Building Trust in TEFCA: Give Users the Keys

==> Welcome to “Fun with the CMS/ASTP/ONC RFI”! Each day for 3 weeks, I’m exploring one policy recommendation from my RFI Response in a playful format.

Today’s Policy Recommendation: Empower Individuals with Transparency and Control Over TEFCA Data Sharing. See https://lnkd.in/gHVWYPpd.

Today’s Voice: Paul Graham

Most ambitious projects that involve user data get one critical thing wrong: they offer no meaningful user control, or if they offer user control at all, they treat it as a feature, not a foundation. TEFCA, the big framework for health information networks, risks the same mistake.

We’re here to talk about making sure individuals aren’t just subjects of TEFCA, but active participants with real say. This means people need to see who’s looking at their health data and have genuine power to allow or deny that access. Not just a checkbox buried in settings, but actual, meaningful control.

The core idea is simple: if you build a national network for sharing something as sensitive as health information, people need to trust it. Trust doesn’t come from assurances alone; it requires transparency and control. So, we’re saying the networks must give patients a clear, free way to see an audit log: who queried their data and when. Without it, the network effectively says, “This Exchange Forgoes Citizen Audits!”

Then, the controls. People should be able to opt-out from TEFCA. They should have an “Ask Me First” option, especially for non-treatment uses, where they get a ping and have to okay the data release. And a “freeze” button, to just stop all TEFCA queries for their data, period. These aren’t technically hard; they just require deciding they’re important.

And crucially, this can’t just be a network-level fantasy. The EHR systems where the data actually lives need to be certified to listen to these network-level preferences. If a patient says “freeze” at the QHIN, the EHR at their doctor’s office needs to honor that signal when a TEFCA query comes in.

Without these things, TEFCA will feel like something happening to patients, not for them. And things that feel that way usually don’t get adopted, or worse, get resisted.

If you want people to willingly participate in a data-sharing network, especially for health, you give them the dashboard and the steering wheel. Otherwise, they’ll rightly stay off the roads you’ve built.

=> Wrapping Up: For TEFCA to earn public trust and achieve widespread adoption, it must be designed from the ground up with robust, user-friendly mechanisms for individual transparency (knowing who accessed their data) and control (managing how it’s shared) at the network level, with corresponding obligations for participating EHRs to honor these preferences.

“What’s the single most important control feature (e.g., audit log, opt-out, ‘ask me first’) you’d want for your health data in a national network?