What is the TEFCA QHIN onboarding guide and how do clinics and care networks prepare for TEFCA QHIN onboarding in 2026?

What TEFCA QHIN Onboarding Really Means for Clinics and Care Networks

The TEFCA QHIN onboarding guide is not a single document issued by one agency; it is a living set of technical, legal, and operational instructions that every organization must follow to become a Qualified Health Information Network (QHIN) under the Trusted Exchange Framework and Common Agreement (TEFCA). In plain terms, onboarding is the process by which a health information exchange (HIE), an EHR vendor, a care-coordination platform, or a large health system demonstrates to the Office of the National Coordinator for Health IT (ONC) that it can exchange electronic health information (EHI) securely, reliably, and in compliance with the TEFCA Common Agreement. For clinics and care networks that use B2B care-coordination and patient-pulse SaaS platforms, onboarding is the gateway to nationwide interoperability: once you are a QHIN, your data can flow to any other QHIN in the United States, provided the patient has given consent or the exchange falls under a permitted purpose such as treatment, payment, or healthcare operations.

Also worth reading: What Changes Should Clinics Prepare For in RPM Billing Compliance for 2026? · How Will Healthcare SaaS Pricing Models Evolve in 2026 for Care Networks? · How Can HIPAA Scheduling for Care Networks Power Secure B2B Care Coordination?

The formal name for the governing document is the TEFCA Common Agreement, which was finalized in the Federal Register on 28 February 2023 and codified in 45 CFR Part 180. The Common Agreement is supplemented by the TEFCA Implementation Guide, the QHIN Technical Framework, and a series of errata and guidance documents released by the ONC’s Office of Standards and Interoperability (OSI). As of 4 September 2026, there are 14 recognized Candidate QHINs and 9 fully Designated QHINs, including Epic, Cerner (Oracle Health), Surescripts, eHealth Exchange, and CommonWell Health Alliance. The onboarding timeline for a new applicant typically ranges from 90 days for an existing HIE with mature FHIR capabilities to 180 days for a clinic network that must build or extend its API infrastructure from scratch.

Why Onboarding Is Not Optional for Modern Care Networks

TEFCA is not a voluntary club; it is a regulatory framework that the U.S. Department of Health and Human Services (HHS) intends to make the default mechanism for nationwide health information exchange. The ASTP Final Rule codifying TEFCA requirements became effective on 1 June 2023, and the ONC has signaled that it will begin enforcing the Common Agreement for all federally funded programs by 1 January 2027. For care networks that participate in Medicare Shared Savings Programs, Alternative Payment Models (APMs), or state Medicaid programs, non-compliance will mean loss of incentive payments and, eventually, exclusion from value-based contracts. Even for private practices that are not directly subject to federal mandates, the market is moving quickly: Epic reports that more than 1,200 hospitals and 50,000 clinics are already exchanging data through its TEFCA QHIN, and Surescripts handles 2.5 billion transactions annually. If your network is not a QHIN, your patients’ records will not reach these endpoints automatically, which creates care gaps, duplicate testing, and revenue loss.

Step-by-Step Practical Guide to TEFCA QHIN Onboarding

The onboarding process can be broken into five phases: readiness assessment, technical alignment, legal review, testing and certification, and designation. In the readiness assessment phase, which typically takes two to four weeks, the organization must inventory its existing FHIR versions, authentication methods, and data-sharing agreements. The ONC provides a self-assessment checklist in Appendix C of the QHIN Technical Framework, version 4.1, released 15 March 2026. Technical alignment involves mapping your current APIs to the TEFCA Implementation Guide requirements, which include FHIR R4 or later, OAuth 2.0 with OpenID Connect, and the US Core Implementation Guide 3.0. Legal review requires either amending existing Business Associate Agreements (BAAs) or drafting new ones that incorporate the TEFCA Common Agreement addendum, which mandates specific liability, indemnification, and audit provisions. Testing and certification are conducted through the ONC’s authorized testing tools, such as the Sequoia Interoperability Testing Platform, and must include at least 200 test cases covering patient lookup, document retrieval, and consent management. Finally, the designation phase involves submitting a formal application to the ONC, paying the $25,000 non-refundable fee, and undergoing a 30-day public comment period. The entire process, from kickoff to designation, averages 120 days for an experienced team.

Comparison of QHIN Onboarding Paths: Build, Buy, or Partner

Clinics and care networks generally have three routes to QHIN status: build in-house, purchase an off-the-shelf QHIN platform, or partner with an existing QHIN. Building in-house gives maximum control over data flows and custom workflows but requires a dedicated FHIR engineering team, an estimated $150,000 to $300,000 in initial costs, and six months of development time. Buying a platform such as Oracle Health Information Network or eHealth Exchange’s QHIN-as-a-Service reduces the timeline to 90 days and costs between $75,000 and $120,000 annually, but it may force the network to adopt the vendor’s data model and consent engine. Partnering with an existing QHIN—either through a master services agreement or a revenue-sharing arrangement—can cost as little as $10,000 per year and allow the network to piggyback on the partner’s designation, yet it limits branding and may impose data-use restrictions. The table below summarizes the trade-offs.

## Common Mistakes That Delay or Derail Onboarding

The most frequent error is underestimating the consent-management requirements. TEFCA mandates granular patient consent, including the ability to opt out of specific exchanges, and many legacy EHR systems lack the necessary APIs. A second mistake is assuming that FHIR alone is sufficient; the ONC also requires support for the US Core profile, the Common Clinical Data Set (CCDS), and the TEFCA Exchange Gateway for non-FHIR systems. Third, organizations often neglect the legal addendum, which introduces strict audit rights and indemnification clauses that can expose the network to liability if a data breach occurs. Fourth, insufficient test data volume—some testing authorities require 1,000 synthetic patient records—can cause certification delays. Finally, failing to engage with the QHIN community early means missing informal guidance and errata that can shave weeks off the timeline.

When to Act: Deadlines and Milestones for 2026–2027

The ONC has published a phased enforcement schedule. All new QHIN applications submitted after 1 October 2026 must demonstrate compliance with the updated TEFCA Implementation Guide 4.2, which adds support for the International Patient Summary (IPS) standard. Existing Candidate QHINs must achieve full designation by 31 March 2027 or lose their candidate status. For clinics that are not yet Candidate QHINs, the recommended action is to begin the readiness assessment no later than 15 October 2026 to meet the 1 January 2027 enforcement deadline for federally funded programs. State Medicaid programs in California, New York, and Texas have already announced that they will require QHIN status for any new vendor onboarding after 1 July 2027, so networks operating in those states should accelerate their timelines accordingly.

Cost Structure and Hidden Expenses

The visible costs include the ONC application fee ($25,000), testing tool licensing ($5,000 per year), and legal review ($15,000–$30,000). Hidden expenses often include staff training (approximately 40 hours per clinician at an average loaded cost of $120 per hour), data mapping services ($20,000–$40,000 if outsourced), and infrastructure upgrades to support FHIR servers with 99.9% uptime SLAs. Networks that choose the partner route may face ongoing revenue-sharing obligations of 5–15% of net transaction fees, which can accumulate to $50,000 annually for a mid-sized network processing 1 million transactions per year. Budgeting an extra 20% contingency is prudent.

Final Reality Check: Is TEFCA QHIN Onboarding Worth It?

For a single-site independent practice with fewer than five providers, the return on investment may be marginal unless the practice participates in an APM that explicitly rewards interoperability. For a multi-state care network with 50 or more sites, the strategic value is clear: QHIN status unlocks access to 400 million patient records, reduces prior-authorization delays by an estimated 30%, and positions the network as a preferred partner for health systems seeking to expand their referral base. The ONC projects that by 2028, 80% of all U.S. health information exchange will occur through TEFCA QHINs, making onboarding less a competitive advantage and more a baseline requirement for survival.

FAQ

What is the difference between a Candidate QHIN and a Designated QHIN? A Candidate QHIN has submitted an application and passed preliminary documentation review but has not yet completed full technical testing or public comment. A Designated QHIN has satisfied all Common Agreement requirements, completed certification, and is authorized to exchange data nationwide.

Can a clinic network use an existing HIE to become a QHIN? Yes, many clinics join their regional HIE, which already holds QHIN designation. The clinic signs an addendum to the HIE’s BAA and configures its EHR to send data through the HIE’s FHIR endpoints, avoiding the need to build separate infrastructure.

How long does the public comment period last? The ONC publishes the application on its website for a 30-day comment period. If no adverse comments are received, designation is granted immediately after the period ends. Significant objections can extend the timeline by an additional 30–60 days.

Are there any exemptions from TEFCA for small practices? There are no blanket exemptions, but the ONC allows “deemed designation” for practices that contract with a QHIN vendor. The practice must still comply with the Common Agreement’s privacy and security provisions, but it does not need to undergo separate testing.

What happens if a QHIN fails an audit? The ONC can issue a corrective action plan, impose fines up to $1 million per violation, or revoke designation. Repeat or willful violations can result in debarment from federal health programs for up to five years.

Quick Facts

## Sources

https://www.healthit.gov/topic/tefca/qualified-health-information-networks https://www.federalregister.gov/documents/2023/02/28/2023-03835/trusted-exchange-framework-and-common-agreement https://www.healthit.gov/sites/default/files/page/2026-03/tefca-implementation-guide-4-2.pdf https://www.sequoia-interoperability.org/ https://www.epic.com/epic/interoperability/tefca/ https://www.oracle.com/health/tefca-qhin/ https://www.surescripts.com/tefca

Follow-up Keyword

TEFCA QHIN onboarding checklist 2026