On August 3, 2026, revised TEFCA procedures took effect governing treatment requests across its nationwide health information exchange framework. The procedures address a difficult question: when should a request labeled treatment require another organization to return a patient’s records?
The answer matters because interoperability depends on information moving beyond the organization that originally collected it. But the organization holding the records often cannot directly observe the care being provided by the requester.
Refusing legitimate requests undermines care. Accepting an unchecked treatment assertion creates an opportunity for misuse. TEFCA’s policy attempts to make the distinction workable across many connected systems.
HIPAA Supplies the Permission
HIPAA generally permits a covered entity to disclose protected health information for another healthcare provider’s treatment activities without obtaining the patient’s authorization. Its definition of treatment includes care coordination, consultations, and referrals, as HHS explains.
That breadth serves a clinical purpose. A specialist, referring clinician, pharmacy, and care coordinator can need information collected elsewhere to perform different parts of a patient’s care.
HIPAA’s treatment permission does not itself require a covered entity to fulfill every request. And it does not displace other applicable restrictions on disclosure.
A federated exchange needs an implementation approach: a shared way to identify requests that participating organizations have agreed to answer, without treating a stated purpose as conclusive proof.
TEFCA Specifies When a Response Is Required
TEFCA’s Treatment procedure retains HIPAA’s treatment definition. It distinguishes T-TREAT, for which responses are encouraged, from T-TRTMNT, which requires specified network participants to respond, subject to exceptions.
The latter pathway requires eligible requesters and a documented present or planned clinical event connected to the individual’s care. It recognizes referrals and consultations, which do not require that the patient first selected or was assigned to the requester, alongside remote interactions and assigned care relationships, which generally do.
It also restricts use after a patient declines or ends a relationship, when clinical accountability ends, and for rapid successive queries without the required patient-specific care connection. Research preparation does not qualify. Repeat requests have specified allowances for additional information, corrected demographics, and technical problems.
The policy’s significance lies in connecting access to circumstances that can be explained and examined. Treatment is more than a field selected in a transaction. The requester needs a basis for using that designation for this patient and this request.
Organizational Vetting Addresses a Different Question
A companion vetting procedure establishes review before an organization is listed as eligible for the vetted exchange purpose. A sponsoring network submits information and other qualified networks have at least five business days to object. An unresolved objection goes to a caucus of those networks, which settles the question only by unanimous vote, and otherwise to ONC for decision within fifteen business days.
Objections must identify specific deficiencies, with evidence or explanations supporting the concern. Limited treatment services, a lack of physical patient interaction, an organization’s provision of both treatment and other services, and secondary use of information obtained through the framework will typically not substantiate an objection, on a list the procedure describes as not exhaustive.
That balance matters. A rule requiring a conventional office visit would exclude legitimate forms of care. A rule accepting every organization’s assertion would provide little assurance about eligibility.
Vetting the organization and justifying an individual query therefore perform separate jobs. An eligible provider can still make an improper request. A legitimate remote provider should not be excluded merely because its care looks different from an office practice.
A Shared Rule Is Not a Factual Guarantee
These procedures establish conditions for participation and exchange. They do not demonstrate that every requester follows them or that every improper request will be detected.
Their effectiveness depends on implementation: whether clinical events are actually documented, whether organizational information is accurate, and whether problems are identified and addressed. The existence of a policy cannot establish those results.
Nor does a request outside the mandatory-response pathway automatically become unlawful under HIPAA. Permission to disclose, a TEFCA obligation to respond, and separate information-blocking obligations are distinct legal questions. The absence of one does not decide the others.
These are TEFCA participation procedures, not an amendment to HIPAA imposing the same response duties on every healthcare organization.
