The Impact of TEFCA & HITRUST on Patient Privacy and Security

The Trusted Exchange Framework and Common Agreement (TEFCA) is a groundbreaking initiative within the healthcare sector, promoting integrated and secure health information exchange. This framework not only supports interoperability among Qualified Health Information Networks™ (QHINs), but also simplifies the sharing of patient data. Organizations under TEFCA must achieve HITRUST certification to uphold strict data protection standards. The partnership between TEFCA and HITRUST lays a robust foundation for health information exchange, enhancing patient privacy and security.

What is TEFCA?

TEFCA establishes a shared framework of principles, terms, and conditions to facilitate the creation of a standardized agreement. This agreement aims to facilitate the seamless exchange of electronic health information across diverse health information networks on a national scale.

Launched in December 2023, TEFCA’s primary goal is to advance the seamless flow of health information nationwide. The agreement is intended to ensure that healthcare providers, payers, and patients have secure, efficient access to health data, leading to better patient outcomes.

The Sequoia Project, a non-profit advocate for nationwide health information exchange, has been pivotal in developing TEFCA, serving as the Recognized Coordinating Entity (RCE). In this role, it’s responsible for crafting the Common Agreement and the QHIN Technical Framework, setting technical and governance requirements for Qualified Health Information Networks (QHINs) to ensure secure data exchange.

Collaborating with the Office of the National Coordinator for Health Information Technology (ONC), and stakeholders, The Sequoia Project ensures TEFCA’s visions translate into practice, enhancing healthcare delivery efficiency in the US.

What are the goals of TEFCA?

TEFCA plays a vital role in driving the US healthcare system towards efficiency and comprehensive care. The agreement aims to:

• Increase data access: Enable more secure and appropriate sharing of electronic health information to support existing user needs.
• Ensure core data availability: Guarantee a set of core data is shared across networks for treatment, individual access, public health, benefits determination, and certain payment and healthcare operations as defined by HIPAA.
• Reduce costs and improve efficiency: Minimize the need for multiple Health Information Network (HIN) memberships and legal agreements.
• Standardize privacy and security requirements: Offer a common framework for privacy and security, including standards for identity proofing and authentication, to protect patient data.

Who can participate in TEFCA?

TEFCA’s data exchange network is open to a wide range of healthcare organizations that successfully complete the comprehensive onboarding process, ultimately being designated as QHINs. These organizations include hospitals, health systems, payers, HIES, and other entities engaged in the management, exchange, or analysis of healthcare data.

To achieve QHIN status, an organization must demonstrate rigorous adherence to TEFCA’s technical, privacy, and security requirements. Additionally, these entities are mandated to maintain a commitment to interoperability, ensuring that health information can be securely shared across the care continuum to improve patient outcomes and streamline healthcare delivery.

As of February 2024, seven organizations have completed the rigorous approval process and have been designated as QHINs able to exchange health data across the nation via TEFCA:

• CommonWell Health Alliance
• eHealth Exchange
• Epic Nexus
• Health Gorilla
• Know2
• KONZA
• MedAllies

HITRUST Certification Requirements for QHINs in TEFCA

HITRUST Certification is a gold standard for compliance in the healthcare industry, providing a comprehensive security framework that aligns with existing standards and regulations, like HIPAA. As an internationally recognized benchmark for safeguarding sensitive information, HITRUST Certification demonstrates an organization’s commitment to protecting healthcare data.

As a part of TEFCA, QHINs are required to meet the rigorous data protection standards of the HITRUST CSF. Through collaboration with HITRUST, TEFCA upholds high data protection standards, acknowledging HITRUST as an effective solution for risk mitigation and compliance in healthcare.

Take the Next Step with A-LIGN

Whether you are on the path to becoming a QHIN within the TEFCA exchange or are just beginning your HITRUST compliance journey, A-LIGN can assist you with the certification process.

Working with A-LIGN offers you a high-quality and efficient audit experience, ensuring that your organization not only meets but exceeds the rigorous data protection standards required. With our expertise, your organization can confidently progress toward HITRUST Certification, paving the way for enhanced security, compliance, and trust in the rapidly evolving healthcare landscape.

For more information about achieving HITRUST Certification, contact us today.