When it comes to a trusted data sharing network, a lot can get lost in the technicalities. Of course clearly defined, robust systems matter, but what 2026 has shown is that technology alone can’t create trust. What’s as important as technological capabilities is a shared understanding of who can access health data, under what circumstances, and what happens when those rules are broken.
That is where the Trusted Exchange Framework and Common Agreement™ (TEFCA®) comes in. Where participants once had to rely on individual business relationships and bilateral agreements to trust one another, the healthtech sector now operates under a common set of policies and common exchange purpose codes, which makes trust an infrastructure, rather than a series of one-off negotiations.
New participants raise new questions
Today, some hesitation and the initial withholding of trust may come during data exchange, leading to questions like: “Is this request appropriate for the stated use case? Is the requester who they claim to be, whether a healthcare organization or a patient?”
This year, those questions have grown sharper as newer participants join the network and healthcare advances present new considerations. For example, what does it mean for an AI-powered entity to query for treatment when there isn’t necessarily a human provider behind the request? How do we vet noncovered entities for treatment query, like concierge care and direct primary care (DPC) organizations that are becoming increasingly popular? Additionally, third-party apps using Individual Access Services (IAS) are growing in number and variety as are nontraditional care models.
Questioning what these new instances mean is part of the process to align infrastructure for trust. Participants deserve confidence that an incoming request from a new type of participant is tied to a legitimate exchange purpose and that the requester has the authority to use the data. As this newness continues to multiply, especially with AI, the best solution is transparency. By codifying what the communities feel confident in, TEFCA can update the infrastructure to show who is requesting data, what purpose of use they’re invoking, and what oversight applies to them.
Expansion, though, isn’t only about scale. Growing access without guardrails is exactly what erodes trust. The goal is to balance broader access with quality: the right data going to the right party at the right time. Organizations joining the network shouldn’t have to choose between its usability and its trustworthiness.
The vetting process is working and evolving to address this. Peer Qualified Health Information Networks® (QHINs™) vet one another’s participants before they are published to the directory for the treatment use case. Knowing that scrutiny happens at that level makes it easier for participants to respond to requests with confidence. Another important aspect is the requirement that participants align their privacy and security notices to TEFCA standards before they can be published in the directory as an IAS provider. Organizations can exchange data with confidence even if they’ve never worked together before.
Accountability when things go wrong
Trust also depends on knowing there are consequences for misuse and that every participant operates under the same expectations. At CommonWell, we take our stewardship role seriously. Participants look to us to establish trust in the network, and mechanisms exist to back that up. The recently published Consequences SOP, for example, sets out how QHINs go through the accountability process if they enable participants who weren’t properly vetted or who turn out to be bad actors. There are also processes to mediate vetting disagreements between peer QHINs.
QHINs play a big role in this framework, but the goal shouldn’t be to make them liable for every bad actor. Some will slip through and not always with nefarious intentions. The better approach is to encourage one another to maintain strong vetting, oversight, and governance so participants can rely on network integrity and bad actors find it harder over time to get through.
Even when a requester doesn’t fit the mold you’d expect, knowing they went through a rigorous, documented process is reassuring. Vetting is predictable and verifiable, and as things become more predictable, trust grows organically. That is why standardization matters so much.
TEFCA’s role as the market changes
We see TEFCA as the foundation of trust for the next generation of health data exchange. Today’s use cases are primarily treatment and patient access, but conversations are already underway about healthcare operations, payment, public health, research, and emerging digital services. If we keep investing in trust at the current pace, TEFCA can become an ecosystem that brings together patients, providers, payers, public health agencies, and innovators, using health information well beyond clinical care.
With CMS involved, new vetting processes in place, and growing interest from data intermediaries, payers, and others beyond traditional providers, we expect a far more diverse ecosystem, with health information used in more ways. That should accelerate nationwide exchange and, most importantly, be more valuable to end users, extending well past a patient receiving their records or a doctor gaining access to the right data when trying to deliver care.
Broader use will bring stronger security requirements and other support. But the fact that we’re making this work today gives confidence that in 2027, TEFCA will keep evolving, along with the players it brings together. Without TEFCA, we take a step backward and make trust a piecemeal process again, the opposite of what interoperability is working toward.
When everyone participates under one umbrella, we skip the burden of building trust entity by entity. And without common standards, expectations would be all over the board. You can’t force people to trust each other, but you can hold them accountable for upholding agreed-upon standards.