The Data Layer: TEFCA, Interoperability, and Who Controls the Training Set
RADIOLOGY IN THE AGE OF AI & VLMS | ARTICLE 10 OF 14
Article 9 established what we owe our patients when AI contributes to a read: a documented workflow, a defensible audit trail, a record that proves how the tool was used and what decision was made. This article asks a different question. What do we owe ourselves, and our practices, when it comes to the data that makes these AI tools possible in the first place?
A federal interoperability framework is actively connecting imaging data across the country right now. Most radiologists and practice leaders are not paying attention to it. Which is understandable as it does not show up on the worklist. But the decisions being made inside that infrastructure will shape who controls the AI training sets that define radiology performance for the next decade. That is worth understanding.
What is TEFCA?
TEFCA stands for the Trusted Exchange Framework and Common Agreement.
It is the federal framework for standardized health data exchange across providers, payers, public health agencies, and government programs.
The mechanism that makes it work is the Qualified Health Information Network, or QHIN. A QHIN is a designated national-scale network that connects healthcare organizations under a common set of technical and legal exchange rules.
As of late 2025, eleven data exchanges have received QHIN designation, more than double the number when TEFCA went live at the end of 2023. Oracle Health’s designation in November 2025 is one example of the scale and pace of this buildout. In Oracle’s own words at the time, the network’s ability to support various data types, including X-rays and MRIs, could help fuel advanced AI capabilities. This seems like a company describing its own product.¹
TEFCA was originally designed to ensure that a patient’s records could follow them across care settings. The use case most people picture is the longitudinal clinical record: a patient seen in San Diego ends up in an emergency department in Chicago, and the ED can pull the relevant history. That is the intended purpose.
Imaging is explicitly included. DICOM files, radiology reports, imaging orders, and prior studies are all within scope of what QHINs can exchange. That is where things get more consequential for our field.
How Complete Is It Today?
The infrastructure is real and data is actively flowing, but participation is uneven. An ONC survey found that roughly 60 percent of U.S. hospitals planned to participate in TEFCA as of 2023, and that number has grown since. But by late 2025, even some large health systems had not yet committed, and an industry observer put it plainly: the sector does not have an interoperability problem, it has an adoption problem.³ The technical rails exist. Getting organizations onto them is the work still underway.
For imaging specifically, that gap matters in both directions. A practice not yet connected to a QHIN may assume the governance questions in this article are someone else’s problem for now. They are not.
The participation agreements being signed today, the data sharing terms being accepted during onboarding, establish the baseline for what flows and under what conditions when the network reaches full scale.
The time to understand those terms is before connectivity, not after.
The geography of this gap is harder to pin down with precision. Published data on regional or rural-versus-urban variation in QHIN participation is limited. The reasonable inference is that smaller practices, critical access hospitals, and independent imaging centers with fewer IT resources face steeper onboarding friction. But that is an inference, not a documented finding, and it should be treated as such.
Why Imaging Is Different
A clinical summary document has administrative and clinical value. A longitudinal imaging dataset has something more: it has training value.
A set of prior chest X-rays with associated radiology reports, outcome data, and clinical context is not just a medical record. It is a labeled dataset. The kind that took research teams years and millions of dollars to assemble a decade ago.
TEFCA-level infrastructure, if utilized in that direction, could make something resembling a national collection of labeled imaging data accessible at a scale that was not previously imaginable for commercial AI development.
This raises a question worth sitting with. When imaging data flows through a QHIN as part of a routine exchange transaction, who can use that data to train an AI model, and under what conditions?
The TEFCA Common Agreement does define permitted purposes for data exchange. Those purposes include treatment, payment, and several other use categories. The challenge is that AI model training does not map cleanly onto any of them. The framework was not written with this use case in mind, and the field has not resolved the ambiguity. This is not a scandal; it is a gap. Infrastructure tends to get built before the governance catches up. But it is a gap worth understanding, because the same practices that cannot document how AI influenced an individual read, the problem Article 9 described, are often the same ones that have not read the secondary use provisions in their HIE participation agreements. The governance attention deficit shows up at two different scales, individual read and institutional data agreement, but it is the same underlying failure mode.
To be precise about where things stand: the TEFCA FHIR roadmap is currently in Stage 3, which targets direct QHIN-to-QHIN FHIR-based exchange. That work is underway now. Stage 4, which would bring end-to-end FHIR exchange down to individual participants and subparticipants, does not yet have a confirmed timeline. The governance conversation needs to run parallel to this technical buildout, not wait for it to finish.
What Europe Built Instead
At ECR 2026 in March, a session on health data harmonization provided a comparative view that is directly relevant here. The European Health Data Space, known as EHDS, entered into force on March 26, 2025. Like TEFCA, it establishes a federated framework for cross-border health data exchange. The implementation rolls out in stages. By March 2029, the first group of priority data categories, patient summaries and ePrescriptions, becomes operational for cross-border exchange. Medical images, lab results, and hospital discharge reports are in the second group, with a target date of March 2031 for full operability across EU Member States.²
The architecture is deliberately different from TEFCA, and the difference is the important part. Under EHDS, imaging data stays at the originating institution. Researchers and developers come to the data through what are called Secure Processing Environments: controlled access points where queries can be run and models can be trained without the underlying images being moved or copied to an external party.
The data does not travel to the researcher; the researcher’s computations travel to the data.
The EUCAIM project, the EU-funded pan-European cancer imaging infrastructure, shows what this looks like in practice. It supports tiered access: catalogue browsing at one level, federated query at another, distributed model training at a third. The anonymization layer is designed to avoid what researchers call the anonymization wall, where privacy requirements produce datasets that are technically de-identified but scientifically useless. The governance is built into the architecture from the start.
On the AI training question specifically, EHDS is not ambiguous the way TEFCA is. The regulation explicitly names the training and testing of algorithms and AI systems in medical devices as an in-scope secondary use purpose. It is not a pending interpretation or an open legal question; it is written into the framework. Researchers and developers who want to use EHDS-governed data for AI model training must go through the Health Data Access Body process, comply with data permit requirements, and operate within the Secure Processing Environment architecture. The governance precedes the access.
TEFCA’s enumerated exchange purposes contain no equivalent provision. That is not a criticism of TEFCA; it reflects when each framework was built and what each legislature was thinking about at the time. But the contrast is concrete: one framework names AI training as a governed secondary use and builds the governance in from the beginning; the other does not address it. For U.S. radiologists and practice leaders, that structural difference is worth carrying in mind as both systems mature.
One credibility anchor worth noting: Adrian Brady, co-author of the ACR/ESR/RSNA multi-society statement on AI evaluation that this series has cited across multiple articles, co-chaired the EHDS session at ECR 2026. The people building governance frameworks on both sides of the Atlantic are in the same professional conversation. That convergence also showed up in the Royal College of Radiologists’ first professional-body postmarket monitoring standard, issued in March 2026, another data point in the same direction: the international regulatory trajectory is toward mandatory governance requirements, not away from them.
The Strategic Dimension
Here is the part that does not get discussed enough. Imaging data is an asset. It has always been an asset in the clinical sense: the prior study that changes the differential, the comparison that establishes chronicity, the baseline that makes surveillance meaningful. But it is now also an asset in the commercial sense, because the models that will shape AI-assisted radiology for the next decade are being trained on imaging data, and the practices generating that data are not necessarily the ones who benefit from the models trained on it.
HIE participation has generally been framed as an obligation: a regulatory requirement, a network effect, a way to serve patients. That framing is not wrong. It is just incomplete.
The practice that understands its data governance position, that knows what it is contributing to and under what terms, is in a fundamentally different position than the practice that signed a participation agreement without reading the secondary use provisions.
This is not a call to opt out of interoperability. It is a call to read what you are signing.
The Agentic Layer
Article 7 of this series examined what agentic AI systems can do inside a local clinical workflow: query PACS, cross-reference EHR history, route findings, draft notifications. The governance questions there are already substantial.
The TEFCA dimension adds a layer. An agent operating with access to QHIN-level data is not querying a local institutional dataset. It is operating within a nationally connected exchange infrastructure covering thousands of provider sites. The governance frameworks built for human clinicians exchanging records about shared patients were not designed with autonomous multi-step AI systems in mind. That is not a reason for alarm; it is a reason for governance attention. The field will need frameworks for what AI systems can do with QHIN-accessible data that go meaningfully beyond what currently exists in the Common Agreement.
These conversations are happening in Washington and in Brussels. They are worth happening in your department too.
What Is Coming Next – Article 11
Article 11 examines what happens when the AI does not know it is a radiology model, and why governance frameworks built around specialty boundaries may already be architecturally mismatched to the tools being deployed.
Most clinical AI systems are evaluated before deployment and assumed to perform the same in production. In reality, performance shifts across sites, scanners, populations, and workflows, and those shifts are rarely measured systematically.
If you are building or deploying AI in radiology, including VLM-based reporting or multi-model orchestration systems, you need a way to monitor real-world behavior continuously. This includes tracking disagreement with clinicians, identifying drift, and understanding failure modes over time.
Veriloop.health provides a vendor-agnostic observability layer for clinical AI. We sit downstream of your model and workflow, measuring performance where it matters: in production, across real cases, with real users.
This is not model evaluation. This is system monitoring.
If your practice is evaluating VLM deployment and you want to talk through what safe implementation looks like in practice, please reach out at ty@orainformatics.com
References
1 Oracle Health Secures TEFCA QHIN Designation. Healthcare Dive, November 21, 2025. https://www.healthcaredive.com/news/oracle-health-qhin-designation-tefca/806217 | Oracle Health designated a TEFCA QHIN. Healthcare IT News, December 2025. https://www.healthcareitnews.com/news/oracle-health-designated-tefca-qhin | TEFCA Final Rule: ASTP Codifies QHIN Requirements. McDermott Will & Emery, January 2025. https://www.mwe.com/insights/astp-final-rule-codifies-requirements-for-tefca-qualified-health-information-networks | TEFCA: A Framework for Public Health Interoperability. NACCHO, 2024. https://www.naccho.org/blog/articles/tefca-ver-2.1-published
2 ECR: Making Data Speak the Same Language: Harmonization and Health Data. Tschabuschnig, AuntMinnie Europe, March 19, 2026. https://www.auntminnieeurope.com/imaging-informatics/article/15819751/making-data-speak-the-same-language-harmonization-and-health-data | European Health Data Space Regulation (EU) 2025/327, entered into force March 26, 2025. Official Journal of the EU, March 5, 2025. https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en | Brady, Allen et al. Developing, Purchasing, Implementing and Monitoring AI Tools in Radiology: ACR/ESR/RSNA Multi-Society Statement. Radiology: AI, 2023. | Post-deployment monitoring and safety reporting of AI medical imaging devices in clinical practice. Royal College of Radiologists, March 2026. https://www.rcr.ac.uk/our-services/all-our-publications/clinical-radiology-publications/post-deployment-monitoring-and-safety-reporting-of-ai-medical-imaging-devices-in-clinical-practice
3 TEFCA in 2026: What QHIN Expansion Means for Digital Health Vendors and Providers. Wireless-Life Sciences Alliance, January 2026. https://wirelesslifesciences.org/2026/01/tefca-in-2026-what-qhin-expansion-means-for-digital-health-vendors-and-providers | TEFCA Health Tech Implementation Challenges. Invene, January 2026. https://www.invene.com/blog/tefca | TEFCA FHIR Roadmap Version 2. The Sequoia Project / ONC, 2024. https://www.hcinnovationgroup.com/interoperability-hie/trusted-exchange-framework-and-common-agreement-tefca/news/53083106/tefca-qhin-to-qhin-fhir-exchange-to-be-piloted-in-2025