Common Agreement for Nationwide Health Information Interoperability

Common Agreement V2 adds a number of new elements to significantly advance nationwide network-to-network interoperability. The biggest change is the adoption of Fast Healthcare Interoperability Resources (FHIR®) -based exchange, which will allow participants to leverage TEFCA governance, policy, and technical services to scale FHIR Application Programming Interface (API)-based exchange nationwide. In addition, SOPs released today introduce policies and processes to further enhance the trust model that is the central feature of TEFCA. These SOPs include policies for:

• Transitioning TEFCA governance to the permanent TEFCA Governing Council comprising QHINs^™ and Participants;
• Requiring cooperation by QHINs, Participants, and Subparticipants in investigating and responding to concerns raised by TEFCA leadership, QHINs, or Participants/Subparticipants about matters related to exchange under TEFCA;
• Reporting TEFCA security incidents to the RCE and potentially impacted QHINs, Participants, and Subparticipants;
• Specifying requirements on Individual Access Service providers for protection of privacy and security of individually identifiable information, consent from individuals about uses of their information by the IAS provider, and reporting to individuals about security
  incidents involving their information;
• Clarifying when Treatment exchange requests require response, when requests come from, among others, hospitals, ambulatory physician offices, LTPAC, pharmacies, laboratories, and individuals licensed to provide health care such as psychologists, nurses, social workers, and physical/occupational therapists;
• Catalyzing scalability of FHIR API-based exchange by supporting Facilitated FHIR transactions for providers, payers, public health, individual access, and other authorized uses, including publication of FHIR endpoints in the TEFCA Directory;
• Advancing individual access by enabling use of FHIR OAuth 2.0 capabilities that helps providers and payers meet HIPAA compliance requirements and more fully support individual access through TEFCA; and
• Allowing Participants, including care providers, payers, and public health authorities, to authorize contracted Delegates to conduct TEFCA transactions on their behalf.