DirectTrust HIE accreditation is the Health Information Exchange Accreditation Program (HIEAP), assessed in 2026 against DirectTrust’s “Health Information Exchange v5.1” criteria and governed by DirectTrust’s Electronic Healthcare Network Accreditation Commission (EHNAC). It is for health information exchanges that want third-party oversight; the program assesses health information and oversight, technical performance, business processes and resource management. Integral Healthcare Solutions (IHS) crosswalks your HIE governance and agreements to the DirectTrust criteria and drafts the gaps; your technical leaders own architecture.

Last reviewed: October 2026.

What is DirectTrust HIE accreditation?

DirectTrust describes the program this way: “The Health Information Exchange Accreditation Program (HIEAP) assesses your health information and oversight for meeting healthcare reform and privacy and security regulations. Our accreditation program also focuses on technical performance, business processes, and resource management.” (source) The same page says the program “provides recognized third-party oversight for enhancing trust throughout your healthcare community.” (source)

The governing text for 2026 is “Health Information Exchange v5.1*”. In DirectTrust’s 2026 release, “* Denotes programs that contain DirectTrust’s standard Privacy and Security criteria.” (source) DirectTrust announced “the release of new versions of program criteria for its 28 accreditation programs starting January 1, 2026” and states that its accreditation and certification programs “are governed by the organization’s Electronic Healthcare Network Accreditation Commission (EHNAC).” (source)

The 2026 privacy criteria changed. DirectTrust says they “have been updated across all relevant programs to incorporate changes to regulations regarding reproductive health data and Substance Use Disorders information, while continuing to cover HIPAA, Personal Health & Wellness Data (PHWD), the General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA).” (source) The release also introduces “optional enhancements designed to support cyber resilience” (source).

The criteria documents are not posted publicly. DirectTrust says: “Criteria for each of our Accreditation Programs are available for request at the top of the Programs and Criteria page.” (source) This page relies on DirectTrust’s public program and process pages, not the criteria text. A draft 2027 release is out: “DirectTrust has announced the draft version of the 2027 Criteria Release.” “Please note the comment period ends on November 17, 2026.” (source)

Who needs it and what triggers it?

The buyer is a health information exchange or health data network that has set DirectTrust accreditation as an objective, or is building the operating program the criteria assess. Common triggers, drawn from DirectTrust’s own pages and IHS’s reading:

• A first accreditation. DirectTrust says: “Organizations interested in knowing if they qualify for accreditation or certification must complete the Application form.” (source)
• Reaccreditation. “The accreditation cycle is for 2 years.” Renewing organizations “Submit complete self-assessment 4 months prior to the expiration date.” (source)
• The 2026 privacy changes on reproductive health data and Substance Use Disorders information, which DirectTrust built into its privacy criteria (source).

No source IHS reviewed states that HIE accreditation is legally required. Whether a state, payer or participant contract asks for it is set by that party.

How IHS helps

IHS crosswalks your HIE governance and agreements to the DirectTrust criteria and drafts the gaps. The work runs in this order:

1. Gap assessment against the Health Information Exchange v5.1 criteria your exchange obtains from DirectTrust.
2. Document and evidence mapping: a crosswalk of participant governance, participant agreements, privacy and security responsibilities and incident workflows to each criterion. Where the exchange already holds HITRUST evidence, the crosswalk reuses it.
3. Drafting: policies and procedures for each gap, for your leaders to review and approve.
4. Mock review of the self-assessment package against the criteria.
5. Readiness support: drafted responses to assessor findings, for your exchange to submit.

What your exchange supplies: the criteria, participant agreements, governance documents, security records, and your technical leaders.

The limit: interoperability architecture and technical testing stay with the exchange’s engineers. IHS does not test systems. Your exchange submits its own application and self-assessment.

How the DirectTrust process runs

• Application: “An Accreditation Program Agreement must be signed by the applicant and submitted. A Financial Attestation to verify your organization’s revenue must also be submitted.” (source)
• Self-assessment: “New applicants can submit the self-assessment as soon as it is completed before the due date.” (source)
• Location review: “Location reviews are completed, and the Assessor completes the draft Accreditation Report.” (source)
• Decision: “The Commission reviews and votes on the Accreditation Report. The organization will be informed whether the accreditation has been approved or denied.” (source)

DirectTrust does not publish a typical time from application to Commission vote on the pages IHS reviewed. The pace is set mostly by how long your exchange takes to complete the self-assessment and assemble evidence.

What to have ready

Each item ties to DirectTrust’s published process or its public description of the 2026 HIE program. The criteria text (Health Information Exchange v5.1) governs; check each item against your copy.

1. A copy of the Health Information Exchange v5.1 criteria, requested from DirectTrust (criteria available on request).
2. A completed Application form (accreditation process).
3. A signed Accreditation Program Agreement (accreditation process).
4. A Financial Attestation of your organization’s revenue, which also places you in a fee tier (process); (fees).
5. Your oversight and governance records, since the program assesses “your health information and oversight” (program description).
6. Privacy and security policies, including how you handle reproductive health data and Substance Use Disorders information under the 2026 privacy criteria (2026 release).
7. Records of technical performance (program description).
8. Written business processes and records of how your exchange manages resources (program description: “business processes, and resource management”).
9. For a renewal, a calendar that puts the complete self-assessment in DirectTrust’s hands 4 months before expiration (process).
10. Evidence that the practices you document are carried out; IHS’s expectation for the location review, which DirectTrust’s process page describes only as ‘Location reviews are completed’.

To walk through this list against your own exchange, start with the introductory call.

How it compares

An HIE weighing DirectTrust HIE accreditation usually looks at these alternatives. What the sources say about each:

• DirectTrust Healthcare Network accreditation (Healthcare Network v14.1). DirectTrust says of its network programs: “These accreditation programs indicate that industry-established standards are exceeded, and that your organization complies with HIPAA regulations in areas such as privacy, security and cyber security” (source).
• TEFCA participation through a QHIN. TEFCA is a contractual exchange framework, not an accreditation. The RCE says: “To participate in TEFCA exchange, entities other than QHINs must: Be connected into TEFCA exchange through a QHIN.” (source) IHS covers TEFCA onboarding on its TEFCA participant onboarding page.
• HITRUST certification. The DirectTrust HIE pages IHS reviewed do not say whether HITRUST certification substitutes for the HIE criteria. See IHS’s HITRUST page.
• DirectTrust’s own advisory help. DirectTrust program pages say: “Learn about our Consulting and Advisory Services which have been designed to provide additional guidance in completing these programs.” (source)
• No accreditation. No source IHS reviewed makes HIE accreditation a legal requirement.

Related DirectTrust pages: DirectTrust MSO accreditation consulting; DirectTrust Outsourced Services accreditation consulting; DirectTrust identity and trust service accreditation consulting. All IHS accreditation services are listed on the Accreditation Consulting page.

What does DirectTrust HIE accreditation cost?

The cost has two parts: DirectTrust’s fees, which DirectTrust sets by program, location and revenue level, and the cost of preparing, which depends on how much evidence your exchange already has. DirectTrust says: “Accreditation fees are based on program(s), location(s), and revenue-level. Accredited organizations incur an Annual Fee. Every other year when an organization pursues accreditation (their On-Cycle year), they additionally incur Assessment, Location, and (if applicable) Multi-Program Discounted and Program-Specific Fees, as appropriate. On Off-Cycle years, organizations pay only the Annual Fee.” (source)

Three of the six revenue tiers on DirectTrust’s apply page (fetched October 2, 2026):

DirectTrust’s note on the table: “*Federal, state, and non-profit organizations are included in the Small Size above.” (source) On that note, a non-profit HIE falls in the Small tier.

Verify current fees with DirectTrust before budgeting. IHS scopes each engagement after a free introductory call.

What this is not

• IHS is not an accrediting body. IHS does not grant, predict or influence DirectTrust’s decision; the Commission votes on the Accreditation Report.
• IHS does not submit anything to DirectTrust. IHS drafts; your exchange submits.
• This page is not legal advice, and IHS does not design or test interoperability architecture.

Frequently asked questions

What is DirectTrust HIE accreditation and who grants it?

It is DirectTrust's Health Information Exchange Accreditation Program (HIEAP), which assesses an exchange's health information and oversight, technical performance, business processes and resource management. DirectTrust says its accreditation programs are governed by its Electronic Healthcare Network Accreditation Commission (EHNAC), and the Commission votes on each Accreditation Report.

Is DirectTrust the same as EHNAC?

DirectTrust states that its accreditation and certification programs are governed by the organization's Electronic Healthcare Network Accreditation Commission (EHNAC). The DirectTrust pages IHS reviewed do not describe the legal relationship between the two names.

Which version of the DirectTrust HIE criteria applies in 2026, and what changes in 2027?

The 2026 version is Health Information Exchange v5.1, effective January 1, 2026, and it contains DirectTrust's standard Privacy and Security criteria. DirectTrust has released a draft 2027 criteria release, with comments closing November 17, 2026. The final 2027 text was not published on the pages IHS reviewed.

How do I get a copy of the DirectTrust HIE accreditation criteria?

Request them from DirectTrust. Its program page says criteria for each accreditation program are available for request at the top of the Programs and Criteria page. The criteria are not posted as a public document.

What are the steps to DirectTrust accreditation for a health information exchange?

Complete the Application form, sign and submit the Accreditation Program Agreement, and submit a Financial Attestation of revenue. Then complete the self-assessment. Location reviews follow, the Assessor drafts the Accreditation Report, and the Commission votes to approve or deny.

How long does DirectTrust accreditation last, and when is the reaccreditation self-assessment due?

The accreditation cycle is 2 years. DirectTrust asks organizations to submit a complete self-assessment 4 months before the expiration date. DirectTrust does not publish a typical start-to-finish timeline on the pages IHS reviewed.

How much does DirectTrust accreditation cost for a non-profit HIE?

DirectTrust places federal, state and non-profit organizations in its Small tier, published at a $4,300 Annual Fee and a $6,000 Assessment Fee, with location and multi-program fees on top where they apply. Fees were read from DirectTrust's apply page on October 2, 2026; verify current fees with DirectTrust. IHS scopes its own engagement after a free introductory call.

Do we need DirectTrust accreditation if we are joining TEFCA through a QHIN?

They are different things. TEFCA is a contractual exchange framework that non-QHIN entities join by connecting through a QHIN, and DirectTrust HIE accreditation is an accreditation. The sources IHS reviewed do not say that one requires or replaces the other.

Can our HITRUST certification evidence be reused for DirectTrust HIE accreditation?

The DirectTrust HIE pages IHS reviewed do not say whether HITRUST certification substitutes for the HIE criteria. In IHS's crosswalk, existing HITRUST evidence is mapped to each criterion it answers, so the exchange does not rebuild documents it already has.

Does DirectTrust HIE accreditation cover the new Substance Use Disorders information and reproductive health privacy rules?

DirectTrust says its 2026 privacy criteria were updated across all relevant programs for reproductive health data and Substance Use Disorders information. Health Information Exchange v5.1 carries DirectTrust's standard Privacy and Security criteria. On IHS's reading (October 2026), those updates apply to the HIE program; confirm against the criteria text.