ONC releases Direct guidelines for secure HIE

The Office of the National Coordinator for Health IT has released guidelines to provide recommended policies and practices for health information service providers (HISPs), trust communities and accrediting bodies such as DirectTrust to enable providers to securely exchange patient information across geographic, organizational and vendor boundaries.

The Direct Implementation Guidelines for Assuring Security and Interoperability were developed due to ONC's concern that HISPs were not using a "common standard" and were "creating islands of automation." ONC encourages adoption of the guidelines and believes that voluntary adoption will help providers meet Stage 2 of the Meaningful Use program and provide care coordination.

"The new guidelines reflect the results of consensus reached by Direct Project community participants at an open forum we held last November," wrote ONC's Claudia Williams, director of the State Health Information Exchange Program, in a Health IT Buzz blog post. "Alignment with these guidelines will help Direct implementers across the country overcome policy and implementation differences that have limited cross-vendor and cross-community exchange to date."

Recommended guidelines include the following:

• Have a contractually binding legal contract with clients who send and receive patient information, including all terms and conditions needed in a business associate agreement;
• Issue Direct addresses only to organizations and/or individuals that have had their identities verified according to NIST level 3 assurance requirements; and
• Provide users with mechanisms to directly establish trust with another user.

"The guidelines will give providers and their data trading partners confidence that Direct is being implemented in a manner that supports privacy, security and interoperability," Williams wrote.

ONC opted not to proceed with regulations mandating HIE governance, and instead provide voluntary support to entities working to improve interoperability. Patients and others have expressed concerns about the security of data being shared electronically.

The guidelines complement, but do not change, the Direct technical specification, she wrote.