TEFCA Expansion Signals Heightened Federal Scrutiny Of Health Information Sharing

Before diving into recent developments, it is helpful to distinguish between two related but distinct initiatives by the U.S. Department of Health and Human Services (HHS) Office of the National Coordinator for Health Information Technology (ONC). The Trusted Exchange Framework and Common Agreement (TEFCA) was created by HHS to establish a nationwide health information exchange framework through Qualified Health Information Networks (QHINs), allowing providers to access patient records regardless of where those records originated.¹ Participation in TEFCA is voluntary at the federal level, although individual states or payors may impose their own requirements. By contrast, information blocking prohibitions arise from the 21st Century Cures Act and apply separately, with mandatory penalties enforced by HHS and the Office of the Inspector General (OIG).² While these two areas are connected, understanding their distinct legal footings is important for healthcare providers navigating today’s interoperability landscape.

On June 26, 2026, the ONC announced that the TEFCA network has reached a major milestone: over 1 billion health records exchanged, up from just 10 million less than one year ago.³ Health Secretary Robert F. Kennedy, Jr. emphasized that “[a]ccess to your own health records is a fundamental right,” and the administration is strengthening interoperability measures to put patients in control of their health information.⁴

The expansion comes with a clear warning from federal regulators: Information blocking enforcement is escalating.⁵ Chris Klomp, HHS chief counselor, stated the agency is “fully committed to using every appropriate regulatory and policy tool available to root out information blocking and protect patients’ right to access their own health data.”⁶ Civil penalties through the OIG can reach up to $1 million per violation, and ONC can revoke electronic health record (her) certification.⁷ Fraud and abuse on the network will be referred for investigation.⁸

Dr. Thomas Keane, MD, MBA, the ONC national coordinator, made clear that “[a]s ONC identifies any behaviors on the network that are potentially civilly or criminally actionable, including information blocking and fraud, we will refer them to the appropriate Executive Branch agencies for investigation, including the HHS Office for Civil Rights, HHS Office of Inspector General, and the Department of Justice.”⁹ HHS Office for Civil Rights (OCR) Director Paula M. Stannard added that “[t]rust in those principles is foundational – and nonnegotiable. Individuals who believe that their right to access their health information has been denied or that its security has been violated can file a complaint with OCR.”¹⁰

To support this growth and oversight, ONC has awarded a contract to Alliance Global Tech (AGT) to serve as TEFCA’s new auditor, reviewer and compliance monitor.¹¹ While this choice has drawn some industry commentary, given AGT’s limited health IT background, proponents note that selecting an outsider may help ensure neutrality in an environment where major industry players are already entangled in ongoing disputes.¹²

This auditor appointment is not occurring in a vacuum. Growing information blocking enforcement, backed by OIG penalties¹³ and ONC certification authority, has intensified scrutiny of the network. A letter from more than 75 health systems demanded independent vetting and fraud monitoring, and industry participants have called for a federally overseen credentialing authority to centralize participant oversight.¹⁴

Practical Takeaways for Healthcare Providers

For healthcare organizations, there are several practical steps to consider:

• Review Data Sharing Practices. TEFCA is expanding rapidly and a new auditor is in place. Compliance with information blocking rules is under increased scrutiny. Ensure you have clear policies governing how and when patient data is shared.
• Revisit Business Associate Agreements. If you participate in health information exchange networks, confirm your BAAs are current and compliant.
• Document Patient Access Responses. Patients who believe their access rights have been denied can file OCR complaints. Ensure your processes are well-documented and responses are timely.
• Secure Data Transmissions. Ensure all patient data transmitted electronically is properly encrypted and consider password-protecting sensitive attachments with separate password delivery.
• Expect Increased Scrutiny. With a new federal auditor tasked with reviewing QHIN operations, network participants should anticipate greater oversight.

Footnotes

1. An introduction to TEFCA. (n.d.-a). https://www.healthit.gov/wp-content/uploads/2024/10/TEFCA-Overview-DataSheet_508.pdf

2. Information blocking - onc - office of the National Coordinator for Health Information Technology. (n.d.-c). https://healthit.gov/information-blocking/

3. HHS Press Release, “HHS Expands Secure Access to Health Records Through the TEFCA® Network, Announces Milestone of One Billion Health Records Exchanged” (June 26, 2026). https://www.hhs.gov/press-room/onc-strengthens-tefca-one-billion-health-records-exchanged.html

4. Id.

5. Id.

6. Id.

7. Enforcement alert - information blocking. (n.d.-a). https://healthit.gov/information-blocking/enforcement-alert/

8. HHS Press Release, supra note 1.

9. Id.

10. Id.

11. AGT Awarded HHS/ONC TEFCA ARC Support Contract. Alliance Global Tech IT Consulting and Solutions. (n.d.). https://agtbi.com/tefca-arc-contract-award/

12. Brendan Keeler, “June Monthly Review: The Unusual Suspect,” Health API Guy (July 1, 2026). https://healthapiguy.substack.com/p/june-monthly-review-the-unusual-suspect

13. Enforcement alert - information blocking. (n.d.-a). https://healthit.gov/information-blocking/enforcement-alert/

14. More than 75 health systems call for stepped-up oversight of patient data sharing. (n.d.-e). https://www.fiercehealthcare.com/health-tech/over-70-health-systems-call-stepped-oversight-patient-data-sharing