Skip to content
LastVet

← Back to Where we stand

Identity

TEFCA Individual Access Services and IAL2

Published September 18, 2026

What changed

Fact. Named instrument, date, jurisdiction. Cited.

In June 2026, the Sequoia Project, acting as the TEFCA Recognized Coordinating Entity, published SOP: Individual Access Services (IAS) Exchange Purpose, version 3.0. The RCE and ONC announced that SOP as effective August 3, 2026. It is current TEFCA operating procedure in the United States, not a statute.

Under that SOP, IAS Providers may use only credential service providers approved by an RCE-selected CSP approval organization. Those CSPs must conduct identity proofing to at least NIST Identity Assurance Level 2 (IAL2). Individuals who elect to use an IAS offering must be verified to at least IAL2 before first use of TEFCA Exchange.

Why it matters for veterans

Stakes in plain language. If we interpret, we say so.

Veterans' health records sit across VA and community systems. Individual Access Services is a TEFCA path for a person, or an app acting for them, to request those records. The IAL2 proofing requirement is the door to that path. If a veteran cannot complete it, they do not get the records through TEFCA IAS.

LastVet's position

The stance.

A veteran's identity is not a form to fill out. It is the line between a veteran holding their own record and someone else reaching it. So when the national exchange rules set the bar at strong, evidence-based identity verification, our instinct is that the bar is right, not that it is in the way.

But a bar that protects veterans only helps them if they can clear it. Identity proofing that turns a tired, rural, or newly separated veteran away at the door protects no one. It just hands the burden back to the person with the least time to carry it, which is the exact pattern LastVet exists to break.

So we hold two things at once. We build toward the level of assurance that lets a veteran carry their records across the systems that fragment their care. And we treat the difficulty of proving identity as our design problem to solve, not a hurdle we pass down to the veteran. We would rather meet a high bar well than route around it and leave a veteran with a weaker hold on their own record.

What we're doing

Dated actions only.

  • 2026-06. VA Lighthouse sandbox access is approved for Patient Health (FHIR) and Veteran Service History & Eligibility. Veterans authorize the pull through VA's identity brokers. This is sandbox, not VA production. Case #00015000 remains in review.
  • 2026-09-15. TestFlight completed an end-to-end sandbox record pull against LastVet's production infrastructure.
  • 2026-04-15. LastVet attested to the CARIN Code of Conduct. That is a consumer-app conduct attestation. It is not TEFCA IAS and not a CARIN Blue Button implementation.
  • 2026-09-18. IAL2 / IAS identity-proofing is a horizon design flag (later). It is not a current evaluation and is not in this Block 4 as work underway.