TEFCA’s Qualified Health Information Networks (QHINs) have a deadline coming up fast: 5:00 p.m. Eastern on October 26, 2026. In its October 13 compliance bulletin, The Sequoia Project issued interim technical directions for Individual Access Services (IAS), which support patients’ access to their records. Sequoia, acting as TEFCA’s Recognized Coordinating Entity (RCE), warned that QHINs still out of compliance at that time may face consequences under TEFCA’s noncompliance procedures.
If your organization connects through one of these networks, this deserves a place on your calendar, too. A restriction on your QHIN could affect your access even if your organization did nothing wrong. And with federal oversight expanding, participants should be thinking about more than whether today’s connections work. They may also need to explain what happened to records exchanged months or years ago.
What Prompted the October Deadline?
The immediate issue involves technical changes under version 3.0 of the IAS Standard Operating Procedure (SOP). According to the RCE’s status update, QHINs implemented the October 1 changes differently, including how they verified IAS claims tokens. These tokens carry information used to support a patient’s identity and access request. When systems interpreted that information differently, some exchanges failed. Testing before the change had not caught all of those differences.
The good news is that, as of October 19, the RCE estimated that more than 99 percent of historical IAS exchange volume had been restored. Work to restore full connectivity was still underway. That is real progress, although it offers limited comfort to the patient whose request is still stuck.
The October 13 bulletin clarifies requirements for verified contact information and data formats. Its instructions tell QHINs to follow the interim directions beginning October 13. A QHIN that cannot comply must give the RCE an expected compliance date and daily progress updates. October 26 is the deadline after which QHINs still failing to follow those directions may face consequences.
For hospitals, HIEs, and app vendors, a failed request may trace back to a network several connections away. You may need your QHIN’s help to find and fix the problem. The patient should not need a network diagram to get a copy of their medical records.
The Consequences May Reach Beyond the QHIN
TEFCA’s Consequences for QHIN Non-Compliance SOP gives the RCE several options. These range from warnings and required fixes to closer monitoring, limits on adding participants, suspension of certain queries or exchanges, and termination. Some steps require ONC’s prior approval. The RCE is supposed to consider whether its response fits the problem, including the impact on participants and subparticipants that were not involved.
That last part matters. Your organization may have followed the rules and still lose access because of a restriction imposed further up the network. The SOP also addresses a QHIN’s failure to ensure that its participants and subparticipants meet applicable requirements. So this is something both the QHIN and the organizations connected through it need to understand.
The bulletin does not say that sanctions have already been imposed or that every missed deadline will lead to disconnection; but it does give participants a concrete reason to ask whether their connections are working, what remains unresolved, and who will handle a problem if one arises.
TEFCA Also Has an Audit Contractor
This comes against a broader push for oversight. In its June 26 announcement, HHS reported that more than one billion health records had been exchanged through TEFCA. The Office of the National Coordinator for Health Information Technology (ONC) also announced a new oversight contract and additional reviews of QHINs and their participants.
The contractor is Alliance Global Tech, Inc. (AGT), based in Columbia, Maryland. Its award announcement confirms a firm fixed price contract for TEFCA Audit, Review, and Compliance support. The base period runs from June 25, 2026, through June 24, 2027. Public procurement summaries report about $1.26 million in initial funding, with a potential total of about $5.62 million if options through June 2031 are exercised. Early reporting also described material on AGT’s website about AI-assisted screening of network participants (eek!!). But AGT’s current award page says that earlier analysis was a “mockup posted in error.” Hmmm. It also says the work was not performed under the contract or directed or approved by ONC or its contracting officer’s representative.
Notably, there does not appear to be any publicly available information expressly linking the October 13 bulletin to AGT’s work. The October bulletin is an RCE compliance action; AGT’s contract separately supports ONC’s oversight efforts. Sequoia continues in its RCE role and announced in August that ONC had renewed its contract for another option year, with a funding increase of more than 15 percent. In practical terms, ONC is funding both Sequoia’s ongoing administration of TEFCA and AGT’s separate audit and compliance support. So, participants should prepare for closer scrutiny of how they request, share, and use health records, well beyond the October 26 deadline.
Lawsuits Show Why These Issues Matter
Seems so long ago now, but the allegations in Epic Systems Corporation v. Health Gorilla, Inc. highlight the importantce of compliant use of TEFCA by its participants and subparticipants. In that January 13, 2026 complaint, Epic, OCHIN, Reid Health, Trinity Health, and UMass Memorial Health alleged that Health Gorilla (a TEFCA QHIN) and other defendants facilitated or engaged in improper access to patient information through national exchange frameworks. The alleged conduct included using a treatment purpose to obtain records for other commercial purposes, including supplying information to lawyers seeking potential claimants.
Health Gorilla has rejected those allegations, maintained that it complied with applicable requirements, and said it suspended the connections at issue and investigated. Allegations against one defendant also should not be treated as findings against every organization involved. Yet, the case raises difficult operational questions:
- What was verified before an organization granted access?
- Did its customer’s actual business match the stated exchange purpose?
- What happened when unusual requests or other warning signs appeared?
These questions closely resemble the issues a compliance review might examine, although the public record does not establish that AGT is investigating this lawsuit or any particular defendant.
The separate Particle Health v. Epic Systems litigation illustrates something completely different, which is that exposure that can arise from restricting access. In its September 5, 2025 ruling, the court in that case allowed certain antitrust and contractual-interference claims to proceed while dismissing other claims. That ruling did not establish liability, but it shows why decisions to limit connectivity require their own legal and factual support.
The challenge is to investigate credible concerns withouth cutting off lawful exchange. As we have seen, a blanket refusal to share records can create problems of its own. On the other hand, a TEFCA participant’s listing in the directory does not resolve every question about the legitimacy of its requests. The response needs to fit the evidence and the rules that apply.
Past Data Sharing May Still Come Under Scrutiny
For current and former participants, I would pay close attention to what a review of past activity could uncover. Depending on its scope and authority, an audit or investigation may examine earlier onboarding decisions, access logs, complaints, and responses to suspected misuse. HHS’s June announcement said ONC would refer potentially actionable conduct, including fraud and information blocking, to agencies such as the HHS Office for Civil Rights, HHS Office of Inspector General, and Department of Justice.
That said, reviewing past conduct is different from applying a new rule retroactively. A review needs to identify which agreement, SOP version, and legal requirements applied when the exchange occurred. Compliance dates and legal time limits matter, too. Where the language was unclear, the wording and guidance available at the time should be part of the analysis. Ambiguity should not be dismissed, but it also does not automatically excuse the conduct.
TEFCA’s noncompliance SOP allows feedback without discipline where problems reflect misunderstanding or ambiguity, and includes timing limits for certain consequences. Neither the October bulletin nor the June announcement sets a general period for reviewing past exchanges. Nor do they make the new technical directions apply to every earlier transaction. So, we should not assume that AGT has a broader mandate than the public record supports.
At the same time, fixing a process today does not necessarily resolve an earlier violation. Changing QHINs, removing a customer, or leaving a network does not erase the history of records already obtained or shared. Depending on what happened, an organization may still need to assess an incident, notify affected parties, address contractual duties, or preserve evidence. It may also need to determine what it can lawfully do with data it still holds.
The network involved matters as well. A Carequality exchange does not become a TEFCA exchange just because an organization participates in both. AGT’s contract does not, by itself, establish authority to audit every national network. Other laws and agreements may still provide grounds to review that conduct. The right starting point is the actual transaction and the rules that governed it.
What TEFCA Participants Should Be Doing Now
With October 26 approaching, Participants should start with a direct conversation with their relevant QHIN.
Are your IAS exchanges working?
What remains unresolved, and who is responsible for fixing it?
If the QHIN faces a restriction, how would that affect your services and the people trying to access their records?
I would also look at existing connections, not just new applicants. Can your organization support the exchange purposes it claims? Does it know whose behalf it is acting on? Are concerns about misuse being investigated and documented? The RCE’s Expectations for Cooperation SOP already addresses questions about exchange purposes and cooperation when objective, verifiable evidence points to inappropriate use.
Then Participants should also review the record of past decisions. Preserve relevant agreements, onboarding materials, logs, and incident communications under applicable retention rules and legal holds. If access was restricted, keep the reasons for that decision and the steps taken to restore proper access. If a review finds a possible improper disclosure, assess the duties that follow under the relevant laws and agreements. A better policy going forward is helpful, but it does not answer every question about what happened before.
Conclusion
More consistent oversight could benefit organizations that are trying to get this right. It could help identify misuse and provide a fairer way to resolve access disputes. That will depend on reviewers understanding how these networks work, matching the response to the problem, and giving organizations a chance to correct factual errors. For now, the priority is to keep lawful exchange working and resolve the remaining access problems. Participants should also be able to explain why they obtained, shared, or withheld records, including in earlier exchanges. That is a reasonable expectation for a network built on trust, provided the review is just as careful as the conduct being reviewed.