DirectTrust Financial Services accreditation covers organizations that process healthcare payments and remittances, through two programs assessed against the 2026 criteria versions “Financial Services Network v6.1” and “Financial Services Lockbox v6.1”. It is for payment networks and lockbox services handling healthcare transactions. Integral Healthcare Solutions (IHS) drafts the procedures and evidence file for it and runs a mock review; your operations and security teams own the controls.

Last reviewed: October 2026.

What is DirectTrust Financial Services accreditation?

DirectTrust says: “The programs ensure that the organization follows HIPAA security and privacy rules, supports ASC X12N 835 for electronic remittance advice transactions, and meets a range of criteria applicable specifically to financial electronic health networks.” (source)

“Each Financial Services Accreditation Program applicant is evaluated against sixteen financial criteria and three criteria that apply exclusively to financial and banking electronic health networks.” (source) DirectTrust adds that “Organizations are evaluated on technical requirements, timeliness of transactions, customer service, system availability, capacity, storage and retrieval, and other factors.” (source)

Network vs Lockbox

DirectTrust explains the difference: “Financial Services Accreditation Program for Lockbox differs from the other programs in that certain performance metrics are modified or not included. For instance, a lockbox operation does not receive standards-based transactions. Also, specific document handling and delivery criteria are unique to this program.” (source)

Both 2026 versions carry an asterisk in DirectTrust’s release, marking programs that contain its standard Privacy and Security criteria (source). The release covers new criteria versions for “its 28 accreditation programs starting January 1, 2026.” (source) DirectTrust states that its programs “are governed by the organization’s Electronic Healthcare Network Accreditation Commission (EHNAC).” (source)

The criteria are released on request, not published, so this page relies on DirectTrust’s public program pages. A draft 2027 criteria release is out for comment until November 17, 2026 (source).

Who needs it and what triggers it?

The buyer is a payment network, bank or lockbox service that handles healthcare payments, remittance data or payment documents for providers or payers. The triggers in the sources:

• State transaction processing. DirectTrust’s Financial Services page says “DirectTrust accreditation is required for processing healthcare transactions in the states of Maryland and New Jersey” (source). DirectTrust’s Healthcare Networks page uses softer wording, that accreditation “is accepted by Maryland and New Jersey to meet the requirement for processing healthcare transactions in those states” (source). IHS has not reviewed the Maryland or New Jersey statutes for this page; read them, or ask your counsel, before relying on either wording.
• A defined accreditation objective: a client or payer that asks for it, or a decision to put your healthcare payment operations against an external standard.

How IHS helps

IHS drafts the procedures and evidence file for DirectTrust financial-services accreditation; your operations and security teams own the controls. The work runs in this order:

1. Gap assessment of your operations against the Network or Lockbox criteria your organization obtains from DirectTrust.
2. Questionnaires on clients, subcontractors, transaction exceptions and data handling.
3. Document and evidence mapping: each criterion crosswalked to the procedure, log or system output that answers it.
4. Drafting: accountability, exception-handling, privacy and security procedures, for your leaders to review and approve.
5. Mock review of the self-assessment and evidence against the criteria.
6. Readiness support: drafted responses to findings for your organization to submit.

What your organization supplies: the criteria, client and subcontractor agreements, exception logs, and your financial operations, legal and security leads. Your organization submits its own application.

The limit: payment execution and cybersecurity controls belong to your specialists. IHS documents and organizes them and does not test them.

How the DirectTrust process runs

• Application: “An Accreditation Program Agreement must be signed by the applicant and submitted.” (source) and “A Financial Attestation to verify your organization’s revenue must also be submitted.” (source)
• Self-assessment: “Upon completion of the Application Process and approval, the Self-Assessment zip file will be made available to the organization, the Assessor will be assigned and the organization will be added to the Accredited Organizations page as a Candidate.” (source)
• Location review: “The purpose of a Location Review is to confirm that the practices documented by the organization are being carried out in real life.” (source)
• Decision: “The Commission reviews and votes on the Accreditation Report.” (source)
• Cycle: “The accreditation cycle is for 2 years.” (source) DirectTrust also “offers an optional Midterm Accreditation review.” (source)

DirectTrust does not publish a typical end-to-end timeline on the pages we reviewed.

For lockbox operations with several sites, DirectTrust says: “For financial organizations with multiple lockbox facilities that have sites that perform the same function demonstrating adherence to the same policies and procedures, a location review rotation will be used” (source). Its published rotation table lists, for example, 2 reviews for 2-4 locations and 3 reviews for 5-8 locations (source).

What to have ready

This list ties to DirectTrust’s published process and the Financial Services program page. The criteria text (Financial Services Network v6.1 or Financial Services Lockbox v6.1) governs; check each item against your copy.

1. A copy of the Financial Services Network v6.1 or Financial Services Lockbox v6.1 criteria, requested from DirectTrust (criteria are available on request).
2. A decision on which program fits your operation, using DirectTrust’s Network vs Lockbox description (program page).
3. HIPAA privacy and security policies (program page).
4. For Network applicants, documentation of your ASC X12N 835 electronic remittance advice support (program page).
5. Records on timeliness of transactions, system availability and capacity (program page).
6. Customer service procedures and records (program page).
7. Storage and retrieval procedures; for Lockbox applicants, document handling and delivery procedures (program page).
8. A list of locations, and for multi-site lockbox operations, evidence that sites follow the same policies and procedures (location review rotation).
9. A signed Accreditation Program Agreement and a Financial Attestation of revenue (accreditation process).
10. Evidence that your documented practices are carried out, for the location review (process).

If you want to walk through this list against your own operations, start with the introductory call.

How it compares

Payment organizations often already produce other control reports. What the sources say:

• SSAE / SOC reports. DirectTrust says its criteria make IT controls “more comprehensive to assist in the preparation of other audits, such as SSAE 16 (formerly SAS 70) or Sarbanes-Oxley” (source). The pages IHS reviewed do not say whether a SOC 1 or SOC 2 report substitutes for DirectTrust accreditation.
• DirectTrust Healthcare Network (clearinghouse) program, which DirectTrust says is “intended for companies or organizations whose electronic health networks perform claims clearinghouse or EDI gateway functions” (source).
• HITRUST certification. The pages IHS reviewed do not address HITRUST as an alternative for financial services organizations.

Related DirectTrust pages: DirectTrust medical biller accreditation consulting; DirectTrust MSO accreditation consulting; DirectTrust HISP accreditation consulting. All IHS accreditation services are listed on the Accreditation Consulting page.

What does DirectTrust accreditation cost?

DirectTrust publishes its fee schedule. The cost has two parts: DirectTrust's own fees, which DirectTrust sets by program, location and revenue level, and the cost of preparing, which depends on how much of the evidence your organization already has. DirectTrust says: “Accreditation fees are based on program(s), location(s), and revenue-level. Accredited organizations incur an Annual Fee. Every other year when an organization pursues accreditation (their On-Cycle year), they additionally incur Assessment, Location, and (if applicable) Multi-Program Discounted and Program-Specific Fees, as appropriate. On Off-Cycle years, organizations pay only the Annual Fee.” (source)

Three of the six revenue tiers on DirectTrust's apply page (fetched October 2, 2026):

• DirectTrust places federal, state and non-profit organizations in its Small tier, listed at $4,300 annual and $6,000 assessment (source).
• “Travel expenses are not included and will be invoiced after any physical location review(s) occur.” (source)
• DirectTrust lists “a charge of $250/hour for the Assessor time per additional submission of documentation.” (source)

Multi-site lockbox operations should also read the location review rotation table on the same page, since the number of location reviews affects Location fees and travel (source).

Verify current fees with DirectTrust before budgeting. IHS scopes each engagement after a free introductory call.

What this is not

• IHS is not an accrediting body and does not grant, predict or influence DirectTrust’s decision.
• IHS does not submit anything to DirectTrust. IHS drafts; your organization submits.
• IHS does not test payment or cybersecurity controls, and this page is not legal advice on state transaction rules.

Frequently asked questions

What is DirectTrust Financial Services accreditation for healthcare payments?

It is a pair of DirectTrust programs for organizations that process healthcare payments: Financial Services Network v6.1 and Financial Services Lockbox v6.1. DirectTrust says they confirm the organization follows HIPAA security and privacy rules, supports ASC X12N 835 for electronic remittance advice, and meets criteria specific to financial electronic health networks.

What is the difference between the Financial Services Network and Lockbox programs?

DirectTrust says the Lockbox program modifies or drops certain performance metrics, because a lockbox operation does not receive standards-based transactions. It also has document handling and delivery criteria unique to that program.

Do banks running healthcare lockbox services need DirectTrust accreditation?

DirectTrust's Financial Services page says its accreditation is required for processing healthcare transactions in Maryland and New Jersey, while its Healthcare Networks page says it is accepted there. IHS has not reviewed those statutes for this page. Check your client and payer contracts for what they require.

What does the 835 remittance requirement mean for accreditation?

DirectTrust says the programs confirm the organization supports ASC X12N 835 for electronic remittance advice transactions. A Network applicant should expect to document that support. DirectTrust notes a lockbox operation does not receive standards-based transactions, so certain metrics differ for Lockbox.

How many locations does DirectTrust review for a multi-site lockbox operation?

DirectTrust uses a location review rotation for lockbox facilities whose sites perform the same function under the same policies and procedures. Its published table lists, for example, 2 reviews for 2-4 locations and 3 reviews for 5-8 locations.

How much does financial services accreditation cost?

DirectTrust publishes revenue-tiered fees: an Annual Fee every year plus Assessment and Location fees in the on-cycle year, with travel for physical reviews invoiced afterward. For example, the Very Small tier lists a $3,100 Annual Fee and $5,500 Assessment Fee. Verify current fees with DirectTrust.

How long does the accreditation process take?

DirectTrust does not publish a typical timeline on the pages IHS reviewed. The steps are the application and agreement, the self-assessment, location reviews and a Commission vote.

DirectTrust accreditation vs SOC 1 or SOC 2 reports for a payment processor?

DirectTrust says its criteria help in preparing other audits such as SSAE 16 or Sarbanes-Oxley. The pages IHS reviewed do not say whether a SOC report substitutes for DirectTrust accreditation, so check what your clients, payers and states accept.

How often must a lockbox operation be re-accredited?

The DirectTrust accreditation cycle is two years, with an Annual Fee every year. Renewing organizations submit a complete self-assessment 4 months prior to the expiration date.