TEFCA participation is voluntary, but it is no longer a side project. More than 23,000 organizations are now live on the network, and the question for a healthcare SaaS company has shifted from "what is it?" to "where do we plug in, and when?" A good strategy answers four things: which pathway fits your product, which exchange purposes you will support, what it costs and how long it takes, and how it supports your sales and your next raise.
This guide is written for founders, product leaders and investors in healthtech. We advise healthcare SaaS companies as a Fractional Chief Medical Officer and strategic partner, so we look at TEFCA from both the clinical and the commercial side.
TL;DR
- TEFCA is a voluntary, nationwide framework for health information exchange. No actor is required to join, but federal rules give participation a regulatory upside.
- Most SaaS companies connect as a Participant or Subparticipant through a QHIN. Becoming a QHIN yourself is a multi-year infrastructure decision.
- Your strategy should start with use cases and exchange purposes, not with the network contract.
- Budget for onboarding and annual fees, engineering time, legal review of the Terms of Participation, and security work.
- Treat TEFCA as one part of your interoperability roadmap, alongside EHR integration and your hospital customers' own requirements.
Table of Contents
- What TEFCA participation means for a SaaS company
- Is TEFCA mandatory?
- The pathways: QHIN, Participant or Subparticipant
- Build the strategy in five decisions
- What to budget: cost, time and people
- What adoption tells you
- A 90-day plan for a SaaS team
- Perspective
- Get a physician-led view of your TEFCA plan
- FAQ
- Sources
What TEFCA participation means for a SaaS company
The Trusted Exchange Framework and Common Agreement is a nationwide framework for health information sharing. ONC created it to remove barriers to electronic sharing among providers, patients, public health agencies and payers. According to ONC's TEFCA page, participation means an organization connects to a Qualified Health Information Network (QHIN) as a Participant or Subparticipant. It can then exchange health information for authorized purposes across a network of networks.
The history matters for planning. The NC HIEA TEFCA FAQs note that the 21st Century Cures Act mandated TEFCA's development in 2016, with the framework finalized in 2022. ONC reports that the first QHINs were designated in December 2023 and that data began to flow within days.
For a SaaS company, "participating" is rarely about joining a network for its own sake. It means your product can send or receive records for a specific purpose, such as a clinician pulling outside records at the point of care or a patient app retrieving a copy of their own data, without you negotiating a separate point-to-point connection with every health system.
The exchange purposes define your use cases
TEFCA authorizes specific Exchange Purposes. The eHealth Exchange TEFCA FAQs list Treatment, Individual Access Services, Payment, Health Care Operations, Public Health and Government Benefits Determination. Your strategy starts by mapping your product to this list.
A clinical decision support tool will probably center on Treatment. A patient-facing app will focus on Individual Access Services. A revenue-cycle or utilization platform will look at Payment and Health Care Operations. A population health or surveillance product will care about Public Health. If you cannot name the exchange purpose your product serves, you are not ready to choose a pathway.
Is TEFCA mandatory?
No. The HTI-2 Final Rule in the Federal Register states that participation in TEFCA is voluntary and that no actor is required to join.
That is not the whole picture. The same source explains that the HTI-1 Final Rule created the "TEFCA Manner" exception to information blocking (45 CFR 171.403). Under that exception, an actor who declines to fulfill a request for electronic health information in any manner other than through TEFCA will not be considered to be information blocking, if the conditions are met. This gives actors a regulatory reason to be on the network.
What does that mean for a SaaS company? Two things.
- Your provider customers may be subject to information blocking rules, and TEFCA gives them one defined way to respond to requests. If you help them do that, you become easier to buy.
- Federal and state programs are likely to keep looking at TEFCA as a standard route for exchange. Our HTI-1 implementation checklist walks through the related regulatory steps for health IT teams.
Voluntary does not mean optional for your roadmap. It means you get to choose the timing and the pathway deliberately.
The pathways: QHIN, Participant or Subparticipant
The TEFCA Guide from September 2024 describes the structure. Organizations can connect directly to a QHIN, or through a Participant as a Subparticipant. Participants contract with a QHIN and may provide connectivity to Subparticipants. Both agree to the same Terms of Participation and can generally exchange in the same manner.
| Pathway | What it means | Best fit | Main trade-off |
|---|---|---|---|
| QHIN | A U.S. network that completes application, onboarding and designation and signs the Common Agreement | Large networks and platforms with deep exchange infrastructure | Heavy technical, governance and financial obligations; long timeline |
| Participant | Contracts directly with a QHIN and can connect others | SaaS platforms, HIEs and vendors that want a direct relationship and may sponsor downstream connections | Your own contract, onboarding and compliance work |
| Subparticipant | Connects through a Participant | Early-stage products, or companies whose customers are already connected | Less control over terms and onboarding pace |
A related point from the NC HIEA FAQs: an individual provider would not be a direct participant. They could be connected as a Subparticipant of a health system or HIE that is already connected, or by going straight to a QHIN.
TEFCA also does not replace what you have. The same FAQs state that participating does not prevent connecting to a local HIE, and that TEFCA is meant to complement existing exchanges.
Should you ever become a QHIN?
For almost every early-stage healthcare SaaS company, no. ONC says a QHIN must be a U.S. entity and complete the application, onboarding and designation process, which typically takes about 12 months. The eCFR rules in 45 CFR Part 172 add that a QHIN must not be under Foreign Control. It must be able to exchange among more than two unaffiliated organizations, support at least one authorized Exchange Purpose, and respond to transactions from other QHINs for all authorized purposes. It must also maintain the governance, privacy, security, breach-response, financial and personnel resources for its Designated Network.
The onboarding rules are demanding. Under 45 CFR 172 Subpart C, within 30 calendar days of receiving Designation, a QHIN must show a successful transaction with every other in-production QHIN, or provide a written explanation and plan. Designation becomes final 60 days after the documentation is submitted. The RCE's QHIN onboarding procedure gives a Candidate QHIN twelve calendar months from acceptance to finish conformance and non-production partner testing, with a possible extension of up to twelve more.
That is a business of its own. Unless network operation is your core product, the Participant or Subparticipant route is the rational starting point.
Build the strategy in five decisions
We suggest working through these in order. Each decision narrows the next.
1. Pick the use case that sells
Start with the workflow a customer will pay for. Which records does your clinician or patient user need that they cannot get today? Which data does your product produce that others need? A use case tied to a buyer's pain, such as missing outside records at admission or slow prior authorization data, beats a general interoperability goal.
Our workflow-first approach to EHR integration applies directly here. Define the clinical moment first, then the data, then the connection.
2. Map your regulatory status
Are you a covered entity, a business associate, or neither? This matters because of the security obligations. Per the TEFCA Guide, Non-HIPAA Entities participating in TEFCA must comply with the HIPAA Security Rule for all Individually Identifiable Information as if it were protected health information and they were a covered entity or business associate. A consumer health app that has avoided HIPAA so far should plan for that standard if it joins.
3. Choose the pathway
For most SaaS teams, the choice is between connecting as a Participant to a QHIN and connecting as a Subparticipant through a customer or partner that is already on the network. Ask four questions.
- Do we need our own contract and relationship with a QHIN, or is access through a partner enough?
- Will we connect other organizations downstream? If yes, the Participant model fits.
- Which QHINs are best aligned with the health systems and payers we sell to?
- What are the onboarding fees, annual fees and technical requirements of each option?
4. Check technical readiness
The QHIN Technical Framework sets technical, functional, privacy and security requirements, using HL7 and IHE standards. Its exchange modalities include QHIN Message Delivery, QHIN Query and Facilitated FHIR, according to the TEFCA Guide. Your engineers should compare these to what your product supports today. Where do you stand on FHIR APIs, patient matching, consent handling and audit logging?
The October 2026 HITAC presentation from ONC lists the program's current focus areas: network governance, implementation that expands use cases and real-world exchange, infrastructure that improves security and advances FHIR exchange, and measurement of program value. Those are good signals for what your roadmap should line up with.
5. Tie it to a commercial outcome
Decide what success looks like before you sign anything. Possible measures include faster customer implementations, fewer custom interfaces, a stronger answer in hospital security and vendor reviews, or a clear item in an investor update. Our guides to hospital vendor onboarding and the health IT vendor assessment show how buyers evaluate interoperability and security claims. TEFCA participation helps most when it answers a question the buyer is already asking.
What to budget: cost, time and people
Costs depend on the pathway and the network you choose, so get written quotes. Public figures give a sense of the range. According to ASTHO's TEFCA FAQ, costs include onboarding fees and annual fees to join a QHIN as a Participant or Subparticipant, internal development costs, ongoing operations, and legal and policy costs for reviewing and signing the Terms of Participation and framework agreements.
One published example for providers: eHealth Exchange's pricing page lists a core participation fee from $5,000 for organizations with under $1 million in net patient revenue up to $41,000 for those with $5 billion or more. Its TEFCA FAQs state that its participants can access TEFCA with no additional network participation fees. That schedule applies to providers and to that network. SaaS vendors should ask any network for the schedule that applies to them.
A simple planning table:
| Budget line | What to include |
|---|---|
| Network fees | Onboarding and annual fees for your pathway |
| Engineering | Conformance with the technical framework, FHIR work, testing, patient matching |
| Security and privacy | HIPAA Security Rule alignment, audit logging, breach-response procedures |
| Legal | Review of the Terms of Participation and flow-down provisions |
| Operations | Support, monitoring, partner issue resolution, reporting |
On timing, plan in quarters, not weeks. A Participant or Subparticipant integration is far lighter than QHIN designation, but it still involves contracting, testing and customer coordination. Build in slack for legal review.
What adoption tells you
Adoption is the strongest argument for putting TEFCA on the roadmap. ONC's fact sheet, Data Liquidity, Affordability, and Access, reports roughly 10 million documents exchanged before 2025 and 464 million by the end of 2025, with more than 71,000 sites or organizations participating through 11 QHINs. The October 2026 HITAC update reports over 1.7 billion documents shared since December 2023, 23,000 organizations live and 104,000 unique connections.
For investors, those numbers show a network effect forming. For founders, they show that the question your customers ask will soon be "are you on TEFCA?" rather than "what is TEFCA?"
There is a caution in the data too. Volume is mostly document exchange so far, and ONC's own focus on expanding use cases and FHIR exchange shows the program is still maturing. Plan for the standard to evolve. The Federal Register explanation notes that ONC chose not to codify every TEFCA requirement in regulation so the framework can move quickly. Your architecture should be ready for changes.
A 90-day plan for a SaaS team
Days 1 to 30: scope.
- Name the use case and exchange purposes.
- Confirm your HIPAA status.
- Inventory current interfaces and FHIR capability.
- Ask your top five customers how they plan to use TEFCA.
Days 31 to 60: evaluate.
- Request fee schedules, terms and technical requirements from QHINs and Participants.
- Have counsel review the Terms of Participation.
- Size the engineering effort against the technical framework.
Days 61 to 90: decide and commit.
- Choose the pathway and the network.
- Add the work to your roadmap with an owner and budget.
- Update sales materials and your security questionnaire responses.
- Brief your board or investors on timing and expected value.
If your team is also weighing other integrations, our guides to Cerner integration and market readiness for FDA and payer fit can help you sequence the work.
Perspective
Most of the TEFCA conversations I have with founders start in the wrong place. They begin with the network and the contract. I would begin with the clinician.
Interoperability only matters when it changes what happens at the point of care or in the operations behind it. After more than 25 years in medicine and business, I have watched good technology stall because no one translated a standard into a workflow a physician would use. TEFCA can be that bridge, but only if the use case is clinically specific.
This is the gap a Fractional Chief Medical Officer is built to close. We help healthcare SaaS leaders decide which exchange purposes fit their product, how to explain the value to health system buyers, and how to line up product, compliance and go-to-market before they commit engineering time. We also work with investors who want a clear view of a portfolio company's interoperability plan.
If your roadmap says "join TEFCA" but no one can say which clinical problem it solves, I would welcome a conversation.
Paul Bergeron MD, MBA
Get a physician-led view of your TEFCA plan
The StartUp MD is a healthcare advisory firm. We provide Fractional Chief Medical Officer services and strategic advisory for healthcare SaaS and healthtech companies, including clinical strategy, regulatory guidance, market readiness assessment and investor support. If you are deciding on a TEFCA pathway, we can help you connect the technical choice to clinical value and to your commercial plan.
See how we work with founders, executives and boards on our services page, or start from The StartUp MD.
FAQ
Do we have to join TEFCA to sell to hospitals?
No. The HTI-2 Final Rule says participation is voluntary and no actor is required to join. But provider customers can use TEFCA as a route to respond to information requests, so a product that works with it can make their compliance planning simpler. Ask your target customers what they expect.
Should a startup join as a Participant or a Subparticipant?
It depends on whether you need your own relationship with a QHIN and whether you will connect other organizations. Participants contract with a QHIN and can provide connectivity to Subparticipants. Both follow the same Terms of Participation. Many early-stage companies start through an existing connection and move up as volume grows.
Does TEFCA replace our existing HIE or EHR connections?
No. NC HIEA's FAQs say participation does not prevent connecting to a local HIE, and TEFCA is meant to complement existing exchanges. Most companies will run TEFCA alongside other connections while they build out customer demand.
How long does it take to get connected?
It varies by pathway. QHIN designation typically takes about 12 months, according to ONC. Participant and Subparticipant onboarding is lighter, but you should plan for contracting, technical testing and security review across several months, and confirm timing with the network.
What security standard applies if we are not a HIPAA covered entity?
Per the TEFCA Guide, Non-HIPAA Entities must comply with the HIPAA Security Rule for Individually Identifiable Information as if they were a covered entity or business associate. Have your security lead and counsel review the Terms of Participation before you commit.
Sources
- TEFCA, ONC
- TEFCA FAQs, NC HIEA
- TEFCA FAQs, eHealth Exchange
- eHealth Exchange pricing for providers
- Federal Register: HTI-2 Final Rule and TEFCA
- TEFCA Guide, September 2024
- eCFR, 45 CFR Part 172
- eCFR, 45 CFR Part 172 Subpart C
- RCE SOP: QHIN Onboarding and Designation v3
- ONC fact sheet: Data Liquidity, Affordability, and Access
- HITAC TEFCA Updates presentation, October 2026
- ASTHO TEFCA FAQ