EHRA questions rationale of added TEFCA security protocols

While acknowledging that securing access to data is a shared goal, the HIMSS Electronic Health Record Association suggests ONC's interoperability framework does not consider existing controls, or certain business standards and workflows. The EHR Association suggests that workforce authentication requirements only be applied to the Qualified Health Information Network workforce, with special consideration given to participants and sub-participants who are not HIPAA-covered entities, in its comments to the ONC on the draught QHIN, Participant and Subparticipant Additional Requirements SOP. The Trusted Exchange Framework and Common Agreement, which were created by the enlisted Sequoia project, have been proposed requirements for QHINs, participants, and sub-participants. The Office of the National Coordinator for Health Information Technology (ONC) is accepting comments on these proposals. The EHRA advised in its letter dated January 13 that the breadth of the auditing standards and requirements for worker authentication be reduced and that it is uncertain if further requirements are necessary or beneficial. TEFCA (Trusted Exchange Framework and Common Agreement) security protocols are important in patient record access because they establish a standardized set of security measures that must be followed by all participating organizations in order to ensure the confidentiality, integrity, and availability of patient data. This includes measures such as authentication, access control, and encryption to protect patient data from unauthorized access or disclosure. Additionally, TEFCA sets guidelines for incident management and reporting, which helps to ensure that any security breaches are identified and addressed quickly. Overall, the implementation of TEFCA security protocols helps to promote trust and confidence in the electronic exchange of patient data, which is essential for effective and efficient care coordination across healthcare organizations.