How a National Health System Modernized Direct Secure Messaging Without Downtime
Background
Organization: National integrated delivery network
Solution: DataMotion HISP (Direct Secure Messaging), DPP Provisioning, Apigee X integration, Epic XDR enablement, HPD directory feeds
Cutover Date: December 2025
Executive Summary
A national integrated delivery network modernized its Direct Secure Messaging (DSM) infrastructure by replacing its long-standing DSM partner with DataMotion’s HISP—without downtime, disruption, or loss of interoperability.
Across five major programs—health information exchange, Epic (XDR), the patient portal, the provider directory (HPD), and cross-organizational DNS and certificate management—the health system consolidated more than 400 sending addresses under two primary domains — one for clinical document exchange, one for patient event notifications. The migration eliminated per-facility credential sprawl through a single Basic Auth alias, standardized payload handling across CDA/HL7, MIME, and XDM, and improved provider directory hygiene through automated HPD feeds.
The cutover was executed in December 2025 using a production “handshake” test and a staged ramp methodology—ensuring zero downtime while transitioning mission-critical clinical messaging at national scale.
The result: predictable economics, simplified operations, and standards-aligned interoperability—without risking patient care or clinical workflows.
“Our priority was a seamless transition with zero disruption to patient care. DataMotion delivered exactly that—while giving us the scalability and security we needed for the future.”
— Director, Clinical Interoperability
Customer Context
The health system operates hundreds of facilities and national programs, each supporting distinct messaging workflows—including clinical notifications, transitions of care, patient-facing communications, and provider directory publishing. These workflows span multiple EMRs, integration layers, and trust communities, all of which must operate reliably at scale.
While the prior DSM solution was technically functional, it introduced operational friction and growing cost uncertainty. Per-facility credentials increased automation fragility, vendor-specific payload behavior complicated interoperability, and pricing structures exposed the organization to unpredictable overages as volumes scaled.
Leadership set out to:
- Lower unit economics and reduce overage exposure
- Simplify provisioning and credential management
- Standardize payload behavior to industry norms
- Preserve interoperability and reliability at national scale
The challenge was not fixing something “broken,” but replacing something no longer optimized for scale, predictability, or long-term control.
“The collaboration was proactive and solution-focused. Every challenge was met head-on, and the team made sure we stayed on track for a complex, multi-program cutover.”
— Clinical Messaging Project Lead
Challenges
Multi-Program Orchestration
Four distinct message origination paths—health information exchange, Epic via XDR, the patient portal, and the provider directory—had to converge on a single HISP with consistent behavior and reliability.
Credential Sprawl
Hundreds of facility-level addresses required hundreds of passwords or session keys, increasing operational risk and complicating automation.
Payload Interoperability
Patient Event Notifications (PEN) required support for both vendor-specific MIME headers and standards-aligned XDM attachments. Epic XDR imposed strict requirements for patient demographics, document IDs, and client certificates containing private keys.
DNS Blast Radius
Flipping base nameservers for the organization’s Direct domain risked cascading impact across all subdomains. A poorly executed cutover could spike queuing, error rates, or message loss.
HPD Publishing Hygiene
The health system publishes facility-level addresses (not individual providers) to prevent PHI misrouting. Directory feeds needed to remain accurate, consistent, and complete at scale.
Solution
DataMotion HISP + DPP (Provisioning)
- Single Basic Auth alias for outbound sends—one credential supporting ~400 “from” addresses across both primary domains.
- DPP portal for organization setup, certificate issuance (3-year org certificates), domain management, and bulk user import.
- Trust Agent onboarding handled via notarized Declaration of Identity (DID); administrative users did not require DID.
Health Information Exchange (Outbound & Inbound via Apigee X)
- Outbound workflows used SendMessage (XML CDA) for CCDs and SendMime for PEN.
- Inbound traffic proxied through Google Apigee X with OAuth2 token acquisition, followed by delivery POSTs.
- Acknowledgment returned via HTTP 200 with XML status.
- Payload guardrail enforced at ~15MB pre-encryption (≈21MB on wire).
Epic XDR
- Bidirectional XDR using ProvideAndRegisterDocumentSet.
- Epic required a client certificate containing a private key for outbound signing.
- Endpoint cleanup (removal of CE suffixes) and long-term certificates ensured stability.
- DataMotion validated demographics and document IDs before converting inbound traffic to Epic’s edge protocol.
Patient Portal
- Migration from SOAP toward REST with a single “from” address model.
- Late-night deployment window enabled safe testing.
- DataMotion provided a temporary production test domain to support pre-cutover validation.
Provider Directory / HPD Feeds
- SFTP-based daily delta feeds and periodic full directory files.
- NPIs encouraged for matching accuracy.
- Publishing intentionally focused on facilities to prevent clinical misdelivery.
Implementation & Timeline
November 2025
Architecture design finalized; Apigee X proxy pattern confirmed; Epic XDR troubleshooting completed (client cert with private key, endpoint cleanup).
Early December
DPP onboarding for Trust Agents; organization certificates issued for CCD and PEN; patient portal organization created.
One Week Before Cutover
Go-live sign-off covering DNS plan, production handshake testing, and staged ramp strategy.
Cutover Day
- Morning window: Epic sanity checks and validation.
- Midday window: Health information exchange outbound production test → staged ramp.
- Late-evening window: Patient portal outbound test on a supported bridge → DNS flip.
- DNS coordination covered base and subdomains with the health system’s networking team present.
Cutover Methodology
Production “Handshake” Test
Health information exchange outbound → DataMotion interop address (Basic Auth + MDN validation).
Patient portal outbound → temporary production test domain.
Epic inbound/outbound → test documents with valid demographics and IDs.
Staged Ramp
Trickle → Pause → Validate → Resume approach minimized blast radius and allowed rapid anomaly detection.
Monitoring & Triage
DataMotion monitored MDNs, inbound webhooks, XDR responses, and queues.
The health system controlled ingestion services to regulate volumes during validation.
Results
Executive Outcomes
Technical Proof Points
~400 Sending Addresses
consolidated under two domains
Automated HPD Directory
hygiene via daily delta and full feeds
Controlled DNS
cutover using staged ramp methodology
“Test small, pause, verify, then resume.”
— Joint cutover principle enabling a risk-controlled DNS transition
Metrics at a Glance
Addresses Migrated
~ 400+
Auth Model
One Basic Auth alias
Payloads
CDA/HL7, MIME, XDM; Epic XDR
Cutover Date
December 2025
Org Certificates
3-year term via DPP
HPD Feeds
Daily delta + periodic full (SFTP)
Lessons Learned
- Standards First: XDM attachments for PEN reduce vendor lock-in and ease interop.
- Reduce Credential Friction: Alias-based auth materially improves reliability.
- Respect DNS Blast Radius: Treat DNS like a release—validate in production and ramp carefully.
- Provisioning at Scale Matters: Bulk onboarding streamlines long-term maintenance.
- Certificate Discipline Is Non-Negotiable: Epic’s private-key requirement must be codified in runbooks.
What's Next
- Expand DataMotion’s DPP for ongoing day-2 operations
- Enhance observability with MDN and volume analytics
- Replicate the blueprint across additional clinical messaging workflows
“Predictability matters in healthcare. The utilization monitoring and alerting framework ensures we can manage volumes without surprises—something we didn’t have before.”
This Use Case Might Also Interest You
Premera Blue Cross
Premera's legacy messaging couldn't talk to Genesys Cloud. DataMotion replaced it inside the member portal they already ran — no second system, no retraining.
Health Insurance Technology Startup
DataMotion utilizes the DataMotion Secure Message Center APIs and Platform as a Service (PaaS) to integrate seamlessly into the insurtech’s existing CX Platform to secure exchanges and meet compliance regulations.
Union Hospital
Union Hospital utilizes DataMotion Direct Secure Messaging to reduce operational costs and enhance quality of care.
Book a Demo
Experience a platform built for national‑scale interoperability and cost stability.