I want to warn you that September could be rocky for Carequality participants. The scope of changes happening could impact network-based data exchange due to potential unintended consequences. Being aware and prepared is the key!

If you’re using healthcare software that connects to national networks, are a Carequality Implementer, or connected with one, this Delegation of Authority policy change may affect you, whether you realize it or not. The new Delegation of Authority policy became effective May 12, 2025, but the final technical migration is planned for September 15-21.  Everyone in our community should be aware of this major change.

What Actually Changed (and Why You Should Care)

The old “on behalf of” Carequality participant entries have been the most difficult to manage, understand, and trust across the network. This made them a high priority for Carequality to address, particularly as the organization works to align with TEFCA to further enhance trust in the network.

The dispute between two Carequality Implementers last year encouraged Carequality to act. When major players start reducing data access over trust concerns, it affects patient care across the entire network that connects over 600,000 care providers and supports the exchange of 940+ million documents monthly. While that dispute was resolved within the network itself, it highlighted the need to more closely align with TEFCA policies, which were created more recently, and had the advantage of incorporating “lessons learned”. 

The old “on behalf of” – also known as “OBO” entries – were designed to address scenarios where providers were using innovative new tools to optimize clinical workflows, and that sit “next to” their existing EHRs. These tools provide enhanced ways of retrieving, organizing, and leveraging clinical history information, but many do not add “new” clinical data beyond what the EHR already makes available. The prior “on behalf of” use case was therefore used when the provider’s clinical data was solely available via their EHR, which was also connected to the Carequality network. The OBO entries were used only for initiating queries, with a pointer to the “responding” EMR for that particular provider group. 

TEFCA determined that to improve transparency and reduce potential misuse of this use case, a broader definition and more rigorous process of review was needed.  This became the Delegate of Authority Policy.

A “Delegate” is an entity or health tech that makes queries on behalf of an existing provider organization. Consider this scenario: a health system uses Epic as their main EMR, but also employs a specialized AI tool for its oncology group to improve patient care delivery. Providers could use either system to query the network, but there are advantages to query via the specialized AI tool. The delegate is this secondary system – the AI tool. 

A critical requirement under the Delegate policy is that the provider group/health system (“Principal”) must already be participating in exchange through their primary EMR. If an organization is not participating with Carequality through their primary EMR, but is through a secondary piece of software that otherwise meets all network requirements, including reciprocity (ability to share clinical data back) no delegate relationship exists – the secondary software system simply gets onboarded as a normal network participant. 

Under the TEFCA Delegate of Authority policy, the Principal must directly “attest” and communicate Delegate relationships to their primary EHR (Responder) via a Delegate Notice.

Another big change under TEFCA’s Delegate of Authority policy (SOP), is that the Delegate MUST share data back to the network (reciprocity) unless the Principal attests that the Delegate is not adding any net new clinical data, or if it is, that data is made available via the Principal’s Primary EMR (Responder). 

Effective May 12th, 2025, Carequality has now aligned with TEFCA’s Delegate of Authority Policy, and the clock has started on an implementation window that currently runs from May through mid-September. 

What you need to do now:

• Provider Groups / Health systems (“Principals”) should be sure they understand the new policy language and how it might impact them.
• Carequality Implementers representing Delegates should have their new provider group clients (“Principals”) using the new Delegate Notice Process, effective May 12th, 2025.
• Carequality Implementers with existing Delegate entries must identify all existing Delegates within the Carequality Directory Listings by mid-July and begin getting Delegation Notices submitted to the Principal’s Implementer as soon as possible, but no later than Mid-August.
• Carequality Responders need to have set up Delegation Notice review processes that meet the turnaround times required by the new policy.
• All Implementers must review and make plans to support the required technical requirements. The testing window starts in mid-July, with mandatory testing requirements beginning mid-August, with a planned go-live in mid-September.

The Business Process That’s Creating Challenges

The operational complexity scales with organizational size. Independent practices using ambulatory EMRs like NextGen or eCW will likely find this process relatively straightforward. However, Health Tech vendors selling into large health systems need to engage the right stakeholders early in the Delegation Notice submission process.

The Delegation Notice – a standardized form provided in the policy – must be completed and signed by someone with recognized signing authority. The Principal’s Implementer must be able to verify this authority. If a Principal’s Implementer (like Epic) receives a Delegation Notice signed by someone they cannot identify or verify, they will reject the submission until it’s signed with the correct signing authority.

For example, if an office manager from a small practice within a larger Health System signs the Delegation Notice, an EMR will likely require verification from someone who owns the EMR relationship at the health system level. Large health systems typically have dedicated interoperability teams for this purpose. These teams can assess the request, validate that it makes sense operationally, and provide the appropriate signatures before submitting to the Principal’s Implementer.

Smaller organizations with fewer organizational layers will likely find this process easier, as they are probably closer to the decision-making related to the Delegate system.

What you need to do now:

• Timing: The new Delegation of Authority business process is effective NOW (since May 12th, 2025)!
• Providers (Principals): Identify individuals at your respective organizations who have signing authority that primary EMR vendors (responders) will recognize.
• Implementers: Ensure all relevant parties are included in email communications between Principals and their responding Implementers.
• When launching new technology initiatives, if a new Delegate relationship is being created, start the business process early. Don’t wait until the “go-live” to tackle this important step.

September’s Technical Migration – Managing the Risks

This represents the first major implementer-to-implementer testing event across the entire network since Zen joined Carequality. Testing groups include 6 to 8 implementers each, with approximately one month to complete mandatory testing. Following Carequality Steering Committee approval, September 15-21 has currently been designated as the delegation of authority entry migration week.

The scope is substantial: every existing Directory entry meeting the Delegate definition must be updated by both responding and initiating implementers, as the network reverses the pointers in the Carequality Directory. As currently planned, every delegate entry requires modification within that one-week timeframe.

Despite the challenges, this testing phase offers unexpected benefits. We anticipate discovering issues unrelated to Delegation of Authority that will improve overall Carequality network exchange. This Implementer to Implementer peer testing that will occur in August is a chance to uncover other technical issues that may be impacting the success rates of queries.  In fact, I pretty much guarantee that we will uncover and address unrelated issues. At Zen, when helping customers understand specific endpoint connectivity issues, we regularly identify implementer-level problems that can simply be code drift that has “broken” key messaging requirements.  We expect that some of these broader problems between Implementers will be exposed and can be addressed, improving the overall reliability of exchanging data across Carequality.

What you need to do now:

• If you’re an Implementer who is currently using Zen’s Stargate gateway and hasn’t received testing communications from Carequality, contact me to explore whether you can be included under Zen’s testing umbrella.
• All Carequality participants should plan for potential connectivity issues in September during the migration process – be prepared to use backup communication methods if needed. We do not expect widespread impacts, but with many Implementers needing to perform system updates within a tight time frame to support the new technical requirements, it’s possible for issues to arise, so be prepared!
• Monitor timeline updates closely – Zen will provide updates at every Office Hours session during the Implementation Window this summer.

Building a Scalable Community Process

We have a collective responsibility to implement a more transparent and consistent process for supporting Delegate use cases in a scalable manner across our entire community. The prescriptiveness that TEFCA brings represents an improvement over the less structured requirements of the past. Having standardized forms and clear processes is significantly better than ambiguous guidance. The Implementer Community continues to engage with one another to fill in some operational gaps we see, and hopefully, this process gets easier as we get closer to the mid-Sept full production “live” date for Delegation of Authority.

Your Next Steps

This change was inevitable following the trust issues exposed by last year’s dispute. While the process is complex and the September Delegate of Authority entry migration may present challenges, having clear guidance on how Delegates are managed provides significant improvement over the unclear situation that contributed to trust concerns.

Your action items depend on your specific role:

If you’re onboarding new clients as an Implementer: Master this process early while the time window remains manageable. Some implementers don’t yet have extensive participants, providing an opportunity to establish correct processes from the beginning. Large Implementers are facing a big effort, and are actively working on ways to scale up the Delegate processes.

If you have existing delegate relationships: Collaborate with your customer experience team to identify entries meeting the delegate definition. By July 14th, implementers must notify Carequality of all existing delegate entries. And by mid August, Delegate Implementers must have submitted Delegation Notices to Principal’s EMR Implementer (primary system) for all existing qualifying Directory entries.

If you’re a large health system: Engage your interoperability team early. The delegation notice signatory must have authority that your EMR vendor will recognize.

If you have questions: Contact your Implementer or join my monthly office hours. Remember that this process focuses initially on the treatment use case. This process does not apply to the Individual Access Services use case under TEFCA. Confused about the various exchange purposes?  Reach out to us at Info@zenhealthcareit.com to join one of our upcoming Office hours sessions.

The reality is that we’re navigating a major industry shift. Epic and Carequality’s announcements to align with TEFCA signal a “tectonic shift” in the interoperability landscape toward federal oversight, and this Delegation of Authority policy change represents progress toward aligning Carequality with federal TEFCA requirements.

There is a risk that these timelines may shift if implementers encounter difficulties with required changes. Currently, the target is to be fully operational by September 22nd. The community will continue monitoring progress toward that goal, and we will provide updates should dates change.

Marilee Benson is President and co-founder of Zen Healthcare IT, a Carequality Implementer. She holds monthly office hours for the healthcare interoperability community. You can sign up for Marilee’s office hours by clicking here.