Written and maintained by CASRAI Editorial Board
Last updated
What Is a Health Information Exchange (HIE)? Short Answer
Health Information Exchange (HIE) refers both to the standards-based electronic process of sharing clinical patient information across separate healthcare organizations and to the governance organization or network—historically called a Regional Health Information Organization (RHIO)—that operates the infrastructure for that exchange. As defined by the Assistant Secretary for Technology Policy / Office of the National Coordinator for Health Information Technology (ASTP/ONC), HIE enables clinicians, laboratories, public health authorities, and patients to securely access and transmit longitudinal medical data across disparate electronic health record (EHR) systems through three core modalities: directed exchange, query-based exchange, and consumer-mediated exchange.
Definition and Scope: HIE as a Process vs. HIE Organization (RHIO)
In health informatics, clinical research data management, and federal interoperability regulation, the acronym HIE carries two distinct operational meanings that must be separated when designing data governance agreements or EHR integration architectures:
- Health Information Exchange as a Process (Verb): The standards-driven electronic mobilization of clinical data—including problem lists, allergies, medication histories, laboratory results, diagnostic imaging reports, and admission-discharge-transfer (ADT) alerts—across organizational and vendor boundaries while preserving semantic meaning.
- Health Information Exchange Organization as an Entity (Noun / RHIO): A multi-stakeholder non-profit, state-designated entity, or private health information network that provides the legal trust agreement, Master Patient Index (MPI), record locator service (RLS), and technical gateway connecting hospitals, ambulatory clinics, pharmacies, and public health registries within a region or state. Early local exchange entities were established under the term Regional Health Information Organization (RHIO); today, state-level and regional networks use the terms HIE organization, RHIO, and Health Information Network (HIN) interchangeably.
Centralized, Federated, and Hybrid HIE System Architectures
HIE organizations implement one of three database topologies to manage clinical records across participating institutions:
- Centralized (Consolidated Repository) Architecture: Participating hospitals and clinics continuously transmit copies of clinical documents (such as HL7 Consolidated Clinical Document Architecture [C-CDA] summaries) and HL7 v2 messages into a single central clinical data repository operated by the HIE organization. Queries execute directly against the central database.
- Federated (Decentralized / Peer-to-Peer) Architecture: Patient data remains stored locally inside each participating hospital’s or clinic’s EHR until requested. The HIE organization maintains only a central Master Patient Index (MPI) and Record Locator Service (RLS) showing where records exist; when a clinician initiates a query, the HIE fetches the records in real time from the originating edge systems.
- Hybrid Architecture: Combines a federated query model for full clinical documents with a centralized repository for high-velocity event notifications (such as real-time ADT admit/discharge feeds, immunization registries, and syndromic surveillance).
How HIE Works in Practice: The Three Core Forms of Exchange
According to ASTP/ONC’s official guidance on HealthIT.gov, health information exchange systems support three primary clinical and patient workflows, each paired with specific transport and content standards.
| Form of Exchange (ONC Classification) | Communication Pattern | Primary Technical Standards | Typical Clinical & Research Workflow |
|---|---|---|---|
| 1. Directed Exchange | Push (Point-to-point from known sender to known recipient) | ONC Direct Standard (S/MIME encrypted SMTP with X.509 certificates), HL7 C-CDA, HL7 v2 | Sending a closed-loop specialist referral, transmitting a hospital discharge summary to a primary care physician, or pushing electronic laboratory results (ELR) |
| 2. Query-Based Exchange | Pull (On-demand discovery and retrieval across networks) | IHE Cross-Community Patient Discovery (XCPD), Cross-Community Access (XCA), HL7 FHIR APIs, US Core / USCDI | An emergency department clinician querying outside hospitals for an unconscious patient’s medication and allergy list, or retrieving prior imaging and pathology reports |
| 3. Consumer-Mediated Exchange | Patient-Controlled (Individual aggregates and shares records) | HL7 FHIR R4 Patient Access APIs, SMART on FHIR, OAuth 2.0 / OpenID Connect | A patient pulling longitudinal health records onto a smartphone application to share with a new provider or contribute to a decentralized clinical study |
How Regional HIEs (RHIOs) Differ From National Frameworks Like TEFCA and Carequality
Historically, a clinician connected to a state or regional HIE (RHIO) could query hospitals inside that state, but hit a governance and technical wall when a patient received care across state lines or in a health system participating only in a vendor-specific network. Congress addressed this fragmentation in Section 4003(b) of the 21st Century Cures Act (Pub. L. 114-255; 42 U.S.C. § 300jj-11), directing ONC to establish the Trusted Exchange Framework and Common Agreement (TEFCA).
Rather than replacing regional HIEs or private interoperability frameworks such as Carequality, TEFCA operates as a nationwide ‘network of networks’ coordinated by the Recognized Coordinating Entity (RCE, The Sequoia Project). Under TEFCA, large national networks are designated as Qualified Health Information Networks (QHINs). Regional HIEs (RHIOs) join a QHIN as a Participant or Subparticipant, allowing their member hospitals and clinics to query across the entire national TEFCA ecosystem under one standardized legal agreement and the QHIN Technical Framework (QTF).
| Governance Dimension | Regional / State HIE (RHIO) | TEFCA (Trusted Exchange Framework & Common Agreement) |
|---|---|---|
| Geographic Scope | Sub-state region, metropolitan area, or single state | Nationwide across all U.S. states and territories |
| Statutory / Policy Basis | State legislation, Medicaid HIE designations, and multi-party participation agreements | 21st Century Cures Act Section 4003(b) (42 U.S.C. § 300jj-11); ASTP/ONC & RCE governance |
| Legal Contracting Model | Local Participation Agreement and HIPAA Business Associate Agreement (BAA) with the regional HIE | Single standard Common Agreement connecting QHINs, Participants, and Subparticipants |
| Core Value Add | Local Master Patient Index curation, state public health reporting, real-time ADT alerting, and state-specific consent management | Universal cross-network connectivity across six authorized Exchange Purposes (Treatment, Payment, Health Care Operations, Public Health, Government Benefits Determination, Individual Access Services) |
Where HIE Systems Matter for Clinical Research, Public Health, and Data Governance
For clinical trialists, epidemiologists, and institutional data governance officers, HIE infrastructure intersects directly with secondary research data provisioning and regulatory compliance:
- Secondary Research Use and Data Sharing Agreements: While HIPAA permits covered entities and their HIE business associates to exchange protected health information (PHI) for Treatment, Payment, and Health Care Operations (TPO) without individual authorization (45 CFR § 164.506), extracting centralized HIE repository data for clinical research or longitudinal registries requires an IRB waiver of authorization, de-identification, or a Limited Data Set governed by a formal Data Sharing Agreement (DSA) or Data Use Agreement (DUA).
- Opt-In vs. Opt-Out State Consent Architectures: Regional HIEs enforce state-specific privacy statutes that are often stricter than federal HIPAA baselines. Some state HIEs operate under an opt-out model (records are discoverable for treatment unless the patient opts out), whereas others enforce granular opt-in or facility-level consent rules, especially for behavioral health, reproductive health, and HIV records.
- Event-Driven Clinical Trial Ascertainment: Academic medical centers increasingly link consented trial cohorts to regional HIE ADT feeds so study coordinators are alerted automatically when a trial participant presents at an unaffiliated community emergency department, substantially improving serious adverse event (SAE) capture and clinical endpoint ascertainment.
Common Misunderstandings
- Confusing an EHR with an HIE: An Electronic Health Record (EHR) is the internal clinical software used within a single healthcare organization to document care, whereas an HIE is the inter-organizational network and process that moves data between separate organizations and different EHR vendors.
- Assuming TEFCA eliminates regional HIEs: TEFCA provides nationwide cross-network routing via QHINs, but it does not replace the state-level data curation, Medicaid care management feeds, local public health reporting, or real-time ADT notification services operated by state and regional HIEs (RHIOs).
- Treating HIE treatment access as automatic research access: Clinical staff who have credentialed query access to a regional HIE for emergency or outpatient treatment may not query the HIE to screen or abstract data for a research protocol unless the HIE participation agreement and IRB protocol explicitly authorize research queries.
Frequently Asked Questions
What is a Health Information Exchange (HIE)?
Health Information Exchange (HIE) refers both to the electronic process of sharing clinical patient information securely across separate healthcare organizations using national interoperability standards, and to the organization or regional network (also called a Regional Health Information Organization, or RHIO) that governs and operates that cross-institutional data sharing.
What are the three main forms of Health Information Exchange?
ASTP/ONC defines three core forms of HIE: (1) Directed Exchange, where providers securely push clinical records, lab orders, or referrals to another known provider; (2) Query-Based Exchange, where clinicians search and pull a patient’s longitudinal records across networks during unplanned or emergency care; and (3) Consumer-Mediated Exchange, where patients aggregate and direct their own health records across providers using portals and FHIR-based applications.
How do regional HIEs (RHIOs) differ from national frameworks like TEFCA?
A regional HIE or RHIO governs clinical data sharing, patient matching, and state consent rules within a specific local or state geography. The Trusted Exchange Framework and Common Agreement (TEFCA), established under the 21st Century Cures Act, is a nationwide governance and technical framework that links Qualified Health Information Networks (QHINs) so regional HIEs and health systems can exchange data across the entire country under one Common Agreement.
Sources
- Assistant Secretary for Technology Policy / Office of the National Coordinator for Health Information Technology (ASTP/ONC). What is HIE? (Health Information Exchange). HealthIT.gov. https://www.healthit.gov/topic/health-it-and-health-information-exchange-basics/what-hie
- Assistant Secretary for Technology Policy / Office of the National Coordinator for Health Information Technology (ASTP/ONC). Trusted Exchange Framework and Common Agreement (TEFCA). HealthIT.gov. https://www.healthit.gov/topic/interoperability/policy/trusted-exchange-framework-and-common-agreement-tefca
- United States Code. 42 U.S.C. § 300jj-11 — Office of the National Coordinator for Health Information Technology: Trusted Exchange Framework and Common Agreement (21st Century Cures Act, Pub. L. 114-255, Sec. 4003(b)). https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section300jj-11&num=0&edition=prelim
