The Trusted Exchange Framework and Common Agreement: A Deep Dive for Health Care Leaders

Health information exchange has been changing dramatically in the last ten years; however, that transformation is accelerating, propelled by the Trusted Exchange Framework and Common Agreement (TEFCA), a cornerstone initiative of the 21st Century Cures Act. As major players like Carequality and Epic announce strategic alignments with TEFCA, health care leaders must begin to prepare for this new era of interoperability. This is less of a policy paper and more educational in nature, to help understand why this change is significant. Please feel free to reach out to discuss further.

History of TEFCA

TEFCA was one of the cornerstones of the 21st Century Cures Act (which was signed in December 2016). The legislation gave authority to the Assistant Secretary for Technology Policy (formerly the "Office of the National Coordinator") to establish a framework to address interoperability issues. The framework was to contain:

(I) a common method for authenticating trusted health information network participants;

(II) a common set of rules for trusted exchange;

(III) organizational and operational policies to enable the exchange of health information among networks, including minimum conditions

for such exchange to occur; and

(IV) a process for filing and adjudicating noncompliance with the terms of the common agreement. (source: 21st Century Cures Act

The first draft of TEFCA was released on January 5, 2018 and it has been undergoing several revisions since then. The most recent release was finalized on July 1, 2024

Overview of the Latest Version of TEFCA

The latest version of the Common Agreement, Version 2.0 along with its supporting documents, incorporates significant enhancements to support Health Level Seven (HL7?) Fast Healthcare Interoperability Resources (FHIR?)-based transactions as well as several new standard operating procedures. And, while not directly run by the federal government, the Common Agreement serves as the legal and technical foundation for secure information sharing on a nationwide scale. It defines the baseline requirements for companies that will be accountable for exchanging clinical data--organizations known as Qualified Health Information Networks (QHINs). It also defines agreements for those who are sharing data with the QHINs (called "participants") as well as their service providers (called "subparticipants").

It should be noted that while the framework has been established, the work to fully enable this is still a "work in progress". All the current members (QHINs, participants, and subparticipants), as well as new members, have much work to realize the capabilities outlined in the Agreement fully, and there are parts of the Agreement that still lack some implementation details that still need to be fully fleshed out. However, there does seem to be recognition by many health care entities that it is now "mature enough" to begin considering moving toward.

Major Sections of the Common Agreement:

Like all major legal agreements, the TEFCA starts with a purpose and definitions; however, it goes into some detail on the following topics:

1. Governance and Oversight: The agreement describes the roles and responsibilities of the Recognized Coordinating Entity (RCE), which oversees the implementation and maintenance of the Common Agreement. The Sequoia Project has been designated to oversee the RCE
2. Participation Requirements: The agreement itself details the criteria and obligations for entities seeking to become QHINs, including technical capabilities and compliance with privacy and security standards. It also refers to several new Standard Operating Procedures (SOPs) which are needed to ensure the safety and security of patient data and exchange.
3. Exchange Purposes: Lists the authorized purposes for which health information can be exchanged, such as treatment, payment, healthcare operations, public health, and individual access services. In the latest version of the Agreement, there have been several foundational exchange purposes defined, though it should be noted that currently only "Treatment" is considered operational at this point along with "individual access exchange".
4. Privacy and Security: Establishes strong privacy and security protections for all participating entities, including those not covered by HIPAA. This includes SOPs for cybersecurity incident reporting, escalation,
5. Technical Framework: Incorporates the Qualified Health Information Network Technical Framework (QTF), which outlines the technical standards and protocols for data exchange. This includes requirements for supporting technical data exchange formats, network security protocols, and use cases for how to exchange data.
6. Dispute Resolution and Enforcement: Describes the processes for resolving disputes and enforcing compliance with the agreement.
7. Amendments and Termination: Outlines the procedures for amending or terminating the Common Agreement.

Overview of the Technical Framework

The Qualified Health Information Network Technical Framework (QTF) is an integral component of TEFCA, focusing on the technical requirements for data exchange among QHINs. The QTF addresses several key areas to support future interoperability including:

• Patient Identity Resolution: Descriptions on how to begin moving toward accurate matching of patient records across different systems and networks.
• Authentication and Authorization: Establishes modern, secure protocols for verifying the identity of users and granting access to health information, ensuring proper levels of
• Data Exchange Standards: Specifies the use of standardized data formats and protocols, such as FHIR?, to facilitate interoperability.
• Performance Measurement: Includes metrics for evaluating the performance and reliability of data exchange processes.

Expansion and Future Directions

The future of TEFCA is poised for further expansion and refinement as the health care landscape continues to evolve. Several key areas are expected to drive the next phase of TEFCA's development:

1. Integration with Emerging Technologies: As new technologies such as artificial intelligence (AI) and machine learning (ML) become more prevalent in healthcare, TEFCA will need to integrate these technologies to enhance data analytics and decision-making processes.
2. Global Interoperability: While TEFCA is focused on nationwide interoperability, there is potential for expanding its principles to support global health information exchange, facilitating cross-border healthcare collaboration and research.
3. Policy and Regulatory Adaptations: As healthcare policies and regulations evolve, TEFCA will need to adapt to ensure compliance and alignment with new legal requirements, including data privacy and security standards.
4. Collaboration with Industry Leaders: Ongoing collaboration with industry leaders, including technology vendors, healthcare organizations, and government agencies, will be essential for driving TEFCA's success and addressing emerging challenges.

Conclusion

The latest version of TEFCA is a significant step forward in the quest for nationwide interoperability of health information and clinical data exchange. If successful, TEFCA could reduce fragmentation of patient records. In addition, it has the potential to improve the quality of care and empower individuals with access to their health information. However, the successful implementation of TEFCA will require some harmonization with other efforts as well as more collaboration and commitment from all stakeholders. As TEFCA continues to evolve, it will play a crucial role in shaping the future of health information exchange in the United States.