Direct Secure Messaging

Direct operates on a federated trust framework rather than a centralized authority. Each participating organization operates its own Health Information Service Provider (HISP) , which acts as a certificate authority and message gateway. Trust is established through a web of bilateral agreements and cross-certification between HISPs, forming a trust bundle of accredited certificate authorities. This eliminates the need for a single national provider directory while ensuring every sender and receiver is strongly authenticated.

Direct messages are secured using Secure/Multipurpose Internet Mail Extensions (S/MIME) , which provides two critical protections:

• Encryption: Message content is encrypted with the recipient's public key, ensuring only the intended receiver can decrypt it
• Digital Signatures: The sender signs the message with their private key, providing non-repudiation and integrity verification

This cryptographic envelope wraps standard MIME content, allowing attachments like CCDA documents or PDFs to be transmitted securely.

Direct uses SMTP over TLS for transport, but adds the IMAP or POP3 retrieval requirement at the recipient's edge. The HISP-to-HISP transmission occurs via mutually authenticated TLS, while the final delivery to the end-user's inbox uses standard email protocols. This architecture ensures:

• Point-to-point encryption across every hop
• No message persistence on intermediary servers
• Compatibility with existing email clients like Outlook through the Direct Project specifications

The Applicability Statement for Secure Health Transport is the core technical specification defining Direct message format and transport. It mandates:

• Use of RFC 5322 compliant messages with X.509 certificates
• SHA-256 hashing for digital signatures
• AES-128 or stronger symmetric encryption
• Mandatory TLS 1.2 or higher for all SMTP and IMAP connections

This specification ensures consistent implementation across all certified HISPs and EHR systems.

Every Direct user is assigned a Direct Address that looks like a standard email address (e.g., [email protected]) but is cryptographically bound to an X.509 certificate. The HISP maintains a certificate directory mapping addresses to public keys. Before sending, the sender's HISP queries the recipient's HISP to retrieve the current valid certificate, ensuring:

• Certificate revocation checking for compromised keys
• Automatic key discovery without manual exchange
• Scalable addressing across organizational boundaries

Direct was developed under the ONC's Direct Project to satisfy Stage 2 Meaningful Use requirements for transitions of care. Key regulatory drivers include:

• CMS interoperability rule requiring hospitals to send event notifications
• TEFCA recognition of Direct as a valid exchange modality
• HIPAA Security Rule compliance through encryption and access controls

Direct remains a mandated capability in certified EHR technology, particularly for edge cases where FHIR-based exchange is unavailable.

An organization or technology platform that enables the secure electronic mobilization of clinical information across disparate healthcare information systems within a community, region, or hospital network. Direct Secure Messaging often serves as the transport backbone for HIE push notifications, delivering transition of care summaries directly to a known provider's inbox.

• Enables directed exchange: sending information to a specific, known recipient
• Supports query-based exchange: allowing providers to search and discover records
• Relies on master patient indexes to correctly match identities across systems

A standardized XML document architecture mandated in the U.S. that specifies the encoding, structure, and semantics of clinical documents like discharge summaries for exchange. Direct Secure Messaging frequently transmits C-CDA payloads as attachments, ensuring the receiving EHR can parse and ingest structured data rather than a flat PDF.

• Defines document types: Continuity of Care Document (CCD), Discharge Summary, Progress Note
• Uses LOINC codes for document type identification
• Requires SNOMED CT and RxNorm for coded clinical concepts within sections

Automated, real-time alerts sent via Direct Secure Messaging when a patient experiences a triggering clinical event, such as a hospital admission, discharge, or transfer. These ADT notifications are a cornerstone of accountable care, enabling primary care providers and care managers to act on transitions immediately.

• Reduces 30-day readmission rates by prompting timely follow-up
• Often contains a C-CDA summary of the encounter
• CMS requires hospitals to send electronic patient event notifications as a condition of participation