What this domain asks
Risk that technically available information is exchanged without appropriate authority, purpose, restriction, segmentation, patient preference, or evidence—or withheld because policy and technology cannot express a lawful path.
The domain should retain its own evidence, decision owner, materiality criteria, exception path, and consequence even when it shares organization identity, workflow, or technology with adjacent domains. Aggregation can support oversight; it should not erase the evidence behind different risks or operating outcomes.
Buyer questions
- What legal, contractual, and policy authority supports each exchange purpose?
- How are consent, revocation, proxy, and special-status cases represented?
- Can restrictions travel with data and survive transformation?
- Who decides an information-blocking exception and where is evidence retained?
- How are downstream redisclosure expectations communicated?
- How are policy changes applied without rewriting historical decisions?
Mapped workflows
SMART On FHIR Authorization
A demonstration should show the trigger, source, accountable role, decision, exception, evidence, and downstream handoff for SMART on FHIR authorization within this domain.
Direct Secure Messaging
A demonstration should show the trigger, source, accountable role, decision, exception, evidence, and downstream handoff for Direct secure messaging within this domain.
TEFCA And QHIN Connectivity
A demonstration should show the trigger, source, accountable role, decision, exception, evidence, and downstream handoff for TEFCA and QHIN connectivity within this domain.
Patient Identity And Record Matching
A demonstration should show the trigger, source, accountable role, decision, exception, evidence, and downstream handoff for patient identity and record matching within this domain.
Consent, Authorization, And Data Segmentation
A demonstration should show the trigger, source, accountable role, decision, exception, evidence, and downstream handoff for consent, authorization, and data segmentation within this domain.
Data Quality, Lineage, And Provenance
A demonstration should show the trigger, source, accountable role, decision, exception, evidence, and downstream handoff for data quality, lineage, and provenance within this domain.
Operational Monitoring And Exception Management
A demonstration should show the trigger, source, accountable role, decision, exception, evidence, and downstream handoff for operational monitoring and exception management within this domain.
Authority context
HTI-2 Final Rule
HTI-2 finalizes TEFCA-related definitions, establishes 45 CFR Part 172 provisions supporting TEFCA reliability, privacy, security, trust, and transparency, and leaves the TEFCA Manner Exception unchanged.
HTI-3 Final Rule
HTI-3 adds a definition of reproductive health care for information-blocking regulations, revises the Privacy and Infeasibility Exceptions, and creates a Protecting Care Access Exception.
HTI-5 Proposed Rule
HTI-5 proposes changes to the ONC Certification Program, information-blocking regulations, and standards-based API foundations. Its provisions remain proposals as of the seed date.
TEFCA Common Agreement v2.1
The Common Agreement establishes the legal and governance foundation for nationwide exchange among QHINs, Participants, and Subparticipants, with operating detail supplied by the QTF and standard operating procedures.
SMART App Launch 2.2.0
SMART App Launch defines discovery, authorization, scopes, token exchange, and app-launch patterns for applications accessing FHIR APIs from within or outside an EHR workflow.
Relevant operating models
- Qualified Health Information Network
- Health Information Network And Exchange Framework
- FHIR Server, API, And Compliance Platform
- Identity, Consent, And Patient-Matching Platform
- Community And Public-Health Exchange Infrastructure
Evidence boundary
Health Interoperability Review provides market, standards, policy, and operating research. It does not provide patient-specific medical advice, determine an individual's rights or coverage, certify product conformity, authorize a disclosure, or replace legal, privacy, security, clinical, or implementation review. A provider's documented capability can identify a research candidate but cannot establish buyer-specific adequacy for this domain.