DirectTrust MSO accreditation is the DirectTrust Management Service Organization Accreditation Program (MSOAP), assessed against the 2026 criteria version “Management Service Organization v5.1”, for organizations that give healthcare practices centralized administrative and hosted technology services. Integral Healthcare Solutions (IHS) prepares MSOs for it: IHS drafts the MSO’s policies, contract controls and evidence file and runs a mock review, and your counsel sets the boundaries with the practices you serve.

Last reviewed: October 2026.

What is DirectTrust MSO accreditation?

DirectTrust describes the program this way: “The Management Service Organization Accreditation Program (MSOAP) assesses organizations that offer centralized administrative and hosted technology services.” (source) It adds: “This includes organizations that provide electronic health record systems for healthcare providers, ensuring that protected health information (PHI) is stored, accessed and/or transmitted in a private and secure manner.” (source)

According to the same page, “Other areas of focus for this program include privacy and confidentiality, technical performance, business processes, resources, and security.” (source)

The governing text for 2026 is “Management Service Organization v5.1”. DirectTrust “announced the release of new versions of program criteria for its 28 accreditation programs starting January 1, 2026.” (source) The MSO version carries an asterisk in that release, marking programs that contain DirectTrust’s standard Privacy and Security criteria (source). DirectTrust states that its programs “are governed by the organization’s Electronic Healthcare Network Accreditation Commission (EHNAC).” (source)

The criteria documents are released on request, not published, so this page relies on DirectTrust’s public program pages rather than the criteria text. A draft 2027 criteria release is out for comment until November 17, 2026 (source).

Who needs it and what triggers it?

The buyer is an MSO that provides administrative infrastructure, and often hosted systems, to physician and other healthcare practices. The triggers named in the sources:

• Payer requirements. DirectTrust says “some payers require this accreditation program as a condition of processing their transactions” (source). The page does not name those payers, so check the payer contracts your MSO works under.
• A defined accreditation objective: a practice or payer contract that asks for it, or a decision to put the MSO’s privacy, security and service operations against an external standard.

How IHS helps

IHS drafts the MSO’s policies, contract controls and evidence file for DirectTrust accreditation; your counsel sets practice boundaries. The work runs in this order:

1. Gap assessment of the MSO’s operations against the Management Service Organization v5.1 criteria your organization obtains from DirectTrust.
2. Questionnaires on the services you provide, practice contracts, privacy and security governance, and continuity.
3. Document and evidence mapping: each criterion crosswalked to the policy, contract clause or record that answers it.
4. Drafting: a service-responsibility matrix, contract controls, privacy and security policies, and a continuity plan, for your leaders to review and approve.
5. Mock review of the self-assessment and evidence against the criteria.
6. Readiness support: drafted responses to findings for your organization to submit.

What your organization supplies: the criteria, practice agreements, security documentation, and your operations, legal and technical leads. Your organization submits its own application and self-assessment.

The limits: the MSO’s corporate-practice boundaries with the practices it serves are your counsel’s call, and IHS does not assess technical security controls. Technical evidence comes from your staff or your security vendor.

How the DirectTrust process runs

• Application: “An Accreditation Program Agreement must be signed by the applicant and submitted.” (source) and “A Financial Attestation to verify your organization’s revenue must also be submitted.” (source)
• Self-assessment: “Upon completion of the Application Process and approval, the Self-Assessment zip file will be made available to the organization, the Assessor will be assigned and the organization will be added to the Accredited Organizations page as a Candidate.” (source)
• Location review: “The purpose of a Location Review is to confirm that the practices documented by the organization are being carried out in real life.” (source)
• Decision: “The Commission reviews and votes on the Accreditation Report.” (source)
• Cycle: “The accreditation cycle is for 2 years.” (source) DirectTrust also “offers an optional Midterm Accreditation review.” (source)

DirectTrust does not publish a typical end-to-end timeline on the pages we reviewed.

What to have ready

This list ties to DirectTrust’s published process and its public description of the MSOAP. The criteria text (Management Service Organization v5.1) governs; check each item against your copy.

1. A copy of the Management Service Organization v5.1 criteria, requested from DirectTrust (criteria are available on request).
2. A signed Accreditation Program Agreement (accreditation process).
3. A Financial Attestation of your organization’s revenue; DirectTrust says fees are based on program(s), location(s) and revenue level (process; fees).
4. A list of the administrative and hosted technology services you provide, and to which practices (program description).
5. For any electronic health record system you provide, documentation of how PHI is stored, accessed and transmitted (program description).
6. Privacy and confidentiality policies (program description).
7. Security policies and the technical documentation behind them (program description).
8. Records of technical performance (program description).
9. Written business processes and a description of staffing and other resources (program description).
10. Evidence that your documented practices are carried out, for the location review (process).

If you want to walk through this list against your own operations, start with the introductory call.

How it compares

DirectTrust runs other programs that overlap with MSO work. What DirectTrust says about each:

• Outsourced Services programs: “These programs assess an organization in areas such as privacy and confidentiality measures, level-of-service and escalation procedures, transaction response times, and systems availability.” (source)
• Practice Management System program: “The program provides a comprehensive review of Practice Management System vendors in the areas of privacy, security, mandated standards, and operating rules, as well as key operational functions.” (source)
• Privacy and Security program: “This program accredits organizations against our core criteria including privacy and security, customer service, business practices, personnel requirements, third-party cloud service providers, and more.” (source)
• HITRUST certification or a SOC 2 report. The DirectTrust pages IHS reviewed do not say whether either substitutes for MSO accreditation. Whether a payer or practice accepts one in its place is set by that payer or practice.

Related DirectTrust pages: DirectTrust medical biller accreditation consulting; DirectTrust HISP accreditation consulting; DirectTrust Financial Services and Lockbox accreditation consulting. All IHS accreditation services are listed on the Accreditation Consulting page.

What does DirectTrust accreditation cost?

DirectTrust publishes its fee schedule. The cost has two parts: DirectTrust's own fees, which DirectTrust sets by program, location and revenue level, and the cost of preparing, which depends on how much of the evidence your organization already has. DirectTrust says: “Accreditation fees are based on program(s), location(s), and revenue-level. Accredited organizations incur an Annual Fee. Every other year when an organization pursues accreditation (their On-Cycle year), they additionally incur Assessment, Location, and (if applicable) Multi-Program Discounted and Program-Specific Fees, as appropriate. On Off-Cycle years, organizations pay only the Annual Fee.” (source)

Three of the six revenue tiers on DirectTrust's apply page (fetched October 2, 2026):

• DirectTrust places federal, state and non-profit organizations in its Small tier, listed at $4,300 annual and $6,000 assessment (source).
• “Travel expenses are not included and will be invoiced after any physical location review(s) occur.” (source)
• DirectTrust lists “a charge of $250/hour for the Assessor time per additional submission of documentation.” (source)

Verify current fees with DirectTrust before budgeting. IHS scopes each engagement after a free introductory call.

What this is not

• IHS is not an accrediting body. IHS does not grant, predict or influence DirectTrust’s decision; the Commission votes on the Accreditation Report.
• IHS does not submit anything to DirectTrust. IHS drafts; your organization submits.
• This page is not legal advice. Corporate-practice-of-medicine questions go to your counsel, and IHS does not assess technical security controls.

Frequently asked questions

What is DirectTrust MSO accreditation?

It is DirectTrust's Management Service Organization Accreditation Program (MSOAP), which assesses organizations that offer centralized administrative and hosted technology services, including electronic health record systems for providers. The 2026 criteria version is Management Service Organization v5.1. DirectTrust says its programs are governed by EHNAC.

Does a management services organization serving physician practices qualify for the MSOAP?

DirectTrust's description covers organizations that offer centralized administrative and hosted technology services, including EHR systems for healthcare providers. On IHS's reading (October 2026), an MSO that provides those services to physician practices fits that description. Confirm fit against the criteria and with DirectTrust's application.

What does the MSO accreditation program assess?

DirectTrust names privacy and confidentiality, technical performance, business processes, resources and security, and the private and secure handling of PHI in hosted systems. Version 5.1 also contains DirectTrust's standard Privacy and Security criteria. The full criteria are released on request.

Do payers require MSO accreditation to process transactions?

DirectTrust says some payers require this accreditation program as a condition of processing their transactions. It does not name those payers on the page IHS reviewed. Check the payer agreements your MSO operates under.

How long does MSO accreditation take?

DirectTrust does not publish a typical timeline on the pages IHS reviewed. The steps are the application and agreement, the self-assessment, a location review and a Commission vote.

How much does DirectTrust MSO accreditation cost?

DirectTrust publishes revenue-tiered fees: for example, a $3,100 Annual Fee and $5,500 Assessment Fee for organizations under $3M in revenue, and higher amounts for larger tiers, with location-review travel invoiced separately. Verify current fees with DirectTrust. IHS scopes its own engagement after a free introductory call.

What documents does an MSO need for the self-assessment?

DirectTrust makes the self-assessment available after the application is approved, and the criteria define the evidence. Based on DirectTrust's program description, expect policies and records on privacy, confidentiality, security, technical performance, business processes and resources. IHS maps each criterion to the document that answers it.

How does an MSO handle the corporate-practice-of-medicine boundary in its policies?

That boundary is a legal question for the MSO's counsel, and IHS does not advise on it. IHS drafts the service-responsibility matrix and contract controls around the lines counsel sets.

How often is MSO accreditation renewed?

The DirectTrust accreditation cycle is two years, with an Annual Fee every year. Renewing organizations submit a complete self-assessment 4 months prior to the expiration date. An optional midterm review is available.