending when we checked in September 2026. Watch for its final text before planning EHR changes around it.
Sources: ASTP/ONC: HTI rules
What a small clinic should do now
You do not need to join a QHIN yourself. Most of the work sits with your vendors, but a few questions are worth asking.
- Which QHIN does our EHR connect through, and is it switched on for our practice?
- Which exchange purposes do we respond to today, including individual access?
- How are requests for patient records handled, and how quickly do we respond?
- Has our EHR or intake vendor joined the CMS Health Tech Ecosystem pledge?
- Who in the practice owns information-blocking policy and exceptions?
Questions about this guide
Do patients have to do anything to use TEFCA?
Patients use individual access through an app that participates in TEFCA. The app handles the request and identity verification; they do not join a network directly.
Does TEFCA replace my patient portal?
No. A portal shows records held by one organization. TEFCA individual access can help an app find records across many organizations.