TEFCA 2.0 and CMS Payer Reporting Requirements Force Interoperability Spending Shift

TEFCA Common Agreement 2.0 expands FHIR exchange requirements

The Office of the National Coordinator and The Sequoia Project released version 2.0 of the Common Agreement on October 6, 2026, adding enhanced HL7 FHIR API exchange to the Trusted Exchange Framework and Common Agreement. The update increases pressure on private exchange networks—including CommonWell, Carequality, and health information exchanges—to support nationally recognized FHIR exchange rather than document-based or proprietary interfaces.

Health systems should audit whether their HIE, EHR, payer, and application vendors support the new Common Agreement requirements and FHIR exchange profiles. The budget impact is less about new license categories than additional implementation work: API governance, identity matching, security controls, and conformance testing. The announcement confirms expanded FHIR support but provides no quantified adoption target, implementation deadline, pricing, or benchmark showing faster exchange. Treat it as a road-map signal, not proof of immediate interoperability gains.

CMS interoperability requirements create measurable payer obligations

CMS's 2026 interoperability agenda imposes concrete obligations on payers: shorter prior-authorization decision timeframes, specific reasons for denials, public reporting of prior-authorization metrics, and reporting Patient Access API usage metrics to CMS. The compliance exposure shifts from simply having an API to demonstrating that it is usable, monitored, and connected to operational decision processes.

Payers with mature FHIR API, utilization-management, and workflow platforms gain an execution advantage over organizations still using portal workflows, fax, or manual review. Payer technology budgets must now cover API observability, audit trails, denial-reason capture, data-quality controls, and integration with provider workflows. Procurement teams should demand evidence that vendors can produce CMS-required metrics—not merely expose an endpoint.

The risk is operational, not theoretical. Payers that fail to demonstrate compliance through verifiable metrics face regulatory exposure. Vendors competing in this space include payer-core platforms, prior-authorization specialists, EHR vendors, and API integration providers.

Datavant launches Provider Exchange for medical-record retrieval

Datavant announced Provider Exchange during the week of October 5–8, 2026, a digital retrieval platform designed to let provider organizations request, track, and receive medical records across the healthcare ecosystem. The product targets the operational bottleneck between a provider's request for records and receipt of records, rather than only providing a standards-based API. It is positioned around secure digital requests, tracking, and retrieval.

Provider Exchange competes with incumbent release-of-information and clinical-document-exchange services, health information exchanges, EHR-native exchange functions, and manual medical-record vendors. Datavant's broader record-exchange footprint gives it a potential distribution advantage, but the announcement discloses no customer counts, transaction volume, pricing, retrieval-time benchmarks, or interoperability coverage.

Provider groups and health systems evaluating medical-record retrieval should compare total cost per request, percentage of records retrieved electronically, turnaround time, coverage by sending organization, duplicate-record handling, and integration with their EHR or revenue-cycle workflows. This is a substantive product launch, but the public data is too thin to treat as evidence that Datavant has achieved superior retrieval speed or lower cost.

Datavant integrates ID.me for patient identity verification

Datavant also announced an integration between its Patient Request Tool and ID.me, intended to apply digital identity credentials to patient medical-record requests. The integration addresses identity verification at the point of patient record access, a major control for preventing unauthorized disclosure. It competes with health-system portal identity, knowledge-based verification, digital identity vendors, and patient-access platforms built into EHR ecosystems.

Health systems should evaluate whether stronger identity proofing reduces manual verification work without creating exclusion for patients who lack compatible digital credentials. Contracts should specify identity-assurance levels, fallback workflows, fraud rates, accessibility, and handling of sensitive records. The announcement provides no pricing, adoption figures, fraud-reduction rate, or verification-time benchmark, so the buying case remains security- and workflow-oriented rather than financially demonstrated.

What to watch

The clearest strategic shift is toward FHIR-enabled national exchange plus measurable payer API and prior-authorization obligations. TEFCA Common Agreement 2.0 affects interoperability architecture and vendor road maps, while CMS requirements create direct compliance and reporting work for payers. Datavant's launches are relevant to provider organizations that still spend heavily on manual record retrieval, but buyers should require quantified service-level data before assuming they will reduce labor or turnaround time.

Budgets should prioritize API governance and observability over endpoint creation. The federal direction is clear: interoperability compliance now means demonstrating usage, not just capability.