for healthcare teams

Direct secure messaging

Direct secure messaging is how one healthcare provider's EHR sends records, such as referrals and care summaries, to another provider's EHR. It is a specific exchange standard. It is not a general name for any "secure message," and it is not how staff talk to each other inside a practice.

Direct secure messaging: definition

Direct secure messaging is a standards-based method that lets healthcare organizations send encrypted health information to known, trusted recipients, usually from inside their EHR.

The protocol was developed under the Direct Project, an initiative led by the Office of the National Coordinator for Health Information Technology (ONC).

A Direct address looks like an email address, but it can only exchange messages with other addresses inside the trusted Direct network.

In practice at a clinic or small practice

Referral coordinators and front desk staff usually meet Direct in the EHR's Direct inbox. They use it to send outgoing referrals to specialists. They also receive discharge summaries from hospitals and care summaries from other practices. Incoming messages show a Direct address from the sending hospital or specialist office. Staff don't open a separate app. The messages sit in the EHR next to the patient's chart, and staff attach or file them there.

The office manager handles setup and addresses. A practice gets its Direct addresses through its EHR vendor or through a HISP (health information service provider), the organization that operates Direct messaging on the practice's behalf. When a new referral partner asks to "send it Direct," the office manager may need to find that partner's address in a provider directory. Many practices also use Direct instead of faxing records to partners who can receive Direct messages. Fax is still in use, so Direct is a common alternative, not a universal replacement.

Not to be confused with

HIPAA-compliant messaging or team chat. These are internal staff conversations inside the practice. Examples include a shift question, front desk coordination ("Room 3 is running 20 minutes behind") or a task assigned to the billing team. A staff chat tool such as Chanty belongs to this category. It is a different category from Direct and does not send records over the Direct network.
Patient portal messaging. These are messages between the practice and its patients. Direct is mainly used for provider-to-provider exchange, and sometimes for provider-to-system exchange.
"Direct message" (DM) in social or chat apps. This is unrelated. It only means a one-to-one chat.

What the rules say

HIPAA does not define the term. "Direct secure messaging" comes from ONC standards and industry usage, mainly through DirectTrust. HIPAA does not require practices to use Direct, and Direct is not the only permitted way to exchange records.
ONC certification. ONC's EHR certification program includes criteria for sending and receiving health information using the Direct Project specification.
Technical basis. Direct messages are protected with S/MIME encryption and digital certificates. A trust framework manages those certificates, and DirectTrust accredits HISPs and certificate authorities within it.
CMS link. Practices commonly use Direct to meet Promoting Interoperability measures for sending and receiving health information in referrals and transitions of care.
HIPAA still applies to the content. The Security Rule's transmission security standard covers any protected health information (PHI) sent electronically, whatever the method. Using Direct does not make a practice HIPAA compliant by itself. Access controls, policies, staff training and the practice's agreements with vendors still apply.

Direct secure messaging