Health Data Hangs in the Balance

TEFCA, QHINs, and the Future of Secure Exchange

Introduction

Picture the following scenario. You live in Chicago, but you’re spending the summer in Los Angeles for work. Everything is going swimmingly, until you suddenly fall ill, and find yourself hospitalized. The culprit is a flare-up of a medical condition that you’ve had for years, which you manage well with your primary care physician back home. The physician at the hospital needs your most recent labs to determine the treatment you need – but they cannot access these, because your doctor is back in Illinois. The hospital team tries to treat you to the best of their ability, but clearly, this negatively impacts your quality of care received.

Ideally, you would want a one-stop-shop that allows for secure clinical data access by any qualified individual providing you care, from any location, and at any given time. This is one of the many scenarios in which TEFCA comes into play.

TEFCA, or the Trusted Exchange Framework and Common Agreement, outlines a “common set of principles, terms, and conditions to support the development of a common agreement that paves the way for a nationwide exchange of electronic health information (EHI) across disparate health information networks.” The Office of the National Coordinator (ONC) called for the construction of TEFCA under the 21^st Century Cures Act that was passed in 2016, and the ONC officially launched the TEFCA framework on January 18^th of 2022.  

TEFCA itself can be thought of as two complimentary components: the framework, which serves as the technical piece; and the common agreement, which is the legal article that determines the ground rules for electronic health information (EHI) exchange. The Recognized Coordinating Entity (RCE) for the initiative is the Sequoia Project, which establishes the formal framework, and reviews and accepts Qualified Health Information Network (QHIN) nominations for inclusion.

QHINs are the Lynchpin in TEFCA’s Future Success

The common agreement is not a new concept, but rather an updated version of the original Data Use and Reciprocal Sharing Agreement (DURSA) released way back in 2009 under then-ONC director Rob Kolodner, as part of his effort to create a Nationwide Health Information Network (NHIN). The NHIN failed, but the DURSA lives on.

In contrast to the earlier common agreement, the QHIN is a novel structure, and yet untested. It is clear in this TEFCA architecture that the QHIN is truly the lynchpin for success in creating the new national EHI exchange network.

A Qualified Health Information Network (QHIN) is a regional organizing entity that will operate like a hub, by way of aggregating health information from multiple sources. Information sources will include public health agencies, health systems, and Health Information Exchanges (HIEs), among others Spotify promotion. This QHIN will then connect to other QHINs, and in doing so, this aggregate network will ensure data access and exchange can take place across the U.S.

QHINs must adhere to the terms of the joint agreement in order to be approved for inclusion. They must meet six exchange purposes, which are:

• Standardization
• Transparency
• Cooperation and Non- Discrimination
• Privacy, Security, and Safety
• Access
• Population-Level Data

In short, not every HIE is automatically considered an eligible QHIN. We believe that eHealth Exchange and CommonWell Health Alliance are already taking taking steps to join Health Gorilla and Epic and apply for QHIN status. There is also the possibility of some of the larger public exchanges pursuing the same, with likely candidates including Health Current based in Arizona, Great Lakes Health Connect-MiHIN, and California-based Manifest Medex, among others.

In accordance with TEFCA rules, patients will own the access to their personal health information (PHI) and have the autonomy to determine whether it may be shared or not. However, patients must take the initiative to educate themselves, because organizations may not adequately provide sufficient detail to truly educate on all relevant areas of privacy, risk from data exposure, and how opt-in/opt-out processes are exercised. If history is any gauge of the future, only the most motivated of patients and caregivers will seek this education and exercise their rights as laid out within TEFCA.

In the past, HIEs have struggled with sustainability, relying heavily on Beacon Grants and government funding. When the funding ran out was when sustainability became a frontal issue; we foresee the same challenge for TEFCA. While one benefit of becoming a QHIN is that QHINs may not administer fees to other QHINs, they can however pass them along as service fees to participants such as smaller HIEs, health systems, payers, and any others who wish to participate in the exchange.

First Cut: Entities Looking to Become a QHIN

We have heard little from the Sequoia Project directly regarding the status of any QHIN applicants. However, the market has spoken a bit more loudly and provided some signals of potentially interested groups, several of which are profiled here.

Health Gorilla is a secure health information exchange company founded in 2014. They recently announced their intent to apply for QHIN status and appear to be a strong contender. Health Gorilla already has partnerships with CommonWell Health Alliance, Carequality, and eHealth Exchange – all of whom are major players in the health information exchange arena.

One potential challenge they may face is funding shortfalls. During their start-up period, they raised only $50 million from investors; consequently, they may have difficulty sustaining profitability with the additional costs of meeting all QHIN qualification requirements.

Epic is the largest electronic health record (EHR) vendor in the U.S., with an equally large data exchange footprint that supports over 45,000 clinics, 2,000 hospitals, and over 250 million unique patients.  Most clients exchange data through their Carequality framework, which accounts for 70% of the nation’s hospitals. Epic’s goal is to aid patients in receiving informed and personalized care regardless of their choice of facility. Epic declared their intent to apply to become a QHIN in June of this year.

While Epic is arguably one of the strongest contenders to become a QHIN, they have clearly stated that they do not meet all six of the exchange purpose requirements. In their feedback on the second draft of the Qualified Health Information Technical Framework, they insist that the RCE broaden the exchange purpose scope, citing concerns that immediate support of all six requirements “will deter many healthcare organizations, payers, and other potential Participants and Sub-participants from connecting to a QHIN”. While Epic has considerable staff dedicated to software and security management, they surprisingly do not have the same for the IT infrastructure; specifically, the internal staff needed to maintain audit logging, security, and privacy, which fall to the group using the EHR, and create a potentially significant roadblock in their journey to reach QHIN status.

In 13 years, eHealth Exchange has become one of the nation’s largest health information networks, even announcing in May 2022 that the platform had processed its billionth request. Shortly after, in early June, they announced their intent to apply for QHIN status.

While eHealth Exchange has made strides in interoperability, they also do not currently meet all six exchange purposes. They also lack IT infrastructure, which has caused users to struggle with platform navigation.

CommonWell Health Alliance is a non-for-profit organization launched in 2013 that has since grown to over 27,000 provider sites.

CommonWell submitted commentary to the ONC regarding the January 2018 TEFCA draft, in which they also announced their intent to become a QHIN. An important component of TEFCA is that of collaboration amongst QHINs, to which CommonWell is already keen given their existing partnership with Health Gorilla. It should therefore not be a surprise that they assert TEFCA was designed around their business model.

As is the case for everyone else, some limitations may well block their journey to successfully obtaining QHIN status. In the initial draft feedback, CommonWell voiced concerns about technical scalability and called for the RCE to increase their leniency on assessing qualifications, stating that it would be difficult to acquire a Record Locator Service and Connectivity Broker.

Looking Forward

TEFCA may forever alter the nationwide exchange of health information. As the first entities begin to receive QHIN designation later this year, we will soon be able to see how QHINs – the lynchpin in TEFCA’s EHI exchange hopes and dreams – may succeed, or may falter. If the past is again any predictor of the future, the road is likely to be a rocky one at the early phases.

Nonetheless, we remain hopeful. TEFCA’s common agreement, combined with the technical framework outlining the structure of QHINs, may finally allow for Kolodner’s grand vision of a nationwide health information network to be realized. Such a network will add value not only for a provider treating an out-of-state patient, but also, for any patient with important PHI currently scattered across multiple practices and among different providers who is currently burdened with manual PHI aggregation. Doing so will lay the groundwork for critical improvements in public health initiatives – the potential is vast, and we are optimistic for the future.