Give Your Organization Secure, Fast Messaging That Keeps Up With How You Work

Direct secure messaging (often called "Direct") is an encrypted, email-like transport standard purpose-built for exchanging protected health information over the internet. It uses digital certificates and public-key encryption so only the intended recipient can open a message, and it is governed by the nonprofit DirectTrust under the consensus-based Direct Standard.

Yes — Direct was specifically designed to meet HIPAA's security requirements for transmitting protected health information, using encryption, identity-verified addresses, and audit trails. Compliance also depends on having a Business Associate Agreement in place with your HISP and following your organization's own access and retention policies. IIS includes a BAA as standard with every healthcare deployment.

Direct messaging transmits structured, importable data — including C-CDA clinical summaries — with no image-quality loss and automatic delivery confirmation, while fax sends a flat image that must often be manually re-entered into the recipient's system with no reliable proof of receipt. Because Direct messages import directly into an EHR, they eliminate the manual data entry that faxed documents still require.

DirectTrust reported more than 1.894 billion Direct messages exchanged in 2025 alone — a 42% increase over the prior year — across more than 3.1 million trusted Direct addresses and 196,517 organizations served by DirectTrust-accredited HISPs. Cumulatively, the network has processed nearly 8 billion Direct exchange transactions since 2014.

Direct-based transitions-of-care functionality has been part of ONC's EHR certification criteria since the 2015 Edition, building on Meaningful Use Stage 2 requirements — which is why Direct is now built into more than 150 certified EHR systems. This certification requirement made Direct the de facto standard for provider-to-provider electronic health information exchange in the U.S.

Direct and TEFCA (the Trusted Exchange Framework and Common Agreement) are complementary but distinct: Direct is a "push" model — a sender sends a message to a specific known recipient, like secure certified email — while TEFCA connects Qualified Health Information Networks (QHINs) to support "pull" queries, requesting records from an entire network without needing an existing relationship with the record holder. Most interoperability strategies use both: Direct for routine point-to-point communication and TEFCA for broader record retrieval.