1. Direct Project HITSC Presentation
October 2010

2. Direct Project
A project to create the set of
standards and services that
with a policy framework enable
simple, directed, routed, scalable
transport over the Internet to be
used for secure and meaningful
exchange between known
participants in support of
meaningful use
2

3. Why Direct Project?
Communication of health information among providers and patients still mainly relies on mail
or via fax
• Slow, inconvenient, expensive
• Health information and history is lost or hard to find in paper charts
Current forms of electronic communication may not be secure
• Off-the-shelf e-mail clients do not encrypt information
Meaningful use stages
• Need to meet physicians where they are now
• Both Direct and the current Nationwide Health Information Network model will be needed to
support nationwide health information exchange
01/29/15
Sources: http://www.flickr.com/photos/dougww/922328173/ http://www.flickr.com/photos/greenlagirl/154148230/sizes/o/ http://www.flickr.com/photos/kenjonbro/3418425029/sizes/m/
Current methods of health information exchange are inadequate.

4. Direct Project Organization
The Direct Project represents over 60 organizations and over 200
participants.
• Members participate in the Implementation Group and one or more
of 6 workgroups.
Implementation Group
(60+ organizations, 200+ participants)
Security
and Trust
WG
Security
and Trust
WG
Best
Practices
WG
Best
Practices
WG
Implementation
Geographies
WG
Implementation
Geographies
WG
Communications
WG
Communications
WG
Documentation
and Testing
WG
Documentation
and Testing
WG
Reference
Implementation
WG
Reference
Implementation
WG

5. Close to 200 Implementation Group Participants
in over 60 organizations
» Alere
» Allscripts
» American Academy of Family Physicians
» Atlas Development
» Axolotl
» CareSpark/MobileMD/Serendipity Health
» Cautious Patient
» Cerner
» Clinical Groupware Collaborative
» CSC
» eClinicalWorks
» Emdeon
» Epic
» FEI
» GE
» Google
» Greenway Medical Technologies
» Harris Corporation
» High Pine Associates
» HLN Consulting, LLC
» IBM
» ICA
» Indiana State Department of Health
» Inpriva
» Intel
» Kryptiq
» LabCorp
» Massachusetts eHealth Collaborative
» MedAllies
» Medical University of SC
» Medicity
» MedNet
» MedPlus/Quest Diagnostics
» Microsoft
» Mirth Corporation
» MOSS
» NextGen
» NIH NCI
» NIST
» NYC Dept. of Health and Mental Hygiene’s
PCIP
» Oregon HIE Planning Team
» Redwood MedNet
» RelayHealth
» Rhode Island Quality Institute
» Secure Exchange Solutions
» Siemens
» South Carolina SDE
» Surescripts
» Techsant Technologies
» TN State HIE
» VA
» VisionShare

6. Direct Project
High-Level Project Plan
Activity
Standards and Specification
Development Activity
Real-world Implementation
Activity
Regulatory Activity
Policy Activity
Immediate
Next 90 Days
Short Term
3 to 9 months
Long Term
9 to 36 months
Immediate
Initiatives
Short Term
Initiatives
Long Term
Initiatives
Initial Pilot
Implementation
Expansion
of Pilots
Draft Specification
Complete
Transition to an SDO Ongoing Maintenance
Evaluation for inclusion by NHIN
and ONC Endorsement
HITPC Tiger Team Framework
and Policy Review
Feedback to NHIN
Governance
Feedback on initial
lessons learned
Ongoing Review and
Feedback
Wide-Scale
Deployment
Evaluation by HITSC

7. Direct Project
Real-World Implementation
-
7
-
Direct Project will be demonstrated in real-world pilots across the
country
CareSpark (TN)
Redwood MedNet
(CA)
MedAllies (NY) Rhode Island
Quality Institute
(RI)
Medical
Professional
Services (CT)
VisionShare (MN)
VisionShare (OK)
Direct Project is architected for rapid
adoption by:
• Thousands of hospitals
• Hundreds of thousands of physicians
• Millions of providers
• Tens (or hundreds?) of millions of patients
• Many other stakeholders in healthcare

8. Key Positive Lessons From Direct
» Focused problem-solving around a particular business
case drives engagement
» Asking participants to commit to implementation and
pilots drives positive behavior and focus
» The policy tools at ONC's disposal work to engage
industry broadly
• Aligning federal partners, states with private companies
generates more value than the sum of its parts
» Open source reference implementations are a key tool
to promote standards adoption by lowering the total
industry cost to achieve the value chain
» Communities are awesome things…

9. Key Improvement Lessons From Direct
» Implementation group grew too large, too fast
• In future, set the commitment bar even higher and
have firm limits on number of participants
» Driving to code and driving to implementation drive focus
• Set earlier milestones to set work to code and pilot
test
» US HIT standards world has fundamental philosophical
splits: E.g., quality first or liquidity first?
• Define the problem better, get clearer about national
priorities, establish shared policy context
» Consensus is challenging
• First two improvements would have helped
• Choose your own adventure: trust the community
OR establish independent trusted review

10. Direct: A test of “trust the community”
» Pre-July “findings”
• Need to support structured and unstructured content, often in the
same transaction
• XDR/XDS had implementation support in many modern EHRs
• XDR needed modifications to separate transport metadata from
content metadata
• XDR and XDM has strong support for comprehensive content
packaging with package-level metadata but we couldn’t expect the
broadest range of providers to produce such packaging
• Something more ubiquitous needed to support the broadest
community of providers (strong support for SMTP + web-apps at
the edge)
• Trust model required relatively sophisticated approach to
encryption and signatures (mutual TLS not sufficient)
01/29/15

11. Direct: A test of “trust the community”
» In July, we had a choice of three alternatives:
• XDR (SOAP) as backbone + SMTP/XDR at the edge
• REST as backbone + REST/SMTP/XDR at the edge
• SMTP as backbone + SMTP/XDR at the edge
» After weeks of negotiation, community chose:
• SMTP as backbone but XDR end to end if known support and trust
model
• SMTP and XDR at the edge
» So….
• “Genius of the And” and triumph of the community?
• Mushy middle and design by committee?
01/29/15

12. Measures of engagement
» Since consensus, we’ve seen strong community engagement, as
measured by reference implementation code commits, active edits to the
wiki (less quantitative: energy in calls, active planning for pilots, etc.)
» Significant announcements, seeing specifications built into EHR, HIE
products and services
» Interesting tests of both SMTP and XDR backbones
01/29/15

13. Answers to common objections
» Choice of SMTP is a step backwards from structured content, HITSP-
endorsed standards
• Both SMTP and SOAP transport can carry structured (e.g., CCD,
HL7 v2) OR unstructured content (e.g., text, PDF)
• HITSP-endorsed XDR (over SOAP) and XDM (over SMTP) also
carry content packaging metadata (i.e., package manifest)
» SMTP means spam, identity spoofing, privacy risks, etc.
• S/MIME gives strong assurance (with appropriate identity
assurance and certificate issuance) in sender and receiver
• S/MIME-based encryption means only intended receiver or
authorized delegate can view PHI
» Certificate distribution is a hard problem
• Yes, but unavoidable without a centralized trust model
• Mitigate through DNS distribution, HISP architecture (delegate
encryption, verification duties) in the short term
01/29/15

14. Four Steps to Universal Addressing
• Reference Implementation: Solid, simple set of code and strong documentation.
• Pilot Demonstrations: Successful incorporation of reference implementation and lessons
learned which show that anyone can easily adopt Direct.
• Vendor Adoption: Base interfaces available for purchase and code and software installed
in all HIT exchange products.
• Policy Guidance: Strong base for privacy, security, transparency standards lead to more
tractable scalling for PKI, trust
11 22 33 44
Successful implementation and adoption of Direct relies on four key steps.

15. NHIN Direct + Interoperability Framework = Focused Collaboration
Bottom up use case development within a
top-down coordination framework
CORE PRINCIPLES
Prioritization
Transparency
Engagement
Rapid Results
Focused
Collaboration
Thousand
Blossom
Blooms
Command
and Control
Low High
Participation
Classic
Trade-O
ff
LowHigh
Focus

16. Approach to S&I Framework
NATIONAL GOALS: QUALITY, COST, ACCESS, PUBLIC HEALTH
(HITECH, ACA, etc.)
NATIONAL GOALS: QUALITY, COST, ACCESS, PUBLIC HEALTH
(HITECH, ACA, etc.)
Robust Interoperability Across Settings of Care, Increased "Systemness" of Care Delivery
“ultra-large scale systems”
Robust Interoperability Across Settings of Care, Increased "Systemness" of Care Delivery
“ultra-large scale systems”
Tools and Services
(Use Case Development, Harmonization Tools, Vocabulary Browser, Value Set Repository, Testing Scripts, etc)
(Stanley)
Tools and Services
(Use Case Development, Harmonization Tools, Vocabulary Browser, Value Set Repository, Testing Scripts, etc)
(Stanley)
Use Case Development
and Functional
Requirements
(Accenture)
Use Case Development
and Functional
Requirements
(Accenture)
Certification
and Testing
(Stanley/Deloitte)
Certification
and Testing
(Stanley/Deloitte)
Harmonization of
Core Concepts
(Deloitte)
Harmonization of
Core Concepts
(Deloitte)
Implementation
Specifications
(Deloitte)
Implementation
Specifications
(Deloitte)
Reference
Implementation
(Lockheed Martin)
Reference
Implementation
(Lockheed Martin)
PRIORITY 1 PRIORITY 2 PRIORITY 3 PRIORITY 4
Value and Outcome Focused Projects to Address Key Obstacles, Prioritized by Value, MU, Leverage
2 Months2 Months 2 Months

17. Priority Levels
2 Months
2 Months
2 Months
Tools and Services
(Use Case Development, Harmonization Tools, Vocabulary Browser, Value Set Repository, Testing Scripts, etc)
(Stanley)
Tools and Services
(Use Case Development, Harmonization Tools, Vocabulary Browser, Value Set Repository, Testing Scripts, etc)
(Stanley)
Use Case Development
and Functional
Requirements
(Accenture)
Use Case Development
and Functional
Requirements
(Accenture)
Certification
and Testing
(Stanley/Deloitte)
Certification
and Testing
(Stanley/Deloitte)
Harmonization of
Core Concepts
(Deloitte)
Harmonization of
Core Concepts
(Deloitte)
Implementation
Specifications
(Deloitte)
Implementation
Specifications
(Deloitte)
Reference
Implementation
(Lockheed Martin)
Reference
Implementation
(Lockheed Martin)
PRIORITY 1
PRIORITY 2
PRIORITY 3
PRIORITY 4

18. Principles
» Organizing principle – “solving problems” throughout the entire value
chain, and use that as the “glue” for the other metrics from OIS
» Each team in the S&I framework will assist in solving a problem
» Operationalize the process and problems with metrics, risks and
milestones
» Solve value focused problems in small increments; build consistency
across projects through a national vision and a model-based
approach
» Balance between bottom-up goal-directed coordination and top-
down structured coordination