TEFCA’s October 26 compliance deadline is directed at QHINs, but organizations connected through them should be paying attention, too. A restriction further up the network could disrupt your access even if your organization followed the rules. With federal oversight expanding and data access disputes landing in court, participants may also need to explain what happened to records they exchanged long before this deadline.
Epic got GuardDog to heel. But the stipulated judgment does not close the book for healthcare providers whose patient records may have been pulled, or answer whether they have a reportable breach. With patient class actions already in play, “Epic handled it” is not an incident response plan.
Epic’s new lawsuit casts the company as the white knight protecting patient records from alleged data thieves. For a company already facing antitrust claims over its own data-access practices, that is quite a wardrobe change. But will this fight make health information exchange safer, or leave everyone else afraid to share?
On August 6, 2025, ONC unveiled the first public TEFCA Organizational Map, a tool that makes it possible to see which health systems are stepping into the national interoperability framework—and which are not. For some, this marks a milestone in transparency and progress; for others, it raises questions about strategy, governance, and whether more national data sharing is always a good thing. The uneven pace of adoption, particularly among Epic’s vast customer base, shows just how complicated the march into TEFCA has become.
Audacious Inquiry has filed a patent infringement suit against CRISP, Maryland’s state-designated HIE. At issue are core encounter notification and care coordination tools that providers nationwide rely on daily. With high-stakes infrastructure and TEFCA participation on the line, the outcome could reshape how HIEs balance public good with private innovation.
HHS has opened the door to one of the biggest questions in health information law: should the TEFCA exception to the information blocking rules stay or go? The May 16, 2025 RFI asks whether this carve-out encourages participation in TEFCA or instead creates confusion and double standards for networks like Carequality, which already impose requirements stricter than HIPAA. With comments due June 16, stakeholders have just days to weigh in on a decision that could reshape the balance between nationwide interoperability and local control.
Since TEFCA went live in December 2023, eight (8) organizations have been designated as Qualified Health Information Networks (QHINs). Each QHIN is a large information network that represents up to hundreds of HINs, health systems, public health agencies, payers, and IT vendors. Epic and Carequality recently announced that they would align their frameworks with TEFCA. TEFCA’s growth will be further supported by regulatory measures to incentivize network participation, such as the Information Blocking Rule.
Effective today, the HTI-1 Final Rule introduces a new TEFCA Manner Exception—potentially a safe harbor for HIEs and HINs under the Information Blocking Rule. But those outside TEFCA may find themselves navigating far narrower exceptions with much higher compliance risk.
