The American Hospital Association is calling for a delay to proposed updates to a federal health data exchange framework, warning the changes could expose hospitals to legal and privacy risks.
In an April 24 comment letter to the Sequoia Project, the group said changes to the Trusted Exchange Framework and Common Agreement’s Individual Access Services standard operating procedures do not align with existing federal privacy laws and could create “serious compliance and liability risks” for providers.
The proposed updates are designed to expand patients’ ability to access their medical records through third-party apps, a core goal of TEFCA. The AHA said it supports interoperability efforts, noting nearly 500 million records have been exchanged through the framework since its launch.
However, the association warned new workflows, particularly a proposed consent model managed by third-party apps, have not been tested and could prevent hospitals from meeting HIPAA requirements to verify the identity and authority of data requesters.
The group also raised concerns about patient-matching methods that may rely on manual data entry, increasing the risk of errors and unauthorized disclosures.
The AHA urged regulators to delay implementation until the proposals are reconciled with federal privacy rules, suggesting options such as a legal safe harbor for providers or new regulations clarifying compliance expectations.
Without those changes, the group cautioned providers may be discouraged from participating in TEFCA because of heightened legal and operational risks.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.
