Throughout this year, WISHIN has been working with its participants to set up Direct messaging so they can exchange patient health information with other providers via secure email integrated into their electronic health record (EHR) systems. Direct messaging allows participants to exchange patient health information with other providers electronically, which can reduce the need to send medical records via facsimile or courier service. Direct messaging is also one of the methods that providers can use to meet their Stage 2 Meaningful Use Objective for Transitions of Care.

 
Because the technology and standards are still evolving, implementing Direct messaging has posed several challenges for WISHIN customers.  WISHIN transports and serves as consultants to organizations and their EHR vendors working to establish Direct messaging services.  This article helps organizations understand and become aware of some of these challenges - and provides some recommendations for how to navigate the challenges in order to meet the Transitions of Care Objective.   

Challenge 1: Communicating Across Closed Networks

For the past few years, Direct has been touted by many as a way for any provider with a Direct address to be able to communicate with any other provider that had a Direct address - just like how email works today.  As it turns out, it isn't quite this simple. 

Direct messaging consists of closed, secure email networks that require participants to have security certificates in order to communicate within the network. Once participants are part of a network, they can communicate with anyone else inside that same network (see Diagram 1: Closed Network).   

As a provider, this means that you are limited to sending and receiving messages about your patients to/from other providers within your same closed network, which isn't very realistic or practical.

Diagram 1: Closed Network

In order for members of one network to communicate with members of another network the two networks have to establish a trust relationship with each other.  Trust relationships are established by exchanging certificates and trust anchors (see Diagram 2: Exchange Between Networks).  Without this trust relationship, the messages can't go through. 

Diagram 2: Exchange Between Networks

If members of a network need to communicate with members of more than one other network, a separate trust relationship is required for each network. See Diagram 3: Exchange Among Multiple Networks for a graphical depiction of how this works.  It is important to note that messages can only be exchanged between networks that have point-to-point trust relationships established - they cannot go through one network to get to another.  For example, in Diagram 3, providers in Network C could not exchange messages with Network B because there is no separate trust relationship between Network C and Network B. Network A, however, can exchange with Networks B, C and D because it has established separate trust relationships with each. 

While establishing point-to-point trust relationships isn't technically difficult, it does require that organizations know and understand who they will be exchanging with and what network they belong to.  Providers that do a lot of referrals - or see a lot of referred patients - will likely have to set up several trust relationships in order to ensure they can send Direct messages to all of the providers they need to communicate with.  This can get complicated quickly.

Diagram 3: Exchange Among Multiple Networks

Participation in DirectTrust, an independent non-profit trade association created by and for participants in the Direct community, simplifies this complexity. DirectTrust establishes and maintains a national Security and Trust Framework in support of Direct exchange. The Trust Framework is a set of technical, legal, and business standards, expressed as policies and best practice recommendations, which members of the trust community agree to follow, uphold, and enforce. DirectTrust also offers an Accreditation Program for vendors that offer Direct messaging services.  Accredited vendor solutions become part of a "Trust Bundle" that, put simply, establishes those trust relationships mentioned earlier in this article.  DirectTrust is still a closed network; however, it is a closed network that contains several other closed networks, so the number of point-to-point trust relationships needed is greatly reduced.

WISHIN is a member of DirectTrust and WISHIN's vendor is part of the "Trust Bundle."  Being part of DirectTrust allows WISHIN Direct+ customers to  communicate with providers that use other Direct solutions - and eliminates the need for WISHIN to set up individual point-to-point relationships with other DirectTrust participants, including providers using technical solutions offered by  Cerner, SureScripts, and RelayHealth (see a full list of DirectTrust participants here:  http://www.directtrust.org/trust-bundles/).  This means that WISHIN Direct+ customers are able to exchange with other WISHIN Direct+ customers as well as with other DirectTrust members.  Being part of DirectTrust allows WISHIN to offer the broadest possible network for exchange for WISHIN customers.

DirectTrust is still a closed network. This means that separate point-to-point trust relationships are still needed for DirectTrust members to communicate with non-DirectTrust networks.  Diagram 4: DirectTrust to Non-DirectTrust Exchange shows how DirectTrust participation allows exchange within the DirectTrust "bundle" and how separate trust relationships are still required outside the "bundle".  It is important to note that a point-to-point relationship established by one DirectTrust member does not apply to all of the DirectTrust members - they only apply to that one trust relationship.  For example, in Diagram 4 you can see that Network B has set up a separate, point-to-point trust relationship with Network D.  This allows Network B and Network D to communicate but it does NOT allow Network D to communicate with Network A or Network C (or vice versa).  If Network A or Network C wanted to communicate with Network D they would need to set up their own, separate, point-to-point trust relationship with Network D.

Diagram 4: DirectTrust to Non-DirectTrust Exchange

Even though WISHIN is part of DirectTrust and WISHIN Direct+ customers can exchange with the other DirectTrust networks, there are still several other networks that are not part of DirectTrust.  WISHIN has set up several point-to-point trust relationships with non-DirectTrust networks in order to ensure that providers can securely exchange with other providers regardless of their chosen technology solution.  There's a lot of technical and policy-related work that goes into setting up these relationships in order to ensure that the communications are secure and managed appropriately, but once established, they are invisible to the providers that are using the service.

Challenge 2: Knowing the Direct Addresses of Other Organizations

As with email, users must know the Direct address of the organization or provider they are sending a message to. Unfortunately, there is no established national standard for formatting or exchanging provider directories, making it difficult for providers to know where to send their messages.  

To help our customers and the Wisconsin provider community, WISHIN is maintaining a website of Direct email addresses for its customers and other organizations that communicate with WISHIN customers (http://www.wishin.org/Products/WISHINDirect/ProviderDirectories.aspx). The Provider Directories are listed by health system or organization, and whether the organization is a WISHIN participant, a DirectTrust member, or has a trust relationship with WISHIN (called a "Trusted HISP" (Health Information Service Provider)):

• WISHIN Participants:  WISHIN Direct+ customers and DirectTrust members can download  the provider directories and communicate with organizations in this category.
   
• DirectTrust Participants:  WISHIN Direct+ customers and DirectTrust members can download  the provider directories and communicate with organizations in this category.
   
• Trusted HISPs:  Only WISHIN Direct+ customers can download and exchange emails with organizations in this list. WISHIN has established separate point-to-point trust relationships with these HISPs.

All of the provider directories shared on our website have a consistent format, to keep the importing process consistent for organizations.

 WISHIN is also working with other health information exchange organizations to determine standards and share provider directories with other states, such as the Community Health Information Collaborative in Minnesota, and the Mid-States Consortium of Health Information Organizations, which includes health information organizations from several other states in the Midwest.  We expect that our current provider directory webpage and directory formats may change as these initiatives progress.

If you'd like your organization's provider directory added to WISHIN's website, please send your address list to WISHIN Support at: wishin.support@wishin.org. Make sure to let WISHIN know whether your Direct messaging solution/vendor is part of DirectTrust, or if you'd like WISHIN to establish a separate, point-to-point trust relationship with your organization.

Challenge 3: Different Standards for Different Connections

Meaningful Use Stage 2 EHR Certification requirements (called 2014 CEHRT) allow two separate technical standards for exchanging Direct messages.  Unfortunately, the standards are not totally compatible with each other, which causes problems when providers using a system with one standard attempt to exchange with providers using a system with a different standard. 

For those with a technical background:  To become certified for Stage 2 Meaningful Use, EHR vendors were required to be enabled for Direct messaging using an SMIME over SMTP connection with a working Health Information Service Provider (HISP).  Optionally, vendors could also certify for Direct messaging through an XDR method, but this was not required. Using an XDR method allows health care organizations to use a third-party vendor, like WISHIN, as the HISP.

WISHIN has experience with technical solutions that leverage both technical standards, has seen many variances in how the standards are implemented, and in how they are (or are not) able to exchange with other solutions.  Some key issues we have seen include:

• Many SMTP/SMIME solutions did not go through the optional certification for SOAP/XDR and cannot open incoming messages that follow the XDR standards. This means that, while the message is received by the system, it may not be able to be opened by the receiving organization, and vital health information may not be seen by the providers.
   
• All SOAP/XDR solutions require that incoming messages have a care summary attached to them (in order to get the patient identifier).  If the incoming message does not have a care summary attached the message is dropped. This means that, if a provider is sending an email with health information inside the email (e.g., in the message body), instead of attached as a care summary (for example, an allergy list or latest blood pressure test result), there is no guarantee that the receiving provider will receive the message. 
   
• In situations where a care summary is attached and can be delivered (such as between two systems using SOAP/XDR), there can still be an issue if the care summary doesn't meet certain content or formatting requirements of the receiving EHR.  In those cases, some EHR solutions will not allow the care summary to be incorporated into the EHR.

The solutions to these issues are as unique as the problems.  As a result, WISHIN works through each of these issues on a case-by-case basis in order to ensure our customers can exchange with providers that are part of their referral or care transition work flow.  Extensive testing and, often, system modifications, are needed in order to ensure that the Direct message reaches its intended recipient with all of its intended content.  Even so, there are still significant gaps - and providers need to be aware that they cannot assume that their messages, and all of the contents, will reach the intended recipient without testing. 

WISHIN Recommendations

To overcome these challenges, WISHIN has some recommendations for health care organizations:

1. Know the requirements and limitations of your own system. You can use the checklist of questions below to have a discussion with your EHR vendor.

2. Identify your key exchange partners, and know the requirements and limitations of their systems. Again, you can use the checklist of questions below to have a discussion with your key exchange partners.

3. Test exchanging Direct messages with your key exchange partners. Each EHR vendor has a different setup and has slight differences in their care summary format. There may even be slight differences between the configuration and care summary formats within the same EHR vendor.

4. If there are incompatibilities between your system and your data exchange partner's system, make sure you have policies and processes in place to account for these. For example, if an EHR vendor only allows messages with care summaries attached to them, make sure the providers in your organization have a process in place to ensure all messages to that organization have a care summary attached.

Key Questions to Ask Your Vendor and Data Exchange Partners

Use the following list of questions to find out the requirements and limitations of your own system, along with the requirements and limitations of your key data exchange partners' systems.

1. Does the HISP use XDR or SMIME?

• If it is SMIME:
  • Was it also certified for XDR?
  • Will it receive incoming messages formatted to an XDR standard (a ZIP file)?

2. Is the HISP part of DirectTrust and in the DirectTrust bundle?

• If it is not part of DirectTrust:
• Are there plans for it to become part of DirectTrust?
• Will it allow organizations to establish point-to-point trust relationships with it?

3. Can the EHR receive messages without a care summary attached?

4. Will the EHR drop care summaries that don't meet certain formatting or content requirements for importing messages?

5.  What type of alerting is in place if a message fails on the sending or receiving side? Who gets the alerts?  And, if the provider does not get the alert, is there a process by which the provider would be informed that a message didn't go through or that an incoming message is incomplete?

6. How does the EHR export and import Direct addresses? Is there a specific format required?

Remember:  This is New Technology

 As you're implementing and testing Direct messaging, one of the key things to remember is that this is new technology for everyone - including the vendors. WISHIN, along with other HISPs and EHR vendors, are still learning about the challenges that Direct messaging presents and are using these lessons learned to continue to improve the technology and the efficiency of electronic data exchange.

If you have any questions about your Direct setup, how to exchange Direct messages with WISHIN customers, or need to set up Direct messaging for your organization, contact WISHIN at:  wishin.support@wishin.org.

For more information about DirectTrust, visit:  http://www.directtrust.org/.