The network scaled. Trust didn’t.

On June 26, 2026, HHS announced that the TEFCA network had exchanged more than one billion health records. Less than a year earlier, that number was 10 million.¹ The growth is real and the milestone is worth marking.

But one billion records exchanged is a statement about volume. It says almost nothing about what happens when the record arrives.

What TEFCA actually solved

TEFCA is a transport framework. Its job is to establish rules of the road so that health information networks can exchange records across organizational boundaries without bilateral agreements between every pair of participants. It works. The numbers confirm it works. More than 23,000 organizations across 100,000-plus sites are now connected.² Eleven Qualified Health Information Networks are designated. The infrastructure layer for moving health records nationwide is, in large part, built.

That is a real achievement. It took decades of false starts, competing standards, and political friction to get here. ONC, the Sequoia Project, and the organizations that built the QHIN infrastructure deserve credit for what they built.

The problem is what they were asked to build, and what they weren’t.

The gap the milestone doesn’t capture

TEFCA moves records between systems. It does not verify whose record is moving.

When a query goes across the TEFCA network, it returns a record that matches certain demographic parameters. Name, date of birth, zip code. The network trusts that the record is who it says it is because the source system says so. There is no persistent patient identifier, no cryptographically verifiable chain of custody, and no way for the receiving institution to confirm that the patient whose record just arrived is the same patient whose record it held six months ago in a different system.

The result is a patient identity problem at the moment of exchange, and it compounds at scale. Patient matching accuracy across organizations runs well below what most clinicians assume. When identity can’t be confirmed, a query either returns nothing or returns the wrong record. At a billion records exchanged per year, even small error rates produce large numbers of mismatched records moving through a clinical network that now assumes the transport problem is solved.

What the industry has started to notice

79 health systems and healthcare organizations sent a letter to the Sequoia Project this year demanding independent vetting, fraud monitoring, and stronger oversight of who can join the network.³ They cited concerns about entities connecting to TEFCA with malicious intent. They asked for a credentialing authority to centralize participant verification.

The letter is notable not because the concerns are new, but because 79 organizations signed it. These are organizations that built toward TEFCA, integrated with QHINs, and invested in interoperability infrastructure. They are not opponents of the framework. They are participants who have watched the network scale while trust between participants has not kept pace.

The Sequoia Project’s own published guidance acknowledges that TEFCA currently relies on self-attested business descriptions to determine who can join. The process, as Moxe Health described it publicly this year, runs “completely on the honor system.”⁴

In a network exchanging a billion records annually, the honor system is the identity layer.

Two problems, one is solved

There is a distinction here that gets collapsed in almost every conversation about healthcare interoperability, and the collapse leads to bad conclusions.

Interoperability infrastructure is the network of agreements, standards, and APIs that allows records to move between organizations. TEFCA is interoperability infrastructure. It is largely built. The 21st Century Cures Act is enforceable. ONC is issuing notices of nonconformity to EHR developers for information blocking. Civil monetary penalties can reach $1 million per violation.⁵ HHS has referred cases to the Office of Inspector General. The regulatory and technical infrastructure for moving records is real and operational.

Identity infrastructure is the layer that answers a different question: whose record is this, has it been tampered with, and can the receiving organization trust that it’s looking at what it thinks it’s looking at? That infrastructure is still being built. TEFCA doesn’t build it. The 21st Century Cures Act doesn’t require it. ONC enforcement doesn’t address it.

These are two separate engineering problems. Solving one does not solve the other. Most of the conversation in health IT treats them as the same problem, which means the second one keeps not getting built.

Why this matters more as volume grows

The identity gap doesn’t get smaller as record volume grows. It gets more consequential.

At 10 million records exchanged, a mismatched record is a manageable edge case. A clinician catches it. An alert fires. A duplicate record gets flagged and resolved. At a billion records exchanged, and growing, the same error rate produces errors at a scale that exceeds any manual review capacity. Records return with a patient name attached. Clinicians act on them. The network has no mechanism to tell them whether the record belongs to the patient in front of them.

The patients who bear the most risk from duplicate and mismatched records are the ones the network was built to help. Patients with common names. Patients who have moved. Patients who have received care across multiple health systems over years. Patients who lack the health literacy or administrative capacity to catch the error themselves. A peer-reviewed study published in BMJ Quality & Safety in February 2026, examining 12 U.S. health systems, found that patients with duplicate records were nearly five times more likely to die during a hospital stay.⁶ The mechanism is straightforward: care decisions made on incomplete or incorrect records.

ONC appointed an outside auditor, Alliance Global Tech, to serve as TEFCA’s reviewer and compliance monitor.⁵ The appointment was made specifically to address the scrutiny the network is now under. An auditor can review QHIN operations. An auditor cannot verify patient identity at the record level. That’s not what auditors do. That’s what identity infrastructure does.

The architecture that is missing

What TEFCA needs underneath it is a record-level identity layer. Not a national patient identifier, which has been politically blocked for decades and carries its own set of legitimate concerns. Something different: a persistent, verifiable identifier attached to the patient’s record at the point of issuance, cryptographically sealed, that travels with the record regardless of which system holds it.

The record exists. The problem is that the next system has no way to confirm it’s the same record it saw before.

A record with a persistent identifier and a verifiable chain of custody doesn’t require the receiving organization to trust the sender. It requires the receiving organization to verify the record. Those are different operations, and only one of them scales.

MEDxID™ is UMxID™’s patient identity layer. A persistent identifier attached to a cryptographically sealed patient record. TEFCA moves the record. MEDxID™ confirms whose record it is.

The network trusted the connection. The record needs an owner.

What this signals to operators and investors

For health system operators: TEFCA compliance and integration work you have done or are planning does not address the identity gap. The two investments are complementary, not substitutes. An organization that has completed TEFCA integration still has the same patient matching problem it had before integration. The records move faster. The identity problem moves with them.

For investors: the interoperability market attracted most of the capital in health IT over the past decade. The transport problem is largely solved and the major positions are held by EHR vendors, QHIN operators, and integration platforms. The identity layer is the gap those investments expose rather than fill. EHRs were not built for portability. Verifiable credential frameworks exist but don’t operate at the patient record level across multiple verticals. What is needed is an infrastructure position, not a software feature.

This is a race for infrastructure position, not features. The network already moves a billion records a year. The question of whose record is whose has not been answered.

Sources