Direct Adoption FAQs

General Questions

What is Direct messaging?

Direct messaging is secure email for health information--a simple, cost-effective mechanism to transport patients' protected health information (PHI) to known, trusted recipients over the Internet.

What is the Direct Adoption Program?

The RI Regional Extension Center's (RI REC's) Direct Adoption Program helps providers and practices adopt Direct Messaging by offering educational materials and webinars; a selection of qualified HISPs in an online Vendor Marketplace; and free membership in the Rhode Island Quality Institute's RI Trust Community.

What is the National Direct Project?

The National Direct Project developed the Direct messaging protocols. The project was launched in March 2010 by the Office of the National Coordinator for Health Information Technology (ONC). The ONC created a consortium of physician leaders, health IT experts, and private technology companies to create a secure, simple, scalable, standards-based method to send authenticated, encrypted health information to known, trusted recipients over the Internet.

For more information, visit www.directproject.org.

What is the difference between Direct messaging and regular email?

Regular email is not appropriate for sending PHI. Messages could be intercepted and read during transmission, and you have no way of ensuring that the message will be delivered only to the intended recipient.

Direct messaging is both secure and validated, making it appropriate for sending PHI. Message encryption ensures that the message is not compromised during transmission. An electronic credentialing system--using electronic certificates--identifies the sender and recipient to ensure that the mail is routed only to intended and trusted recipients.

Where can I get more information about Direct messaging and the Direct Adoption Program?

Learn more about RI REC's Direct Adoption Program.

For more information about the national Direct project, visit www.directproject.org.

Direct Technology

What makes Direct more secure than other communication methods?

Direct messaging uses an industry-standard infrastructure and a legal framework that ensure sensitive information is delivered securely.

Message encryption ensures that the message is not compromised during transmission. An electronic credentialing system--using electronic certificates--identifies the sender and recipient to ensure that the mail is routed to only to intended and trusted recipients.

What is a Direct certificate?

A Direct certificate is an attachment to an electronic message used for security purposes. In Direct, it is used to verify that the message sender and recipient are who they claim to be, and to provide the keys to encrypt and decrypt the message.

Certificates are issued by a trusted third party (a Certificate Authority), who follows a validation process to vet Direct users.

How does Direct encrypt message content?

The Direct messaging protocol uses the S/MIME standard to secure the content of the message. S/MIME is a commonly used standard to encrypt MIME (Multipurpose Internet Mail Extension) data.

Where can I get more information about Direct technical specifications?

For more information about Direct technical specifications, please visit http://wiki.directproject.org/Documentation+Library

Adopting Direct

I'm a PCP and only refer patients to specialists within my network. We all have access to the same EHR; why should I adopt Direct?

There's no guarantee that a patient's care team won't include providers outside of a single network, particularly when you consider not just specialists but all of the providers in the system, including labs and pharmacies, behavioral health providers, physical therapists, and hospital emergency rooms. As a community, we need to adopt communication methods that can include all participants in a patient's care.

It sounds as if Direct messaging and some of the use cases are still being developed. Why should I adopt Direct messaging now instead of waiting?

You can use Direct messaging today for provider-to-provider communication with your colleagues. Establishing Direct messaging now also puts you in a good position to adopt other services--such as Provider Notification--as soon as they become available. 

How many RI practices currently are using Direct messaging?

Direct is a new technology, so there aren't many users yet. We're counting on you to use Direct messaging and spread the word to your colleagues. The more Direct messaging users we have, the more valuable the service becomes.

What is a HISP?

A HISP is a Health Information Service Provider--a vendor that provides Direct messaging services. A HISP

- Packages message content using Direct protocols.

- Secures the confidentiality and integrity of the content through data encryption.

- Ensures the authenticity of the sender and receiver.

- Routes the Direct messages.

In short, a HISP ensures that your Direct messages are delivered securely to the correct recipient.

Learn more about the HISPs in RI REC's Vendor Marketplace.

How did the RI Regional Extension Center (RI REC) choose the HISPs in its Vendor Marketplace?

HISPs were evaluated for inclusion in RI REC's Vendor Marketplace based on their technical adherence to Direct standards; the products and services they offer; their pricing model; their level of participation in the national Direct Project; and their willingness to participate in the Rhode Island Trust Community.

Can I use a HISP that is not in RI REC's Vendor Marketplace?

Yes, but using a vendor in RI REC's Vendor Marketplace means the vendor you select has been vetted for technical compliance, offers discounts to RI providers, and will participate in the Rhode Island Trust Community.

Who controls Direct user names and passwords?

Your HISP will work with you to set up user names and initial passwords. Once your Direct service has been established, an administrator within your organization will be able to create new Direct accounts and set and reset account passwords.

Do I need an EHR to adopt Direct messaging?

An EHR is not required to use Direct messaging to communicate electronically with other providers.

What do I need to use Direct messaging?

To exchange Direct messages, you need a Direct account provided through a HISP, a computer with Internet access, and a Web browser to access the Web-based email client.

Do I need to buy any special equipment to use Direct messaging?

Web-based Direct messaging can be used from any Internet-connected computer with a Web browser.

How much does Direct messaging cost?

Your total cost for Direct messaging will vary, depending on the type of services you purchase from a HISP. Basic, Web-based email costs $10 to $15 per month per account. For information about HISP services and cost models, visit RI REC's Vendor Marketplace.

Using Direct messaging

Can I send text in a Direct message? What about an attachment?

Just like any Web-based email, you can enter your own text in a Direct message and attach any type of document.

How do I find the Direct addresses of other Direct users?

At this time, there is no comprehensive directory of Direct addresses. You'll need to contact providers to obtain their Direct addresses.

How do I know if my Direct message was successfully delivered?

You will receive a notice in your Direct Inbox when a message is successfully delivered, or when a message cannot be delivered.

What if I send a message from my Direct account to a regular email account? Or what if someone tries to send a message to my Direct account from a regular email account?

A Direct message can be delivered only if both the sender and recipient are using Direct accounts and have established a trust relationship. Otherwise, the transmission will fail and the sender will be notified.

Will I be able to use Direct only to communicate with other medical practices? What about hospitals and other facilities?

Any care provider with a legitimate need to exchange PHI is eligible to use Direct. You can exchange messages with any other Direct user, provided you have established a trust relationship.

In addition to working with practices to adopt Direct, the Rhode Island Quality Institute also is working with hospitals and other healthcare facilities to encourage the use of Direct messaging.

What is the relationship between CurrentCare and Direct messaging?

Direct messaging was originally envisioned as a secure mechanism for provider-to-provider electronic communication of PHI. Now, the Direct protocol also is being used as a technical component in several services of CurrentCare, the statewide Health Information Exchange.

Is Direct integrated with my EHR?

EHR vendors have different plans and timelines for integrating Direct into their products and services. Direct is a nationally recognized, open source standard, so we anticipate that many EHRs will be including Direct in their product roadmaps. For information about your EHR and Direct, please contact your vendor directly.

Rhode Island Trust Community (RITC)

What is the RI Trust Community?

The Rhode Island Trust Community (RITC) was created by the Rhode Island Quality Institute. It is a community of verified RI providers who have a legitimate need to use Direct Messaging. The RITC streamlines your contacts management and provides an extra layer of confidence.

Why should I join the RITC?

"Community" is the key benefit of the RITC. Within the RITC, critical patient data flow smoothly, allowing RI providers to move beyond the closed networks that can limit data exchange. The efficient data exchange improves patient care coordination between healthcare providers, reduces redundancy (eg, fewer duplicate lab tests), and leads to overall better care for patients.

What does it cost to join the RITC?

RITC membership is free for the first 12 months. Members pay only the annual renewal costs for the RITC certificate, currently approximately $11 per account per year.

How do I join the RITC?

Complete the RITC Participation Agreement and submit it to RIQI with the required documentation. RIQI will review the application and, once approved, work with your HISP to issue the RITC certificate.

Why do I have to provide additional information and documentation to join the RITC?

The information and documentation is used by the Rhode Island Quality Institute (RIQI) to establish technical trust based on Direct and Federal Bridge Certification Authority regulations. As a Registration Authority, RIQI has to have a single, uniform process to apply to all RITC applicants.

RIQI is obligated by the members of the RITC to validate uniformly every entity that applies for membership. RITC members must have confidence in the integrity of the process that screens applicants for membership. Membership in the RITC must provide a high degree of assurance that the entity can be trusted with the patient's PHI.