Direct secure messaging is the health care equivalent of encrypted, authenticated email: a standards-based way to push a clinical document from one provider's system to another's, point to point, without a shared network in between. It underpins referral loops, transition-of-care summaries, and a good deal of certified-EHR functionality. It is also one of the most under-configured integrations in the average practice, where messages go unread in a folder nobody monitors or fail silently because a trust bundle expired. This guide covers what an EMR administrator needs to know to make Direct work reliably.
What Direct is
The Direct standard specifies secure transport of health information using SMTP for delivery, S/MIME for encryption and signing, and X.509 certificates for identity. A Direct address looks like an email address (for example, a name at a subdomain of a health information service provider's domain), but it can only exchange messages with other Direct addresses whose certificates chain to a trust anchor your system recognizes. Direct carries any payload; in practice it most often carries C-CDA documents such as continuity-of-care documents, referral notes, and discharge summaries, with the EMR handling packaging on send and parsing on receipt.
The moving parts
- HISP (Health Information Service Provider). The service that hosts your Direct domain, manages certificates, enforces trust policy, and relays messages. Most EMR vendors bundle a HISP or partner with one. You typically do not run your own.
- Certificates and trust anchors. Each Direct domain or address has a certificate. Your HISP will only deliver to or accept from domains whose certificates chain to an anchor in its trust store.
- Trust bundles. Curated collections of trust anchors, most notably the bundles maintained by DirectTrust, that let HISPs trust each other at scale instead of negotiating one-to-one. If your HISP participates in a bundle, you can exchange with every other participating organization.
- Provider directory. A searchable listing of Direct addresses, often federated across HISPs, that lets users find where to send.
- EMR integration layer. The part of your EMR that generates the outbound document, attaches it to a Direct message, receives inbound messages, matches them to a patient, and routes them to a work queue.
Admin setup checklist
- Confirm your Direct domain and addressing scheme. Decide whether each provider gets an individual address, whether departments get shared addresses, or both. Shared addresses are easier to monitor; individual addresses are what many directories expect.
- Enable Direct for each user or location in the EMR and verify the address the system displays matches what the HISP provisioned.
- Verify trust bundle participation with your HISP and note the bundle names. Ask how anchor updates are applied and whether you will be notified of expirations.
- Configure inbound routing. Decide where inbound messages land (a referral queue, a provider's in-basket, a records team), who monitors it, and what the response-time expectation is. An unmonitored inbound Direct queue is the most common real-world failure.
- Set up patient matching rules for inbound documents. Most EMRs attempt automatic matching on demographics and hold unmatched messages for manual review; make sure someone owns that review.
- Configure outbound triggers. Many EMRs can send a summary automatically when a referral is placed or a patient is discharged. Confirm which document template is used and that it contains what the recipient needs.
- Publish your addresses to the directory your HISP feeds, and to your referral partners directly.
- Test end to end with a partner outside your organization, in both directions, before relying on it.
Finding Direct addresses
The most frequent complaint about Direct is not technical. It is "I do not know the other office's address." Start with the provider directory built into your EMR or HISP portal; many aggregate entries across HISPs. If the recipient is not listed, ask their office directly; the address is often printed on referral forms or available from their EMR administrator. Health information exchanges in your region may also maintain directories. When a partner sends you a message, their address is in the header, so save it. Build and maintain your own address book of frequent referral partners inside the EMR so front-line staff are not searching every time.
Troubleshooting failed messages
| Symptom | Likely cause | What to check |
|---|---|---|
| Bounce citing certificate or trust failure | Recipient's domain not in your HISP's trust store, or expired certificate on either side | Ask both HISPs which bundles they participate in; check certificate validity dates |
| Message shows sent but recipient never received it | Delivered to an unmonitored address or shared mailbox at the recipient | Confirm the exact address the recipient monitors; request a message disposition notification |
| Message received but attachment will not open | Recipient's EMR cannot parse the document version or the payload was not packaged as expected | Confirm the C-CDA version and template; try sending a PDF alongside the structured document |
| Inbound message stuck in unmatched queue | Demographics differ from your record (name variant, address change) | Manual match; review matching thresholds if this is frequent |
| Everything worked last month and now nothing sends | Trust anchor or certificate rotated and the update did not apply | Contact the HISP; ask for confirmation of current anchor set |
| Recipient address rejected as invalid | Typo, or the address is a regular email address, not a Direct address | Verify via directory; Direct addresses cannot be reached from ordinary email |
Ask your HISP whether it returns message disposition notifications (MDNs) to your EMR and whether the EMR displays them. A processed MDN is your proof the recipient's system accepted the message. Without it, "sent" only means it left your side.
Governance and monitoring
Treat Direct like any other clinical interface. Log who has addresses, review the list when staff leave, and confirm that shared mailboxes have named owners and backup coverage. Build a simple weekly report: messages sent, messages received, unmatched inbound items older than two business days, and delivery failures. Because Direct is frequently the mechanism behind referral-loop closure and transition-of-care measures, a stalled queue shows up in quality reporting eventually; it is far cheaper to catch it on a Monday-morning report. Finally, include your HISP in your business associate inventory and your security risk analysis. It is transmitting and often temporarily storing electronic PHI on your behalf.
Common questions
Is Direct secure messaging the same as encrypted email?
It is built on email standards (SMTP with S/MIME encryption and signing), but it operates in a closed trust network. Direct addresses can only exchange with other Direct addresses whose certificates chain to a recognized trust anchor, so ordinary email accounts cannot send to or receive from them.
What is a HISP?
A Health Information Service Provider hosts your Direct domain, manages certificates and trust policy, and relays messages to other HISPs. Most EMR vendors bundle or partner with a HISP, so the practice does not typically run one itself.
Why do Direct messages fail between two organizations that both have Direct?
Most commonly because their HISPs do not share a trust anchor or bundle, or because a certificate expired. Other frequent causes are sending to an address nobody monitors, document formats the recipient cannot parse, and inbound messages stuck in an unmatched-patient queue.
How do I find another provider's Direct address?
Check the provider directory in your EMR or HISP portal, ask the receiving office or its EMR administrator, consult a regional health information exchange directory, or capture it from the header of a message they have sent you. Keep an internal address book of frequent referral partners.