EHR interoperability: TEFCA, information blocking, and what actually works

Picture a scene from the mid-2010s, repeated in parking lots across the country: a daughter driving her mother's CT scans across town on a compact disc, because two nearby hospitals could not send them to each other electronically. Both ran modern, certified, expensive electronic health record systems.

That scene explains the decade that followed. The United States had spent the 2010s digitizing medicine — the HITECH incentives paid hospitals and clinics tens of billions of dollars to adopt EHRs — and discovered it had purchased digital silos. The 2020s became the decade of plumbing: connecting what HITECH built, by mandate where persuasion had failed. Here is where that plumbing actually stands.

The short version

Treatment-purpose exchange now works at national scale. Patient access is legally strong and practically uneven. Research access has barely been touched. And for the first time, the rules have teeth.

Everything below is an expansion of those four sentences.

Information blocking: the default flipped

The 21st Century Cures Act of 2016 inverted the burden of proof. Practices likely to interfere with the access, exchange, or use of electronic health information became prohibited by default — for providers, for EHR developers, and for health-information networks — unless one of a short list of defined exceptions applies, covering legitimate concerns like privacy, security, and infeasibility.

Enforcement arrived in stages, but it arrived. Developers and networks now face civil penalties of up to one million dollars per violation, and disincentives for providers were finalized in 2024. The cultural effect inside health systems has been as significant as the legal one: the default question shifted from "are we allowed to share this?" to "can we justify not sharing it?" After decades in which hoarding data was a business strategy, that inversion is the single biggest change in American health-data policy.

TEFCA: a network of networks goes live

TEFCA — the Trusted Exchange Framework and Common Agreement — is the federal framework under which the big exchange networks interconnect through designated QHINs, Qualified Health Information Networks. Instead of every hospital negotiating connectivity with every other, a participant connects to one QHIN and can reach participants of all of them. The first QHINs were designated in late 2023, and more have joined since.

The honest read in 2026: TEFCA is real, growing, and young. The volume flowing through it is concentrated in treatment-purpose exchange — clinicians pulling records for patients in front of them — which is precisely the use case the networks already handled and the agreement now scales. Individual access services, which would let patients route their own records through the same rails, remain more roadmap than routine. TEFCA is the right architecture solving the easiest purpose first.

USCDI: the floor keeps rising

USCDI — the United States Core Data for Interoperability — is the federal list of data classes that certified health IT must be able to exchange. Version 1, finalized in 2020, was deliberately modest: demographics, problems, medications, labs, notes. Regular updates have expanded it since, and as of January 2026, certified systems must support version 3.

The mechanism matters more than any single version: the floor rises on a schedule, and the industry must follow. Each USCDI version becomes concrete through FHIR and the US Core profiles built on it — the layered system we unpack in FHIR R4 and US Core, explained.

Where it works and where it lags

Treatment works because every incentive finally points the same way: clinicians want the record, networks are paid to move it, and regulators punish withholding it.

Patient access is the half-kept promise. Every certified EHR must expose a FHIR API, and the HIPAA right of access has guaranteed copies for decades — yet the lived experience is app ecosystems that vary by vendor, sign-up friction, and downloads that capture only part of the chart. The practical path through it is the subject of how to download your own health data as FHIR and your right to a copy under HIPAA and GDPR.

Research is the laggard, and not by accident: it was never the design center. TEFCA's early exchange purposes do not meaningfully cover it, so data still reaches researchers the old ways — institutional contracts, de-identified data brokerage, bespoke feeds. The patient, meanwhile, remains the only integration point that sees the whole record, a burden documented in six specialists, six portals.

The patient is still the integration layer

Look again at the table and an asymmetry appears: the one party with both the legal right and the personal motive to assemble a complete record — the patient — has the weakest tooling. For someone managing a chronic condition across six specialists, that is a daily tax. It is also, quietly, the most promising opening the Cures Act created: patient-access APIs mean a patient can aggregate their own record, machine-readable, and direct it wherever they choose — including into research.

That opening is precisely where Mithras Health builds. The platform rides the rails this decade laid — patient-access FHIR APIs, US Core 6.1.0 shapes, records ingested at the patient's direction into a system of record the patient controls. From there, research access runs on consent rather than contracts: each study gets a revocable, scope-limited grant, queries return aggregates only, and every event lands on an append-only audit trail. The plumbing decade connected the institutions. The next one decides whether it connects to the people the records describe.

The compact disc on the front seat was never really a technology failure; the technology to move images existed for years. It was an incentives failure, and incentives are what the law finally changed. The last mile of interoperability is no longer between hospitals — it is between patients and the research that needs them.