TEFCA vs FHIR: How They Work Together

Posted in Healthcare Compliance

TEFCA has moved more than 1.5 billion clinical documents since it went live in December 2023, and FHIR increasingly carries that traffic instead of competing against it. That fact alone reframes the usual comparison. “TEFCA vs FHIR” sounds like a choice between two competing options, but it’s not that. One is a legal and technical network, and the other is the data standard now running inside a growing share of that network’s traffic. What actually determines whether your next quarter goes into a direct API build or the slower work of joining a network you didn’t realize you needed is how the two relate to each other.

What Is TEFCA

TEFCA is short for “Trusted Exchange Framework and Common Agreement”, a legal and technical framework for exchanging health data nationwide, a part of every software or data format. 

It has 3 components: 

1. The Common Agreement: The binding contract that participating organizations sign. 
2. The QHIN Technical Framework: It sets the technical rules for how connections actually work. 
3. Standard Operating Procedures: Defines the rules for specific use cases called exchange purposes.

Organizations don’t connect to TEFCA directly; rather, they connect via a Qualified Health Information Network, or QHIN. It is one of a small set of organizations that have signed the Common Agreement itself and maintain a connection to every other QHIN. 

As of mid-2026, there are 11 designated QHINs, including: 

• CommonWell Health Alliance
• eHealth Exchange
• Epic Nexus
• Health Gorilla
• Oracle Health Information Network
• Surescripts

They represent more than 23,000 participating organizations, and its scaling each passing day. The Sequoia Project runs the program as the Recognized Coordinating Entity, under contract with ASTP/ONC, the agency that used to go by ONC alone.

When Was TEFCA Released?

TEFCA was passed in 2016. The first published version of the framework, Common Agreement version 1 and QHIN Technical Framework version 1, was published in January 2022, built entirely around document-based exchange. 

The network went live in December 2023, when the first group of QHINs countersigned the Common Agreement at an event held at HHS. Common Agreement version 2.0, the version that introduced FHIR into the framework, followed in July 2024, extending what the network could do. 

TEFCA as a published framework is a 2022 release, and TEFCA as a live, operating network is a December 2023 one.

TEFCA vs FHIR in a Nutshell

Dimension	TEFCA	FHIR
What it is	Legal and technical exchange framework	Data standard and API specification
Governs	Who can exchange data with whom, and under what terms	How clinical data is structured and requested
Created by	Authorized by the 21st Century Cures Act (2016); operated by The Sequoia Project as the Recognized Coordinating Entity	Published and maintained by HL7
First live / available	Network went live in December 2023	In active use since the early 2010s; Release 4 (R4) is the current version
Unit of exchange	Legal participation through a QHIN connection	Individual FHIR resources (Patient, Observation, Condition, and others)
Works on its own	No; needs a data format to actually move information	Yes; fully usable outside TEFCA, including direct APIs and SMART on FHIR apps
Where they intersect	Adopted FHIR as an exchange mode through Facilitated FHIR (July 2024)	Is the data format Facilitated FHIR uses inside TEFCA’s governance layer

4 Parameters for a Strong QHIN Connection

Joining TEFCA vs FHIR isn’t a one-time certification; it’s an ongoing set of connections that keep paying off. 

• Choose a role: Most organizations join as a Participant of a QHIN, or as a Subparticipant of a Participant; under Common Agreement 2.0, a participant may connect through more than one QHIN at once. Becoming a QHIN yourself is a different order of commitment, with its own cybersecurity certification and technical onboarding process.
• Register in the RCE Directory: Every connected entity is published there with the identity and endpoint metadata other nodes need to find and authenticate it. Keep it current, and it works quietly in the background; let it drift, and you’ll likely hear about it from a partner before a monitoring alert catches it.
• Implement the security layer: HL7’s FHIR At Scale Taskforce built FAST Security, formally the UDAP Security for Scalable Registration, Authentication and Authorization FHIR IG, which lets a system prove its identity to a TEFCA participant it has never connected with before, using digital certificates instead of a manually negotiated agreement for every new relationship. TEFCA has set January 1, 2026, as the deadline for participants to have this in place for FHIR exchange, with a longer runway into 2027 specifically for dynamic registration support.
• Meet the current data floor: Certified health IT is required to conform to USCDI v3, the federal data-element baseline, as of January 1, 2026, up from the narrower USCDI v1 baseline most systems were originally built against. If your mapping work was scoped against the older version, it’s worth re-checking before you commit further engineering time.

6 Exchange Purposes of TEFCA 

TEFCA opens the door to exchange for six defined purposes, giving every connected organization a clear menu to work from. 

Every QHIN supports all six technically, and responding organizations only need to actually answer a narrower set:

• Treatment
• Payment
• Health Care Operations
• Public Health
• Government Benefits Determination
• Individual Access Services

Treatment carries two codes: 

1. The general treatment code allows an optional response. 
2. The required treatment code obligates an automated response from any vetted, TEFCA-connected health care provider.

The rules about who counts as vetted have loosened over time, pulling more organizations into the mandatory-response tier. Individual Access Services carries a similar required-response obligation, since its entire purpose is letting a patient direct their own data to an app of their choice. For a product team, this is where the specification turns into clear, buildable backlog items. 

Someone parses which exchange purpose code a request carries and keeps required responses separate from optional ones in the access logic, then logs what was released, to whom, and under which purpose. 

4 Things That Make TEFCA and FHIR Projects Successful

• Get ahead of legacy data shapes: Systems built before USCDI existed often hold clinical data in formats that need translation, and mapping to the current baseline is a great opportunity to close coding and completeness gaps that stayed invisible while the data never left the building.
• Give directory management an owner: Identity and endpoint management works best with a named owner rather than a one-time setup step; give it that owner, and directory entries stay current instead of drifting until a connection fails.
• Build access control in from day one: Purpose-based access control is far easier to build once, from the start, than to bolt on after the exchange already works.
• Let FHIR do real work, not just translation: FHIR holds up best when it’s more than a translation layer over an unchanged core system, since the first partner who asks for a resource the core wasn’t built to express will find out fast, and that’s a great early signal to build on.

A well-run discovery phase, the stretch where you find out what your data actually looks like versus what the standard expects, is what keeps a TEFCA or FHIR project short. Teams that invest there up front tend to move faster once they commit to a delivery date.

FHIR Integration With Folio3 Digital Health 

Folio3 Digital Health has spent 20+ years building healthcare IT systems, including hands-on HL7 and FHIR integration work, and is the team behind Decode Health, an interface engine built for the message mapping and interface-level engineering that FHIR projects depend on 

Importance of TEFCA

If you need structured data from a handful of named EHR systems you already have a relationship with, that’s a direct integration problem. A QHIN connection adds governance overhead without adding reach, since the reach you need is already known.

If you expect to onboard an unpredictable set of organizations you have no existing relationship with, that’s the case TEFCA exists for. Connecting through a QHIN gets you standing access across the entire participant network, more than 23,000 organizations as of mid-2026, in exchange for accepting the Common Agreement’s terms and whichever exchange purpose rules apply to your use case.

Most digital health companies past their first few EHR integrations end up doing both. The direct FHIR builds happen first, against the handful of systems already named on the roadmap. TEFCA participation gets added later, once the list of organizations worth reaching stops being one you can name in advance and starts looking like real market reach.

Closing Note

TEFCA continues to change as participation expands and implementation guidance develops. QHIN rosters are updated on a rolling basis, and exchange purpose requirements have already gone through several revisions. FHIR-based exchange is still at an earlier stage than the document exchange model that shaped TEFCA’s initial rollout. Organizations should expect requirements, participation models, and technical approaches to keep changing as the framework matures. 

Frequently Asked Questions 

1. Is TEFCA a compliance requirement?

No, it’s voluntary. Participation in the Trusted Exchange Framework and Common Agreement (TEFCA) it is not a mandatory compliance requirement for all healthcare organizations. 

2. Does TEFCA replace FHIR? 

No, and that works in your favor either way: TEFCA has folded FHIR in as one of several exchange mechanisms it supports, while FHIR remains fully usable outside TEFCA too, including in direct API integrations that have nothing to do with a QHIN connection.

3. Do we need a QHIN connection to use FHIR?

 

No. Every certified EHR already exposes FHIR APIs under ONC certification rules that have nothing to do with TEFCA. A QHIN connection becomes a natural next step once you need to reach into organizations you don’t already have a direct relationship with.

4. Which USCDI version applies to TEFCA exchange?

USCDI v3, as of January 1, 2026, is the same baseline required for certified health IT generally. Earlier guidance pointed to v1, so any mapping work scoped before 2026 is worth re-checking.

5. Do we have to respond to every TEFCA query?

No. Response is mandatory only for the required-treatment code and for Individual Access Services; the general treatment code remains optional, giving you room to design an access strategy that fits your organization. Which tier applies has to be built into your own access logic; the network won’t assume it for you.

 

About the Author