What is a Health Information Service Provider?

A Health Information Service Provider (HISP) is an organization that manages the security and transportation of protected health information. The HISP can also perform HISP-related functions on behalf of sending or receiving providers. HISPs can:

• Provide Direct email addresses to approved registered users
• Enable transport for HISP-to-HISP communications
• Publish digital certificates to establish trust
• Encrypt content and attachments to secure confidentiality and integrity
• Ensure authenticity of sender and recipient
• Route Direct messages to the intended recipient

CareAccord participates in DirectTrust’s Accredited Trust Bundle, comprised of HISPs, CAs, and RAs that have achieved accreditation through the EHNAC DirectTrust Trusted Agent Accreditation Program (DTAAP). All participants in this bundle have not only successfully achieved DTAAP accreditation status, but have also met the requirements set forth by DirectTrust and verified interoperability with other members of the Accredited Trust bundle.

The key value proposition of the DirectTrust Accredited Trust Anchor Bundle is to facilitate interoperable Direct exchange between HISPs in a uniform and scalable manner that is consistent with industry best practices for security and trust, thereby avoiding the need for further one-off negotiations between relying parties who are participants in the bundle.

As a HISP, CareAccord manages the security and transportation required to exchange key health information using Direct protocols. CareAccord works behind the scenes to ensure that messages are delivered securely to other users in the CareAccord Trust Community, which includes CareAccord users and trusted providers that participate in CareAccord’s Flat File Directory service.

CareAccord also issues Direct secure messaging addresses and attaches certificates to those addresses to ensure that providers can safely and security send protected health information to other Direct users, both inside and outside of CareAccord.

What is Health Information Exchange?

Health Information Exchange (HIE) allows doctors, nurses, pharmacists, and other health care providers to securely share a patient’s medical information electronically—reducing the need for patients to transport or relay their medical history, lab results, images, or prescriptions between their health professionals. Instead, this information is shared between health care professionals before the patient arrives for an appointment or goes to a pharmacy. HIE can also reduce orders for duplicate procedures or tests because information is available where and when it is needed, as well as enabling smoother transitions of care because providers, hospitals, and long-term care facilities can more easily share information.

Oregon’s approach to exchanging health information is based on efforts already underway in local communities. Oregon’s Strategic and Operational Plans for HIE outline the phased approach to build on and connect community efforts. The Oregon Health Authority’s Office of Health Information Technology has implemented CareAccord, a Direct secure messaging system, to help providers share data and meet the meaningful use requirements as defined through the Medicare and Medicaid EHR Incentive Programs.

Oregon Health Authority’s other goals include:

• Widespread use of Direct secure messaging
• Adoption of EHRs, particularly in underserved areas
• Security and privacy in data exchange
• Consumer education about how health information technology and electronic HIE can be used to improve health and lower the cost of health care