Digital health

The Trusted Exchange Framework and Common Agreement (TEFCA) establishes a common framework for securely exchanging electronic health information across certain health networks. Historically, health records have been fragmented across regional, state, and vendor-specific networks that do not always connect. TEFCA makes it easier for patients and providers to access records wherever they are held.

Yes. Persona is a Kantara-certified Credential Service Provider (CSP) for the Trusted Exchange Framework and Common Agreement (TEFCA), serving Individual Access Service (IAS) providers in two key ways:

• NIST Identity Assurance Level 2 (IAL2) identity proofing: Persona verifies patient identity at IAL2 standards using a pre-built inquiry template optimized for patient matching, with a mobile-first experience.

• ID token issuance: After a patient completes verification, Persona generates a signed OIDC ID token containing the patient's verified demographics. IAS providers use this token in TEFCA exchange requests.

This enables IAS providers to meet TEFCA requirements without building identity proofing infrastructure from scratch.

No, waiting is one of the higher-risk positions a digital health company can take. As of July 10, 2026, the fourth extension of the telemedicine flexibilities is set to run through December 31, 2026. Vendor selection, Business Associate Agreement (BAA) negotiations, legal review, technical integration, and staff training can each take months to complete. The proposed Special Registration rule already signals what requirements will look like: government-issued photo ID capture and verification at multiple points in the prescribing journey. Companies that use the DEA telemedicine extension period to build audit-ready infrastructure now won't be racing to catch up when implementation timelines are compressed.

Persona supports step-up verification flows that trigger stronger identity checks ahead of controlled-substance prescribing or refill workflows. This is configurable to your clinical context and can be adapted as DEA telehealth rules and state-level drug prescription laws evolve. You won’t need to rebuild your verification flows each time a regulation changes; instead, you reconfigure them in Persona's no-code Flow Editor.

Yes. Persona supports verification of both patients and clinicians. For clinicians, this typically means government ID and selfie matching before granting access to prescribing systems or sensitive patient records.

Persona's platform can also be configured to support NPI-based verification: clinicians enter their NPI number during onboarding, a custom workflow queries the NPPES registry, and the name returned is cross-referenced against the name on their government ID. This helps confirm that the person completing verification is the licensed provider they claim to be.

Not when friction is matched to risk. With Persona's Dynamic Flow, you can calibrate verification to context - lower-risk patients, like those completing standard onboarding, move through with minimal steps, while higher-risk moments, like a first controlled-substance prescription, trigger stronger checks. The result: legitimate patients convert quickly while bad actors face escalating barriers.

Patients get configurable retries with real-time guidance; unresolved cases route to another step or to your team for review. Persona provides dynamic retry screens based on what went wrong, such as prompting patients to improve lighting, reduce glare, move closer, or steady their camera. This gives patients clearer guidance in the moment, helping them progress through the verification flow.

Yes, Persona supports automated insurance card capture and extraction and can capture additional document collection at intake. This reduces manual review time and helps accelerate care without adding a separate vendor for document collection.

Yes, if the vendor creates, receives, maintains, or transmits Protected Health Information (PHI) on your behalf. In that case, the vendor is generally considered a business associate, and a Business Associate Agreement (BAA) should be in place before PHI is shared. Whether identity verification data is PHI depends on the specific data flow and healthcare context. Persona offers a standard BAA for covered entities, but organizations should confirm their requirements with legal counsel.

Integration can require anywhere from minimal to moderate engineering work, depending on your approach:

• Hosted Flow: Little to no engineering resources are required to get started. Simply send patients a branded verification link by email or text. Production deployments typically involve some API work to generate links programmatically.

• Embedded Flow: Embed verification directly within your web experience with just a few lines of code.

• Mobile SDKs: Native development is required for iOS, Android, or React Native apps.

You can configure verification steps and routing logic directly with Persona's no-code template and workflow builder. For additional implementation support, speak with Persona’s support team or your account manager.