Written and maintained by CASRAI Editorial Board
Last updated
DirectTrust is a non-profit healthcare industry alliance and American National Standards Institute (ANSI)-accredited standards development organization that stewards the Direct Standard and operates the national public key infrastructure (PKI) trust fabric for Direct Secure Messaging. Originally launched in 2010 as the Direct Project under the Office of the National Coordinator for Health Information Technology (ONC, now ASTP/ONC) and codified in the ONC Health IT Certification Program at 45 CFR § 170.315(h)(1) and (h)(2), Direct Secure Messaging serves as the foundational “push” interoperability transport across U.S. electronic health record (EHR) integrations, Health Information Exchanges (HIEs), and clinical research recruitment and safety reporting networks.
What Is Direct Secure Messaging in Healthcare?
Within the broader healthcare interoperability architecture, data exchange follows two complementary paradigms: pull (query-based) exchange (such as IHE XCA or HL7 FHIR RESTful queries) and push (directed) exchange. Direct Secure Messaging is the universal standard for push exchange when a sender knows the specific clinical recipient who needs a patient record—such as transmitting an inpatient discharge summary to a patient’s primary care physician, routing a specialty referral packet, or sending a clinical trial serious adverse event (SAE) source packet to a sponsor’s pharmacovigilance inbox.
Technically, Direct Secure Messaging is governed by the Applicability Statement for Secure Health Transport (v1.2), which layers healthcare-grade PKI security directly onto ubiquitous internet messaging standards:
- Transport Protocol (SMTP with TLS): Uses Simple Mail Transfer Protocol (RFC 5321) secured over Transport Layer Security (STARTTLS) between messaging gateways, using human-readable Direct addresses formatted like email addresses (e.g.,
[email protected]). - End-to-End Payload Security (S/MIME v3.2): Every message payload (RFC 5322) is cryptographically signed using the sender’s private key and encrypted using the recipient’s X.509 public key via Secure/Multipurpose Internet Mail Extensions (S/MIME v3.2, RFC 5751) with FIPS 140-2/140-3 validated cryptographic algorithms (such as SHA-256 digests and AES-128/256 content encryption).
- Clinical Content Packaging (C-CDA, FHIR & IHE XDM): Supports unstructured PDFs alongside structured machine-readable attachments, primarily HL7 Consolidated Clinical Document Architecture (C-CDA 2.1 Continuity of Care Documents aligned with USCDI), Cross-Enterprise Document Media Interchange (IHE XDM ZIP packages), and HL7 FHIR R4 Document Bundles.
- Guaranteed Delivery Tracking (MDN): Enforces closed-loop reliability through RFC 3798 Message Disposition Notifications (MDNs)—both processed and dispatched/failed receipts—so the sending EHR can verify that the receiving system decrypted and accepted the clinical record.
What Role Does a HISP Play in Direct Messaging?
In almost all hospital and ambulatory EHR deployments, individual clinicians do not manually manage X.509 cryptographic keys on their workstations. Instead, an organization connects through a Health Information Service Provider (HISP)—either built natively into the EHR platform (such as Epic, Oracle Health, MEDITECH, or eClinicalWorks) or operated by a specialized third-party HISP (such as Kno2, MedAllies, MaxMD, DataMotion, or Surescripts). A HISP executes four core infrastructure functions:
- Identity Proofing & Direct Address Provisioning: Works with an accredited Registration Authority (RA) to identity-proof healthcare organizations and individual NPI-holding clinicians (typically to NIST SP 800-63 Identity Assurance Level 2 [IAL2]) before issuing organizational or address-bound X.509 digital certificates.
- Public Certificate Discovery (DNS CERT & LDAP): When a clinician sends a message to an external Direct address, the sending HISP queries the Domain Name System (DNS) for RFC 4398
CERTresource records first and falls back to Lightweight Directory Access Protocol (LDAP) servers (RFC 4511) to retrieve the recipient’s current public X.509 certificate, checking Certificate Revocation Lists (CRLs) or Online Certificate Status Protocol (OCSP) responders. - Automated S/MIME Signing, Encryption, and Decryption: Wraps outbound messages issued via edge protocols (XDR, SMTP, IMAP/POP, or REST APIs) into signed-and-encrypted S/MIME envelopes and validates/decrypts inbound messages after verifying that the sender’s certificate chains up to a trusted root anchor.
- Provider Directory Federation & Event Notifications: Publishes verified Direct endpoints into national healthcare directories so ordering clinicians can search for recipients directly inside their EHR referral workflow, satisfying CMS Promoting Interoperability and ONC Cures Act electronic health information exchange requirements.
How Does DirectTrust Manage Trust Anchors for Clinical Email Exchange?
Without a central trust coordinator, every hospital HISP would have to negotiate bilateral legal agreements and manually exchange X.509 Trust Anchors with thousands of other hospitals. DirectTrust eliminates this scaling bottleneck through its federated governance and technical trust bundle architecture:
| DirectTrust Component | Governance & Technical Function | Interoperability Impact |
|---|---|---|
| Security and Trust Framework (Accreditation) | Audits and accredits HISPs, Certificate Authorities (CAs), and Registration Authorities (RAs) (historically in partnership with EHNAC) against strict PKI, HIPAA, and identity-proofing policies | Ensures every participating HISP enforces uniform certificate issuance, revocation, and audit controls |
| Accredited Trust Anchor Bundle | Maintains and publishes a machine-readable, cryptographically signed XML/PKCS#7 bundle of all accredited root and intermediate CA Trust Anchors | Participating HISPs automatically poll and refresh the Trust Bundle, enabling instant plug-and-play trust across hundreds of thousands of Direct addresses nationwide |
| ANSI Standards Development (Direct Standard) | Maintains the normative Applicability Statement for Secure Health Transport, Direct Project Edge Protocols, and Direct + FHIR Implementation Guides | Provides the technical specifications referenced by ONC certification criteria 45 CFR § 170.315(h)(1) and (h)(2) |
Frequently Asked Questions
What is Direct Secure Messaging in healthcare?
Direct Secure Messaging (the Direct Standard) is an ONC-certified, push-based health information transport specification (45 CFR § 170.315(h)(1)) that uses S/MIME v3.2 encryption and X.509 v3 digital certificates over standard SMTP email protocols to securely transmit clinical documents—such as HL7 C-CDA Transitions of Care summaries, referrals, and lab results—between verified healthcare participants.
What role does a HISP play in Direct messaging?
A Health Information Service Provider (HISP) is the accredited network operator or embedded EHR gateway that manages Direct addresses, discovers and validates recipient X.509 public key certificates via DNS CERT records or LDAP directories, performs S/MIME encryption/decryption and digital signature verification, and tracks RFC 3798 Message Disposition Notifications (MDNs).
How does DirectTrust manage trust anchors for clinical email exchange?
DirectTrust—an ANSI-accredited standards development organization and non-profit alliance—operates the DirectTrust Accredited Trust Anchor Bundle. By accrediting Certificate Authorities (CAs), Registration Authorities (RAs), and HISPs under a unified Security and Trust Framework, DirectTrust distributes a cryptographically signed root/intermediate certificate bundle that enables thousands of healthcare organizations to exchange encrypted clinical messages without bilateral legal agreements.
Sources
- Electronic Code of Federal Regulations (eCFR). 45 CFR § 170.315(h)(1) and (h)(2) — ONC Health IT Certification Program: Direct Project. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-D/part-170/subpart-C/section-170.315
- DirectTrust. The Direct Standard & Accredited Trust Bundle Documentation. https://directtrust.org/
