Skip to main content
2026 Prospectus
Search
The Healthcare ExecutiveExecutive News

TEFCA tightens oversight as patient app access grows. What CIOs should do

Federal health data exchange is scaling fast, and new oversight plus revised patient-access procedures mean hospitals need clear rules for when and how they verify third-party requests for records.

3 min read
TEFCA tightens oversight as patient app access grows. What CIOs should do

Executive takeaway

TEFCA is now big enough to draw enforcement. Confirm before Aug. 3 that your verification steps for app-based record requests are documented, consistent and fast.

Article

Rapid growth, more scrutiny

On June 26, the HHS Office of the National Coordinator for Health IT said records exchanged through TEFCA, the national framework for sharing data among health information networks, grew from 10 million to more than 1 billion in under a year. Alongside that milestone, ONC awarded a contract to strengthen oversight of the network and is running added reviews of Qualified Health Information Networks and their participants.

The tone has shifted from encouragement to enforcement. ONC said it will refer potentially actionable conduct, including information blocking and fraud, to the HHS Office for Civil Rights, the Office of Inspector General and the Justice Department.

A win on verification

Days later, the Sequoia Project, which serves as TEFCA’s Recognized Coordinating Entity, published revised procedures for Individual Access Services, the channel that lets patients pull records into consumer apps. Hospitals had pushed back on an earlier draft. In April, the American Hospital Association warned that new patient-matching methods could bypass or limit provider checks and lead to wrongful disclosures, breaches and misidentified patients, and it asked for a delay.

The final version drops references to a TEFCA-specific consent workflow and the matching approaches tied to it. Importantly, providers keep the ability to verify requests to access and use data. The revised procedures take effect Aug. 3.

Questions for your team before August

  • Who handles app requests? Identify which teams receive individual access requests arriving through your network and confirm the workflow for identity checks.
  • Are verification standards written down? HIPAA already requires confirming identity and authority before releasing information. Document how those checks apply to TEFCA requests so decisions are consistent and defensible.
  • Is the information blocking risk understood? With federal referrals now on the table, delays or refusals need a documented reason that fits an exception.
  • What do your vendors and networks require? Ask your EHR vendor and network partner how they will implement the revised procedures and what logging you will receive.

Leaders should treat this as a governance issue as much as a technical one. Privacy, compliance, health information management and IT need a shared playbook, because the same request can create a breach risk if handled too loosely and a blocking claim if handled too slowly.

Archive entry for Jul 3, 2026, added Nov. 11, 2026.

Sources

Quarterly Brief

Get the Quarterly Brief by email.

A practical executive agenda for hospital and health system leaders, four times a year.

Sent by The Healthcare Executive. Unsubscribe at any time. See our Privacy Policy.