Written and maintained by CASRAI Editorial Board
Last updated
The eHealth Exchange is a nationwide federated health information network that connects federal healthcare agencies with community health systems, regional and state Health Information Exchanges (HIEs), dialysis networks, and ambulatory provider organizations across all 50 U.S. states. Originally created in 2009 by the Office of the National Coordinator for Health Information Technology (ONC) as the Nationwide Health Information Network (NwHIN) Exchange, the network transitioned in 2012 to public-private governance under The Sequoia Project (formerly Healtheway) and became an independent non-profit organization in 2018.
In December 2023, eHealth Exchange was designated as one of the inaugural operational Qualified Health Information Networks (QHINs) under the Trusted Exchange Framework and Common Agreement (TEFCA). Uniquely among U.S. interoperability networks, eHealth Exchange serves as the primary trust bridge linking federal health systems—including the Department of Veterans Affairs (VA), the Department of Defense (DoD), the Social Security Administration (SSA), and the Centers for Medicare & Medicaid Services (CMS)—with private-sector healthcare delivery organizations.
Origins: From the Federal NwHIN to Independent Network and TEFCA QHIN
Before the creation of the NwHIN Exchange, health systems and federal agencies attempting to share clinical records across organizational or state boundaries had to negotiate customized point-to-point legal contracts and bespoke interface engines. To establish a scalable national architecture, ONC developed three core pillars that remain foundational to the eHealth Exchange:
- A Multi-Party Legal Trust Framework: The Data Use and Reciprocal Support Agreement (DURSA), eliminating bilateral contracting between every pair of participants.
- Standards-Based Technical Specifications: Integrating the Healthcare Enterprise (IHE) web-services profiles and HL7 clinical document standards for federated patient discovery, query, and retrieve.
- Rigorous Onboarding and Conformance Testing: Mandatory digital certificate PKI validation, product conformance testing, and directory registration prior to production exchange.
While private-sector networks such as Carequality and CommonWell Health Alliance expanded nationwide treatment queries among commercial EHR vendors, eHealth Exchange maintained the central hub architecture and governance model required by federal agencies and state/regional HIEs, ultimately bridging into Carequality and becoming a designated TEFCA QHIN.
The Data Use and Reciprocal Support Agreement (DURSA)
The Data Use and Reciprocal Support Agreement (DURSA) is a comprehensive, multi-party legal contract signed by every eHealth Exchange participant. Because federal agencies are governed by the Privacy Act of 1974, the Federal Information Security Modernization Act (FISMA), and federal sovereign immunity doctrines—whereas private hospitals and HIEs are governed by HIPAA and state health privacy laws—bilateral Business Associate Agreements (BAAs) are legally incompatible at scale. The DURSA solves this governance gap through five core mechanisms:
| DURSA Governance Pillar | Legal & Operational Requirement | Impact on Federal & Private Exchange |
|---|---|---|
| Multi-Party Trust & No Bilateral BAAs | All signatories agree to bind themselves to a single common rulebook administered by the eHealth Exchange Coordinating Committee | Allows a newly onboarded health system or HIE to exchange immediately with hundreds of federal and private nodes under one contract |
| Permitted Purposes | Defines authorized exchange purposes: Treatment, Payment, limited Health Care Operations, Public Health activities, and Individual Access / patient-directed disclosures | Provides explicit machine-readable Purpose of Use (POU) SAML assertions validated on every transaction |
| Duty to Respond (Reciprocity) | Participants querying for Treatment purposes must reciprocally respond to incoming Treatment queries from other participants (subject to applicable patient consent laws) | Prevents “free-riding” where an organization queries external clinical records without sharing its own records in return |
| Autonomy & Local Consent Compliance | The disclosing participant applies its own applicable federal, state, or local patient consent rules (Opt-In, Opt-Out, or 42 CFR Part 2 substance use disorder restrictions) before releasing data | Protects institutions operating in strict opt-in states while enabling seamless exchange with opt-out jurisdictions |
| Allocation of Liability & Dispute Resolution | Establishes standardized breach notification timelines, cyber-security baselines, and structured non-judicial dispute resolution procedures | Accommodates federal statutory liability limits alongside private-sector malpractice and HIPAA compliance obligations |
Federal Agency Participation: VA (VHIE), DoD, SSA, and Public Health
A defining characteristic of the eHealth Exchange is its deep integration with federal healthcare and benefits administration programs:
1. Veterans Health Information Exchange (VHIE) and the VA/DoD Joint HIE
The Department of Veterans Affairs operates the Veterans Health Information Exchange (VHIE) (historically called the Virtual Lifetime Electronic Record [VLER] Health program) to coordinate care for veterans who receive healthcare from both VA medical facilities and private-sector community providers (such as under the VA MISSION Act of 2018). In 2020, the VA and the Department of Defense launched the Joint Health Information Exchange (JHIE), unifying VA and DoD Military Health System (MHS GENESIS) connectivity across the eHealth Exchange network.
- Clinical Data Shared via VHIE: Through the eHealth Exchange, authorized community providers and VA clinicians exchange HL7 Consolidated Clinical Document Architecture (C-CDA) summaries containing active problems, allergies, medications, immunizations, laboratory results, diagnostic procedures, vital signs, and clinical discharge notes.
- Opt-Out Consent Model: Following the passage of the VA MISSION Act of 2018 and updates to 38 U.S.C. § 7332, the VA transitioned VHIE from an explicit paper-based opt-in model to an opt-out electronic sharing model for Treatment purposes, substantially expanding longitudinal record availability for millions of veterans while allowing veterans to opt out at any time via VA Form 10-0484 or My HealtheVet.
2. Social Security Administration (SSA) Health IT Program
Each year, the Social Security Administration processes millions of claims for Social Security Disability Insurance (SSDI) and Supplemental Security Income (SSI). Utilizing the eHealth Exchange with a patient-signed HIPAA-compliant authorization (Form SSA-827), SSA’s automated system queries participating health systems and HIEs to retrieve structured C-CDA medical records in seconds, replacing manual chart requests and reducing disability determination turnaround times from weeks to days.
3. Public Health Electronic Case Reporting (eCR)
In partnership with the Centers for Disease Control and Prevention (CDC), the Council of State and Territorial Epidemiologists (CSTE), and the Association of Public Health Laboratories (APHL), the eHealth Exchange serves as a core nationwide transport infrastructure for automated Electronic Case Reporting (eCR), routing reportable disease triggers from clinical EHRs to state, local, and territorial public health agencies.
Technical Architecture: IHE Profiles, Central Hub, and HL7 FHIR
The eHealth Exchange supports both document-based healthcare interoperability and modern RESTful API workflows:
- IHE Web Services Profiles: Document query-and-retrieve transactions utilize Integrating the Healthcare Enterprise (IHE) Cross-Community Patient Discovery (XCPD, ITI-55) for demographic probabilistic patient matching, Cross-Community Access (XCA, ITI-38/ITI-39) for querying and retrieving HL7 C-CDA clinical documents, and Cross-Enterprise Document Reliable Interchange (XDR, ITI-41) for push-based document delivery, secured by mutual TLS (mTLS) and OASIS SAML 2.0 security assertions carrying the Purpose of Use.
- eHealth Exchange Hub Architecture: Rather than requiring every participant to manage hundreds of individual point-to-point network connections, participants connect once to the cloud-hosted eHealth Exchange Hub. The Hub provides centralized certificate validation, single-query broadcast routing, audit logging, and translation between legacy IHE SOAP profiles and modern APIs.
- HL7 FHIR R4 Exchange and TEFCA QHIN Connectivity: eHealth Exchange operates a Fast Healthcare Interoperability Resources (HL7 FHIR R4) directory and proxy gateway, enabling FHIR-based clinical data exchange, prior authorization automation, and cross-QHIN routing under the TEFCA Common Agreement and QHIN Technical Framework (QTF).
Frequently Asked Questions
What is the eHealth Exchange network?
The eHealth Exchange is one of the largest nationwide health information networks in the United States, connecting federal agencies and non-federal health systems, regional health information organizations (HIEs), and clinics across all 50 states. Originating in 2009 as the federal Nationwide Health Information Network (NwHIN) Exchange under the Office of the National Coordinator for Health Information Technology (ONC), it transitioned to public-private non-profit governance in 2012 and operates as an ONC-designated Qualified Health Information Network (QHIN) under TEFCA.
How do federal agencies like the VA (VHIE) and DoD use eHealth Exchange?
Federal agencies—including the Department of Veterans Affairs (VA) through the Veterans Health Information Exchange (VHIE) and the VA/DoD Joint Health Information Exchange (JHIE), the Department of Defense (DoD), the Social Security Administration (SSA), and CMS—use the eHealth Exchange as their primary nationwide interoperability gateway. Through eHealth Exchange, VA clinicians query and retrieve longitudinal C-CDA and FHIR clinical records from community care providers, while SSA automated disability determination workflows retrieve medical evidence from participating hospitals.
What is the DURSA legal agreement in eHealth Exchange?
The Data Use and Reciprocal Support Agreement (DURSA) is the comprehensive, legally binding multi-party trust agreement signed by all eHealth Exchange participants. It replaces thousands of bilateral point-to-point Business Associate Agreements (BAAs) with a uniform set of legal, privacy, security, permitted purpose, breach notification, and reciprocal duty-to-respond obligations across both federal and non-federal participants.
