Demystifying TEFCA: What a Nationwide Interoperability Framework Actually Is

Executive Summary

In healthcare IT, we talk about FHIR, HL7 v2, and C-CDAs until we’re blue in the face. But standard data formats are only half the story — and arguably the easier half.

Think of a data standard the way you’d think of a bank account number. Every account follows the same format — that part is solved and boring. But your money doesn’t actually move to a bank on the other side of the world just because both accounts follow the same numbering convention. It moves because banks have entered into correspondent banking agreements: rules about who trusts whom, who’s liable if something goes wrong, what fees apply, and what transactions are even permitted in the first place. The account number format is the data standard. The agreements that let money actually cross that wire are the framework. Health data works the same way — and that’s where TEFCA comes in.

What an Interoperability Framework Actually Is

An interoperability framework is the rulebook that lets electronic health record systems, health systems, HIEs, and health tech platforms exchange patient data securely — without every participant negotiating a custom legal agreement with every other participant. Instead of signing thousands of point-to-point contracts, an organization signs one agreement and joins a network.

Every functioning framework rests on three pillars:

• Governance & Legal Rules: Who can request data, for which permitted purposes (Treatment, Payment, Operations), and under what privacy, consent, and security obligations.
• Technical Standards & Specifications: How queries get routed and how records get located and delivered — IHE XCA/XCPD, FHIR, and REST-based protocols.
• Trust & Security Infrastructure: How participants verify one another’s identity — digital certificates, participant directories, and audit protocols that keep the network trustworthy.

Framework vs. Network: A Distinction Worth Getting Right

The two words get used almost interchangeably in casual conversation, and that’s where a lot of confusion starts. They are not the same thing, and the difference matters for anyone trying to understand who is actually accountable for what.

A framework is the rulebook. It’s the legal agreement, the permitted purposes, the technical specifications, and the trust requirements that define how exchange is allowed to happen and who is allowed to participate. A framework doesn’t move a single byte of data on its own. A network is the set of live participants operating under that rulebook. It’s the actual organizations, endpoints, and infrastructure — the EHR vendors, HISPs, hospitals, and clinics — that have signed on and are exchanging data day to day. A network is what the framework governs, not what it is.

Put another way: a framework is a constitution. A network is the country operating under it. You can describe TEFCA’s rules in exhaustive detail without a single record ever crossing a wire — the framework exists the moment the rulebook is published. The network only exists once QHINs, Participants, and Sub-participants actually connect and start exchanging under those rules.

This distinction is why TEFCA gets described both ways without contradiction. “TEFCA” the framework is the Common Agreement and its SOPs — governance, permitted purposes, technical specifications, trust requirements. “The TEFCA network” is the actual constellation of QHINs, Participants, and Sub-participants exchanging data because of it. Same initiative, two different layers — and keeping them separate is the difference between describing policy and describing operations.

TEFCA: The Federal Framework for a Nationwide Network

Under the 21st Century Cures Act, the Office of the National Coordinator for Health Information Technology (ONC) — working with the Recognized Coordinating Entity, The Sequoia Project — built TEFCA: the Trusted Exchange Framework and Common Agreement. Notice that it’s named a framework, not a network — and that’s deliberate. TEFCA itself is the Common Agreement and its SOPs; the “network of networks” is what exists underneath it, made up of the QHINs, their Participants, and Sub-participants who actually operate under TEFCA’s terms. The framework is federal policy. The network is the operational layer that policy produces.

TEFCA’s tiered architecture: QHINs route transactions to Participants, who connect Sub-participants below them.

Three elements anchor TEFCA’s structure:

• Common Agreement — a single nationwide contract setting baseline legal, security, and operational rules for every participant.
• QHINs (Qualified Health Information Networks) — the designated, high-capacity hubs responsible for routing transactions across the network.
• Standard Operating Procedures (SOPs) — the detailed rules governing technical implementation, directory management, and permitted exchange purposes.

TEFCA in Two Layers: Framework and Network, Side by Side