The Direct Project aims to improve health information exchange by specifying a simple, secure, and scalable standard for sending encrypted health information directly between known trusted recipients over the internet. It uses common internet protocols like SMTP, S/MIME, and DNS to allow easy and secure communication of clinical information among healthcare providers and patients. Several major healthcare organizations and vendors have announced plans to support the Direct standard to facilitate widespread adoption by late 2012.

1. The Direct Project Ali Emami Software Engineer aliemami@microsoft.com

2. Quick History of the Direct Project 5/28/2011 Launched just after HIMSS 2010 Response to community frustration about state of exchange Collaboration across the industry: government, vendors, advocates Today: real production use in multiple programs across the country

6. Direct ProjectHigh quality open source libraries The history of the Internet shows the power of permissively licensed open source in driving standardization: TCP/IP: Berkeley TCP/IP stack DNS: BIND HTTP: Apache Successful open standards have easily accessible high-quality libraries trivially available to developers, including high quality documentation A key deliverable of Direct Project is a BSD-licensed software stack enabling: Client-side connectivity, for EHRs, EHR Modules, PHRs, etc. and Server-side connectivity for “out of the box” HIOs and Health Information Service Providers (HISPs)

7. Protocols and Technology SMTP Gateway Direct uses SMTP as its transport protocol. S/MIME Messages are signed and encrypted using the S/MIME standard. A decades old protocol for ensuring authenticity, non-tampering, confidentiality, delivery only to intended recipients. DNS Used to serve up certificates bound to an e-mail address or organization. The highest scale distributed directory on the planet. Powers internet addressing. Configuration Web Service and DB Storage and access to org’s certs, private keys, trust anchors

8. HISP Internet Email Server SMTP Gateway Security & Trust Agent MIME + TLS XD* Agent Firewall SOAP Client HTTP Gateway XD* SOAP Endpoint Configuration Web Service SQL HTML/HTTP Admin DNS Gateway Configuration Web UI DNS Server

9. Scenario: Doctor to patient messaging Dr. Alex wants to send a visit summary to patient Jill. From: alex@direct.ahospital.org To: jill@direct.aphr.org Subject: Your health visit summary Jill, Here is the summary information from your visit. - Dr. Alex <Summary Attached>

10. Sending a message Alex creates and sends the message using his favorite e-mail client. Or his hospital’s EHR software. A Direct gateway is installed at ahospital.org. Secure e-mails at ahospital are relayed through this gateway. The gateway receives the message and determines it needs Jill’s certificate in order to send the message. It uses DNS to resolve it. The gateway: Signs the message with Alex’s private key. Encrypts the message with Jill’s public key. Sends the message over SMTP to Jill’s gateway. 5/28/2011

11. Receiving a message Jill is using a PHR system that provides her with a Direct address. Microsoft HealthVault is one such PHR system. The PHR’s Direct gateway receives the message from ahospital.org. The gateway looks up Jill’s private key from its local configuration backend. Jill’s Gateway: Decrypts the message using Jill’s private key. Verifies the signature on the message is valid. Verifies that the signer is trusted. ie. Jill trusts Dr. Alex. Forwards the message to Jill’s inbox. 5/28/2011

12. More scenarios Provider-to-Provider scenarios have equivalent flow. Scenario: Referring doctor sends patient information to another doctor. Patient-to-Provider scenarios are just as easy! Gateways can be configured to allow incoming messages, outgoing messages, or both for a given address or domain. Example: Doctor wants to send to patients but NOT receive.

14. Implementation Guides

15. Reference Implementation

16. Pilot project testing and real-world implementationVendors incorporate reference implementation into HIT products Wide-scale adoption of Direct standards by late 2012 First phase grounded in real-world pilot projects implemented by early 2011 Incorporation of HITPC, HITSC, and ONC policy guidance

17. Momentum is Remarkable Some vendors that have already announced plans to support the Direct Project include: · Allscripts · CareEvolution · Cerner Corporation · Covisint · eClinicalWorks · Epic · Greenway Medical Technologies · Kryptiq Corporation · MedPlus (A Quest Diagnostics Company) · Microsoft Corporation · NoMoreClipboard.com · OpenEMR · Siemens · Surescripts · VisionShare

19. Hundreds of thousands of physicians

20. Millions of providers

21. Tens (or hundreds?) of millions of patients

22. Many other stakeholders in healthcare- 14 -

23. Links to Direct Project Resources Get involved! http://wiki.directproject.org C# Reference: http://wiki.directproject.org/CSharp+Reference+Implementation Java Reference: http://wiki.directproject.org/Java+Reference+Implementation For more informationMy e-mail: aliemami@microsoft.com