3 ms·

The Direct Project is an email encryption scheme that hopes to replace the mail and fax currently used by American physicians to communicate patient health info

The Direct Project is an email encryption scheme that hopes to replace the mail and fax currently used by American physicians to communicate patient health information. It is a requirement for Stage 2 (2014) Meaningful Use certified EHR software. So this is going to be adopted on a large scale in the next year or two. It uses SMTP to transmit SMIME messages signed with X.509. Public keys for recipients are discovered either via DNS (as a CERT record) or via LDAP. Those discovered certificates are only trusted if the two parties have previously exchanged a trust anchor. Direct itself does not define how trust relationships are initiated (which is a problem with scalability). So infrastructure is being formed around the protocol - such as HISPs and Trust Communities. HISPs intend to operate similar to how email providers operate - by providing web portals and edge protocols. Trust Communities are intended to create bundles of trust anchors for companies that have passed as certain level of accreditation. There are currently two fully functional open source Reference Implementations in Java and C#. http://directproject.org/ http://directproject.org/ http://wiki.directproject.org/ http://wiki.directproject.org/ http://wiki.directproject.org/Reference+Implementation+Workgroup http://wiki.directproject.org/Reference+Implementation+Workg...

owenfi 13y ago
One of the mechanisms for relationship building is Blue Button+[1] We have a version of the java reference implementation up and running, so I can vouch for it. I have been thinking about it in context of the privacy atmosphere for quite a while now. On one hand I'm excited that such a technology could also be used for secure communication and on the other I'm worried that health records will be susceptible to the same coercion. [1] https://secure.bluebuttontrust.org/ https://secure.bluebuttontrust.org/
- sixothree 13y ago
  Agreed. Also, ONC has endorsed Direct Trust which has an accreditation process which will likely consolidate providers into HISPs, which will make easy targets for same coercion you speak of. But a slightly altered system where private keys are not consolidated might be a huge improvement.

owenfi 13y ago

One of the mechanisms for relationship building is Blue Button+[1] We have a version of the java reference implementation up and running, so I can vouch for it. I have been thinking about it in context of the privacy atmosphere for quite a while now. On one hand I'm excited that such a technology could also be used for secure communication and on the other I'm worried that health records will be susceptible to the same coercion. [1] https://secure.bluebuttontrust.org/ https://secure.bluebuttontrust.org/

sixothree 13y ago
Agreed. Also, ONC has endorsed Direct Trust which has an accreditation process which will likely consolidate providers into HISPs, which will make easy targets for same coercion you speak of. But a slightly altered system where private keys are not consolidated might be a huge improvement.