Guide

Direct: the encrypted fax replacement your EHR already has

Summary

Direct secure messaging is an encrypted, email-like protocol built specifically for healthcare, letting you send a referral, a consult note, or a discharge summary to another provider's Direct address the same way you'd send an email — except every message travels between Direct Trust-accredited networks that verify both sender and recipient identities first. Most EHRs already issue you a Direct address; check your settings before assuming you need a new vendor or a fax machine.

By Gale Editorial · Updated 2026-07-27. Every figure cited to a dated source. How we write.

What Direct actually is

Direct secure messaging is a HIPAA-compliant, encrypted protocol built for healthcare that works like email: every participant gets a Direct address, formatted like an email address, and messages travel encrypted between accredited networks that verify sender and recipient identity before delivery. It's the infrastructure most EHRs use, often invisibly, whenever you send a referral or a summary of care to another provider electronically.

The protocol was built specifically to solve a problem regular email can't: standard email isn't encrypted end to end by default and doesn't verify that the address on the other end actually belongs to a covered healthcare provider, which is why sending PHI over ordinary email is a routine HIPAA exposure. Direct closes both gaps at the protocol level, which is why it's become the default transport for structured clinical document exchange rather than a product you have to separately evaluate.

How it's different from fax, and why fax hasn't died

A fax and a Direct message accomplish the same basic task, moving a document from your practice to another provider, but Direct does it encrypted, delivered instantly, and landing as structured data your EHR can often file automatically rather than a scanned image someone has to manually attach to a chart.

Fax persists anyway, mostly because it doesn't require the receiving office to have adopted anything, while Direct only works if both sides have a Direct address and know each other's. That's the real adoption barrier: not that Direct is hard to use, but that plenty of specialists' offices, especially small ones, still don't have an address configured or don't know they have one, which pushes the referring practice back toward fax by default.

The exchange landscape Direct sits inside

Direct is one layer of a larger interoperability structure, not the whole of it; TEFCA now establishes a national floor for network-to-network exchange through Qualified Health Information Networks, which is gradually making point-to-point Direct messages less necessary for some kinds of exchange, particularly broad record retrieval that used to require a specific request to a specific office 1.

For now, most solo practices still rely on Direct for the everyday referral-and-consult-note traffic, while tefca and hies increasingly handle broader record retrieval and query-based exchange in the background. The two aren't competing systems — a Direct message is often exactly how a document gets from your EHR into a health information exchange in the first place, and the same underlying address you already have is frequently what a network uses to identify you as a participant.

The information-blocking angle

If a colleague or a patient's new provider asks you to send records and you have a working Direct address, declining or defaulting to a slower channel without a valid reason risks looking like information blocking — the Cures Act rule presumes you'll share electronic health information you're capable of sharing, absent one of eight defined exceptions 2.

The same expectation extends to the app request, a patient's own app-based data request arriving through your EHR's patient-access API; Direct isn't the channel for that specific case, but it's part of the same broader posture the rule expects — that having the technical capability to share information electronically means you generally should, rather than defaulting to paper because it's familiar.

What the Security Rule expects once you're using it

Using Direct doesn't remove your Security Rule obligations, it just changes where they apply: your practice still needs administrative, physical, and technical safeguards for the ePHI you're sending and receiving, anchored in a documented risk analysis, the same as any other channel that carries patient data in and out of your practice 3.

ONC and OCR's free Security Risk Assessment tool covers exactly this kind of question, whether your electronic exchange channels are configured and used the way your risk analysis assumes 4. If your Direct address sits inside a larger business-continuity picture, confirm messaging capability is part of the contingency plan you'd fall back on if your primary EHR access went down — a referral you can't send electronically during an outage still needs a path to the specialist's office.

Getting your own Direct address

Check your EHR's settings or ask your vendor before assuming you need to buy anything separate — most certified EHRs issue a Direct address as part of the base product, often under a menu labeled something like "secure messaging" or "care coordination" rather than "Direct" by name.

The Health Information Service Provider actually routing your messages is a business associate handling PHI on your behalf, which means it belongs on the baa map alongside your EHR and every other vendor touching PHI, and the agreement should already be covered as part of your EHR contract, not as a separate signature you're missing 5. If your current EHR doesn't offer Direct messaging at all, that capability gap is exactly the kind of thing to weigh the next time ehr-operations comes up for review, alongside the other data-access terms worth negotiating before signing a new agreement 6.

Practical workflow: when Direct is the right tool

Direct is the right default for anything structured and provider-to-provider: referrals, consult notes, discharge summaries, transition-of-care documents. It's the wrong tool for anything that needs real-time back-and-forth or involves the patient directly — that's what the patient portal is for.

If you're tracking Promoting Interoperability measures, sending and receiving records through Direct is frequently one of the easier ways to satisfy pi with a small ehr, since the activity you're already doing to close referral loops counts toward the same measure rather than requiring separate work. Save time by pre-loading colleagues' Direct addresses the same way you would a fax number, so the choice at referral time is genuinely a choice, not a default back to whatever's fastest to find.

Common questions

No — regular email isn't encrypted by default and doesn't verify that the recipient address actually belongs to a healthcare provider. Direct is built specifically to close both gaps: every message travels encrypted, and both ends have been verified by an accredited Direct Trust network before the address was issued, which is what makes it appropriate for PHI where ordinary email isn't.

Probably not — most certified EHRs already include a Direct address as part of the base product, often under a label like secure messaging rather than the word Direct itself. Check your settings or ask your vendor before assuming you need a separate purchase or a new account with an outside company.

No — Direct only works when both sender and recipient have an address, so if the receiving office hasn't set one up, the message can't go through and you'll need to fall back on fax or another channel. Ask new referral partners for their Direct address the same way you'd ask for a fax number.

No — Direct's encryption handles the transport, but your practice still needs its own administrative and technical safeguards, anchored in a documented risk analysis, covering how the address is used and who has access to it. Running a security risk assessment that actually accounts for your electronic exchange channels is still your responsibility, not the protocol's.

It can be, if you have a working Direct address and a valid request and you decline or default to a slower channel without a reason that fits one of the rule's defined exceptions. Having the technical capability to share information electronically generally means you're expected to use it, not default to paper because it's familiar.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

  1. 1.Office of the National Coordinator / ASTP (2026). TEFCA — Office of the National Coordinator for Health Information Technology. HealthIT.gov. link ✓Establishes TEFCA as the national floor for network-to-network exchange, framing where Direct's point-to-point messaging sits relative to broader interoperability infrastructure.
  2. 2.Office of the National Coordinator / ASTP (2026). Information Blocking. HealthIT.gov. link ✓Establishes that declining to share electronic health information you're capable of sharing, absent a defined exception, is presumed information blocking, framing the expectation to use Direct when able.
  3. 3.HHS Office for Civil Rights (2026). Summary of the HIPAA Security Rule. U.S. Department of Health and Human Services. linkEstablishes that Security Rule safeguards and a documented risk analysis still apply to how a Direct address is configured and used.
  4. 4.Office of the National Coordinator / ASTP (2026). Security Risk Assessment Tool. HealthIT.gov. link ✓Supports using the free SRA tool to evaluate whether electronic exchange channels like Direct are configured consistently with the practice's risk analysis.
  5. 5.HHS Office for Civil Rights (2026). Business Associates. U.S. Department of Health and Human Services. linkEstablishes that the Health Information Service Provider routing Direct messages is a business associate requiring a signed agreement.
  6. 6.Office of the National Coordinator (2016). EHR Contracts Untangled: Selecting Wisely, Negotiating Terms, and Understanding the Fine Print. HealthIT.gov (ONC). link ✓Supports negotiating Direct-messaging and data-access capability as a contract term when evaluating or renegotiating an EHR agreement.

https://www.gale.care/for-providers/cde-direct-secure-messaging · 6 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers

Findability, by specialty

How practices like yours get found in local search and AI answers — the honest playbook, per specialty.

SEO for private practices · SEO for AI search / answer engines (all verticals)