TEFCA: every control, and what you already have

29 controls 211 frameworks share controls with it United States (ONC) verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
Albania Law on Protection of Personal Data (Law No. 9887, 2008, amended 2014)	2	measure it →
ASD Strategies to Mitigate Cyber Security Incidents	2	measure it →
Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018)	2	measure it →
AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)	2	measure it →
Azerbaijan Law on Personal Data (2010)	2	measure it →
Bahrain PDPL	2	measure it →
Barbados Data Protection Act 2019	2	measure it →
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)	2	measure it →
ISO/IEC 27011:2024	2	measure it →
ISO/IEC 27400:2022	2	measure it →
Nebraska Data Privacy Act	2	measure it →
Taiwan PDPA	2	measure it →

Every control

Code	Control	Also in
`TEF-1`	Standardisation	0
`TEF-2`	Openness and Transparency	41
`TEF-3`	Cooperation and Non-Discrimination	0
`TEF-4`	Privacy, Security, and Safety	0
`TEF-5`	Access and Equity	0
`TEFCA-COMP-01`	Annual Compliance Attestation and Reporting	0
`TEFCA-COMP-02`	Information Blocking Compliance	0
`TEFCA-EP-GOV`	Exchange Purpose Government Benefits Determination	0
`TEFCA-EP-HCO`	Exchange Purpose Health Care Operations	0
`TEFCA-EP-IA`	Exchange Purpose Individual Access Services	0
`TEFCA-EP-PH`	Exchange Purpose Public Health	0
`TEFCA-EP-PMT`	Exchange Purpose Payment	0
`TEFCA-EP-TR`	Exchange Purpose Treatment	0
`TEFCA-GOV-01`	Governance and Cooperation Among QHINs	0
`TEFCA-INT-FHIR`	FHIR Implementation for TEFCA Exchange	0
`TEFCA-INT-IHE`	IHE Profile Implementation for TEFCA Exchange	0
`TEFCA-OP-01`	Service Level Agreements and Availability	0
`TEFCA-OP-02`	QHIN Directory and Endpoint Management	0
`TEFCA-PART-01`	Participant and Subparticipant Onboarding	0
`TEFCA-PART-02`	Participant Offboarding and Suspension	0
`TEFCA-QHIN-01`	Qualified Health Information Network Designation Criteria	0
`TEFCA-QHIN-02`	QHIN Application and Designation Process	0
`TEFCA-SEC-01`	QHIN Security Requirements	0
`TEFCA-SEC-02`	Authentication and Mutual TLS	0
`TEFCA-SEC-03`	Privacy and Notice Obligations	0
`TEFCAREC-1`	Common Agreement Conformance and Onboarding	184
`TEFCAREC-2`	Privacy, Security, Minimum Necessary	12
`TEFCAREC-3`	Exchange Use Cases and Information Blocking	0
`TEFCAREC-4`	Identity Proofing and Authentication	0

Tell me when TEFCA files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What this page is

A control-level reference for TEFCA, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition