AHA urges delay on TEFCA individual access SOP over patient privacy concerns

The AHA April 24 urged the Sequoia Project to delay implementation of the Trusted Exchange Framework and Common Agreement Individual Access Services Exchange Purpose Standard Operating Procedures version 3.0 until key legal and regulatory issues are resolved. The proposed IAS SOP, slated for implementation by August 2027, includes new patient-matching methodologies that bypass or limit provider verification, which the AHA argues could expose hospitals to unauthorized disclosures, data breaches and misidentification errors. 

The AHA emphasized that hospitals and health systems are already legally bound to verify identity, consent and authority before disclosing protected health information, warning that the proposed IAS SOP does not adequately account for these statutory obligations, creating significant compliance and liability risks for covered entities. To address the risks, the AHA recommended delaying the SOP and pursuing statutory or regulatory solutions, such as a provider safe harbor or clear regulatory guidance confirming compliance with IAS satisfies the Health Insurance Portability and Accountability Act verification and consent requirements.