Health Information Exchange

Health information exchange refers broadly to the sharing of health data between providers, patients, and other entities involved in care. While this exchange can occur through paper records, faxes, or other non-digital means, the focus of this playbook is on the exchange of electronic health information. This section will explain the systems and processes that make it possible to share information quickly, accurately, and securely — supporting better care coordination, reducing administrative burden, and improving outcomes for patients.

How does health information exchange affect your practice?

The move from paper records to electronic health records (EHRs) has transformed how care is delivered, improving safety, efficiency, and coordination across the healthcare system. Health information exchange builds on this progress by allowing patients' health information to follow them wherever they receive care. This sharing of information helps reduce the burden on clinicians, supports more informed decision-making, and ensures patients get the right care at the right time.

When health information is exchanged appropriately, it helps reduce duplicate services, avoid errors, prevent unnecessary readmissions, and improve overall care coordination. These benefits not only enhance the patient experience but also strengthen clinicians' ability to deliver high-quality, well-informed care.

There are 3 main ways health information is exchanged:

• Directed exchange (Push) — Allows clinicians to send patient information — such as laboratory orders and results, patient referrals, or discharge summaries — directly to another care professional
• Query-based exchange (Pull) — Allows clinicians to find and/or request information on a patient from other providers; often used for unplanned care
• Consumer-mediated exchange — Allows patients to gather and manage their own health information across providers and healthcare systems

What is being done to improve health information exchange and advance interoperability?

The transition to EHRs has not always delivered the efficiency clinicians expected, and both patients and providers have faced challenges accessing and sharing information across systems. To address these issues and strengthen nationwide interoperability, Congress passed the 21st Century Cures Act of 2016 (the “Cures Act”) with bipartisan support. The law put in place a framework for advancing health information exchange and reducing barriers like information blocking, paving the way for more seamless and secure data sharing.

Specifically, the Cures Act identified the following main priorities for improved interoperability:

• Improve data sharing across disparate networks
• Reduce information blocking
• Advance a trusted exchange framework and a common agreement for exchange between health information networks (HINs) nationally
• Promote the use of application programming interfaces (APIs) to support patients' ability to have greater access to their health information through personal devices like smartphones

Together, these efforts aim to reduce clinician burden and enable a health system where information flows securely and efficiently to support coordinated, high-quality care.

What is TEFCA™?

The Trusted Exchange Framework and Common Agreement (TEFCA) was developed under a mandate of the Cures Act to simplify and strengthen the nationwide exchange of electronic health information. Before TEFCA, health information exchanges and HINs operated under varying rules, policies, and technical standards, which often made it difficult for providers and patients to access a complete picture of health information. TEFCA addresses these gaps by creating a single, standardized approach that supports secure and efficient exchange across networks nationwide.

TEFCA entities and their roles

Within TEFCA, several key entities work together to enable nationwide health information exchange:

• Office of the National Coordinator for Health Information Technology (ONC): Provides federal leadership and oversight for TEFCA's implementation and policy direction
• Recognized Coordinating Entity® (RCE®): The entity selected by ONC that enters into the Common Agreement with Qualified Health Information Networks™ (QHINs™) in order to impose, at a minimum, the requirements of the Common Agreement, including the Standard Operating Procedures and the QHIN Technical Framework (QTF), on the QHINs and administer such requirements on an ongoing basis. The RCE is a Party to the Common Agreement.
• Qualified Health Information Networks™ (QHINs™): A HIN that is a U.S. Entity that has been Designated by the RCE and is a Party to the Common Agreement countersigned by the RCE
• Participant: A U.S. Entity that has entered into the Terms of Participation (ToP) in a legally binding contract with a QHIN to use the QHIN's Designated Network Services to participate in TEFCA Exchange in compliance with the ToP
• Subparticipant: A U.S. Entity that has entered into the ToP in a legally binding contract with a Participant or another Subparticipant to use the Participant's or Subparticipant's Connectivity Services to participate in TEFCA Exchange in compliance with the ToP

TEFCA is made up of three main components:

• The Common Agreement — A legal and governance framework for secure information sharing across networks
• The Trusted Exchange Framework — The principles, standards, and specifications underlying TEFCA
• QHIN Technical Framework (QTF) — Technical specifications and requirements for QHINs to exchange data

TEFCA exchange purposes (XPs)

An exchange purpose (XP) is the reason health information is shared and defines how and why the data can be used within TEFCA. Currently, there are 6 authorized XPs, and more may be added over time.

The authorized XPs are:

• Treatment — Helps to provide, coordinate, or manage healthcare and related services for a patient by one or more healthcare providers
• Individual access services — The services provided to an Individual by a QHIN, Participant, or Subparticipant that has a direct contractual relationship with such Individual in which the QHIN, Participant, or Subparticipant, as applicable, agrees to satisfy that Individual's ability to use TEFCA Exchange to access, inspect, obtain, or transmit a copy of that Individual's Required Information
• Public health — A Request, Use, Disclosure, or Response permitted under the Health Insurance Portability and Accountability Act (HIPAA) Rules and other Applicable Law for public health activities and purposes involving a Public Health Authority
• Payment — The activities a health plan or healthcare provider undertakes to get paid or to reimburse others for healthcare, like getting premiums, determining coverage, billing, and collecting
• Healthcare operations — Helps the business, administrative, financial, legal, and quality-improvement activities that a healthcare organization carries out to run effectively and support treatment and payment
• Government benefits determination — A determination made by any agency, instrumentality, or other unit of the federal, state, local, or tribal government as to whether an Individual qualifies for government benefits for any purpose other than healthcare (e.g., Social Security disability benefits)

Looking ahead, TEFCA will continue to evolve through efforts focused on strengthening governance and building trust across networks, expanding the range of XPs and use cases, and encouraging broader participation nationwide. Future work also includes advancing the adoption of Fast Healthcare Interoperability Resources (FHIR) standards to support modern, interoperable exchange and increasing education and outreach to ensure that providers, payers, public health agencies, and patients understand and can benefit from TEFCA. For more information about ongoing implementation efforts and resources, visit the RCE website.

How do APIs support health information exchange and interoperability?

Application programming interfaces (APIs) are tools that allow different software programs to connect and share information with one another. In healthcare, APIs play a critical role in advancing interoperability, as recognized by the Cures Act, which calls for their use to improve data access and exchange. Just as APIs transformed industries like banking and travel by enabling mobile apps and online services, they are simplifying and improving the way patients and providers access health information.

APIs make it easier for patients to view, download, and share their health data, such as through smartphone apps or patient portals. They also help providers securely share information with other clinicians, reducing the burden of manual exchange and improving care coordination. Beyond treatment, APIs can support a wide range of purposes — for example, enabling clinicians to send data to public health registries or quality reporting systems. The healthcare system as a whole is moving toward exchange based on FHIR APIs, with TEFCA playing an important role in advancing FHIR APIs as the data standard to make health information exchange faster, more consistent, and easier to use across networks.

What are the different types of information exchange?

There are 3 main ways that health information is exchanged today. Each method supports secure sharing of patient data, but they differ in terms of who initiates the exchange and how the information is used. Together, these approaches make it possible for providers and patients to access and share the right information at the right time.

Directed exchange

Directed exchange allows healthcare providers to securely send patient information — such as referrals, care summaries, or test results — directly to another provider. It uses an encrypted, internet-based exchange method that functions much like secure email, ensuring that data are shared in a reliable and protected way. HIPAA provides the legal and security framework that governs directed exchange, giving providers and patients confidence that information is being shared appropriately between covered entities. Directed exchange supports coordinated care by reducing duplicate services, improving transitions between providers, and helping avoid medication errors.

Query-based exchange

Query-based exchange allows providers to look up and request patient information from other providers when it is needed, often in unplanned or urgent situations. For example, an emergency department physician can use query-based exchange to quickly access a patient's medication list or recent imaging, helping them make safer and faster treatment decisions. This approach reduces duplication of tests, improves patient safety, and ensures clinicians have a more complete view of a patient's health history when providing care.

Consumer-mediated exchange

Consumer-mediated exchange gives patients more direct control over their health information. Patients can access, aggregate, and share their records with multiple providers, helping improve care coordination. They can also use this access to check for errors in their medical history, correct billing issues, and track their own health over time. Consumer-mediated exchange supports transparency and empowers patients to play a more active role in their care.

In addition to enhancing care quality for individual patients, secure health information exchange allows providers to share patient information with public health and government agencies for activities such as reporting immunization data, supporting disease surveillance, and submitting quality measures to the Centers for Medicare & Medicaid Services. Together, these methods of health information exchange strengthen care coordination, empower patients, and support public health efforts, advancing a more connected and efficient healthcare system.

What are ADT alerts?

An admission, discharge, or transfer (ADT) alert begins with an ADT message that communicates a transition in patient care by sharing certain data — such as name, insurance, or attending physician — and noting key events, like admissions, discharges, or transfers. These messages ensure that key providers in a patient's care stay informed whenever the patient's care status changes.

How do ADT alerts work?

When a hospital system records an admission, discharge, or transfer, it generates an ADT message. That message is processed through a health information exchange system and transformed into an alert, which is then sent to the patient's primary care provider or community-based care manager. This flow of information ensures that care teams receive timely updates when a patient transitions between care settings.

ADT alerts enable care teams to act quickly during transitions of care — for example, following up after a hospital discharge or adjusting treatment plans when a patient is admitted to the hospital. By providing timely, reliable communication, ADT alerts improve post-discharge transitions, reduce avoidable readmissions, and support ongoing management of patients with chronic conditions.

A transition of care occurs whenever a patient moves from one clinician or care setting to another. This can include a primary care provider referring a patient to a specialist or a hospital discharging a patient to another care setting.

Some transitions are permanent — for example, a hospital discharge where the patient is not expected to return to that inpatient setting. Other transitions involve ongoing coordination — such as specialist referrals where the primary care provider continues to follow up with the patient after the specialist visit.

These transitions provide important opportunities for clinicians to exchange relevant patient information. Having up-to-date information available during transitions allows clinicians to reconcile medications, review clinical notes, and reduce gaps in care, improving both patient safety and continuity of care.

Health information technology (IT) standards are agreed-upon formats for representing and exchanging electronic health data. These standards ensure that information created in one health IT system can be accurately interpreted and used in another, making interoperability and seamless health information exchange possible. Without common standards, systems may struggle to share or understand information, leading to gaps in care and administrative challenges.

Standards are developed, maintained, and improved by Standards Development Organizations — member-supported organizations often accredited by the American National Standards Institute. In addition, the ONC Health IT Certification Program establishes baseline standards for health IT products, helping improve data sharing, care coordination, and patient access to health records.

One example of health IT standards is the United States Core Data for Interoperability (USCDI), which is managed by ONC. USCDI is a standardized set of data requirements for nationwide, interoperable health information exchange. These requirements include data classes, such as patient demographics, medications, and clinical notes, and specific data elements within these classes. The goal of USCDI is to establish a foundation for consistent, broader sharing of electronic health information to support patient care. Review the USCDI Fact Sheet [PDF - 329 KB] to learn more.

Types of health IT standards

Health IT standards serve different purposes depending on the type of data or exchange involved.

Four major categories are commonly used in clinical health information exchange:

• Terminology standards define the vocabulary used to represent clinical concepts. They ensure consistent meaning across systems — for example, distinguishing between weight, birth weight, and dosing weight. Terminology standards rely on standardized code sets and vocabularies such as SNOMED CT (Systematized Nomenclature of Medicine Clinical Terms), LOINC (Logical Observation Identifiers Names and Codes), and ICD (International Classification of Diseases).
• Content standards define the structure and required elements of health information so that exchanged data are complete, properly formatted, and understood the same way by different systems. For instance, a clinical summary document follows content standards that specify which data elements (e.g., medications, allergies, vital signs) must be included.
• Transport standards define how data are packaged and transmitted between systems. They address the “how” of moving information securely from one system to another — for example, through secure messaging or APIs — ensuring that different platforms can communicate reliably.
• Services standards define the infrastructure and protocols that enable data exchange functions. These include methods for securely “pushing” information to a known recipient or querying a system to retrieve specific data.

Other types of standards, such as security standards and process or quality standards, are not unique to healthcare but are also critical to maintaining trust, safeguarding patient data, and ensuring consistent performance.

By adhering to these standards, health IT systems can exchange and use health information more efficiently and accurately. This creates a foundation for interoperability, enabling care teams to access the right information at the right time, improving coordination, reducing duplication, and ultimately supporting better patient care.