FHIR gets the conference keynotes, but a much older, quieter standard still moves more of the health data that actually crosses organizational boundaries every day: Direct secure messaging. Referral letters, transitions-of-care summaries, discharge documents, and public health reports travel constantly between EHRs that have never been integrated with each other — not through a real-time API call, but through an encrypted message that behaves, from a workflow perspective, almost exactly like email.

Direct messaging is not a competitor to FHIR-based interoperability; it solves a different problem. Where FHIR APIs enable structured, queryable, real-time data exchange between systems that have built the integration, Direct provides a simple, standardized way to push a complete document from one trusted address to another with no prior technical relationship required beyond both parties having a Direct address. That simplicity is exactly why it became the default rail for point-to-point clinical document exchange years before most FHIR APIs existed in production, and why it remains embedded in certified EHR technology today.

What is Direct secure messaging, technically?

The Direct Project, launched under ONC’s health IT interoperability initiatives, defined a specification for sending encrypted health information between known, trusted parties using standard internet protocols — S/MIME encryption over SMTP, the same transport family that underlies ordinary email.1 Each participating organization or individual is issued a Direct address, structurally similar to an email address, that is cryptographically bound to a verified identity through a trust framework.

The practical result: a referring physician’s EHR can send a consult request and the relevant clinical summary directly to a specialist’s Direct address, and the specialist’s EHR receives an encrypted, authenticated document that can be reconciled into that patient’s chart — without either system needing a custom interface, a shared health information exchange membership, or a live API connection. Direct messaging is required functionality under the ONC Health IT Certification Program specifically because of this low barrier to entry: any certified EHR must support sending and receiving Direct messages, which is why the standard reaches essentially every certified ambulatory and inpatient system in the country.

Why does trust and identity verification matter so much for Direct?

Unlike ordinary email, a Direct address is not supposed to be self-issued. The entire security model depends on knowing that a message purporting to come from a specific clinician or organization actually did — because the payload is often a complete clinical document containing protected health information, not a request that a human will manually verify before acting on.

That trust is established through Health Information Service Providers (HISPs) — the technical intermediaries that issue Direct addresses, manage the certificates that make S/MIME encryption possible, and enforce identity-proofing requirements before an address is issued. DirectTrust, a non-profit collaborative of HISPs, health IT vendors, and provider organizations, operates the accreditation program that most of the industry relies on to establish mutual trust across different HISPs’ networks — without a shared accreditation framework, a Direct address issued by one HISP would have no basis for being trusted by a different HISP’s users, which would fragment the whole system back into isolated silos.

DirectTrust-accredited HISPs commit to identity-proofing standards, security certificate management practices, and interoperability testing that let a message originated on one accredited network reach a recipient on a different accredited network with the same trust guarantees. This accreditation layer is largely invisible to the clinician sending a referral, but it’s the reason the message actually arrives somewhere trustworthy instead of nowhere at all.

How does Direct actually get used in practice?

Direct messaging shows up in several recurring workflows that FHIR APIs, even where deployed, often don’t fully replace:

  • Care transitions and referrals — a hospital’s discharge summary sent to a patient’s primary care physician, or a PCP’s referral packet sent to a specialist, typically arrives as a Direct message containing a structured Continuity of Care Document (CCD) or Consolidated CDA
  • Public health reporting — many electronic lab reporting (ELR) and electronic case reporting (eCR) feeds to public health agencies route over Direct-based transport, particularly for organizations and jurisdictions that haven’t yet migrated to newer FHIR-based public health APIs
  • Meaningful Use / Promoting Interoperability transition-of-care measures — the federal EHR incentive program’s care-transition requirements have long been satisfiable via Direct exchange, which is a major reason the standard achieved near-universal certified-EHR support
  • Ad hoc clinician-to-clinician communication for organizations with no established HIE relationship or FHIR integration — a Direct address requires no advance technical agreement beyond identity verification, which makes it the practical fallback when no richer integration exists

Direct’s core limitation is exactly what makes it simple: it delivers a document, not a queryable, structured data feed. A Direct message containing a CCD gets the receiving clinician the information, but reconciling that document’s contents into discrete, structured fields in the receiving EHR is a separate — and often imperfect — step, unlike a FHIR API response that arrives already structured.

How does Direct relate to FHIR and where is each the right tool?

Direct and FHIR solve adjacent but distinct interoperability problems, and most health systems run both simultaneously rather than choosing one:

  • FHIR is suited to structured, queryable, often real-time exchange between systems with an established technical integration — a patient app pulling lab results, a payer’s prior-authorization API checking coverage rules, or a population-health platform querying multiple EHRs for quality-measure data.
  • Direct is suited to point-to-point document delivery between parties that may have no prior technical relationship beyond mutual trust-framework membership — the classic referral-and-discharge-summary use case, and public health reporting to agencies that haven’t built FHIR-based intake yet.

ONC’s own interoperability roadmap has treated the two as complementary rather than sequential replacements, and TEFCA’s framework for nationwide health information exchange explicitly accommodates both query-based (FHIR-aligned) and Direct-based (document push) exchange purposes under its Common Agreement, rather than mandating a single transport model. In practice, an organization that assumes FHIR has made Direct obsolete typically discovers otherwise the first time it needs to exchange a discharge summary with an unaffiliated practice that has never built a FHIR integration.

What are the practical limits health systems still run into?

Even with near-universal certified-EHR support, Direct adoption in practice runs into a handful of recurring friction points that health IT teams responsible for care-transition workflows should plan for rather than assume away:

  • Address directory fragmentation. There is no single, universally reliable public directory of every Direct address in the country the way there is for standard email domains. Finding the correct Direct address for a specific unaffiliated specialist or receiving organization can require manual lookup, phone calls, or reliance on a regional directory service, which slows down the first exchange with any new external partner even when both sides are technically capable of Direct messaging.
  • Document reconciliation quality varies by EHR. Receiving a CCD or Consolidated CDA via Direct is only half the workflow — how well the receiving EHR parses that document’s discrete data elements into the patient’s structured chart (problem list, medications, allergies) versus simply attaching it as a scanned-style document varies significantly by vendor and configuration, which shapes how much clinical value the receiving clinician actually gets without manual re-entry.
  • HISP-to-HISP interoperability, while improved by DirectTrust accreditation, is not entirely frictionless. Organizations occasionally encounter delivery or certificate-trust issues when messages cross between HISPs that haven’t fully tested interoperability with each other, particularly with smaller or newer accredited networks.

None of these limitations have displaced Direct from its role as the default rail for care-transition document exchange, but they explain why organizations that assume Direct “just works” the way consumer email does sometimes encounter friction the first time they lean on it for a new, unfamiliar external relationship.

Frequently Asked Questions

Is Direct secure messaging the same thing as regular email?

No. Direct uses the same underlying transport family as email (SMTP) but adds S/MIME encryption and requires each address to be issued through an identity-proofing process by an accredited Health Information Service Provider, giving it trust and security guarantees ordinary email does not have.

Why do HISPs and DirectTrust accreditation matter?

Health Information Service Providers issue Direct addresses and manage the certificates enabling encryption. DirectTrust accreditation lets HISPs trust each other’s identity-proofing and security practices, so a message sent from one accredited network reaches a recipient on a different network with consistent trust guarantees.

Is Direct messaging required for EHR certification?

Yes. Send-and-receive Direct messaging capability is required functionality under the ONC Health IT Certification Program, which is a major reason the standard has near-universal support across certified ambulatory and inpatient EHR systems.

Has FHIR made Direct secure messaging obsolete?

No. FHIR handles structured, queryable exchange between systems with an established integration, while Direct handles point-to-point document delivery between parties that may have no prior technical relationship. Most health systems and national frameworks like TEFCA use both, not one instead of the other.

What kind of document typically travels over a Direct message?

Most commonly a Continuity of Care Document (CCD) or Consolidated CDA — structured clinical summary documents used for referrals, discharge summaries, and transitions of care, though reconciling that document’s data into a receiving EHR’s discrete fields is a separate step from delivery itself.

This article is intended for general informational purposes for health IT professionals and does not constitute legal or medical advice. Organizations should confirm current certification and accreditation requirements with ONC and DirectTrust directly, as program details are periodically updated.

  1. Office of the National Coordinator for Health IT, “Direct Basics,” HealthIT.gov, https://www.healthit.gov/topic/health-it-and-health-information-exchange-basics/direct-basics ↩︎