Referral letters, consult notes, discharge summaries, prior authorization packets, and records requests all have to move between organizations that use different systems. Fax has carried that load for forty years and still carries most of it, but it is no longer the only option, and for many exchanges it is no longer the best one. Direct Secure Messaging, regional and national health information exchange, and FHIR-based APIs each solve part of the problem with different strengths. This comparison lays out what each option does well, what it costs, and how to think about the mix that fits a practice.
The problem: getting a document from here to there
Clinical document exchange has four requirements that pull against each other. The document has to reach the recipient, whoever they are and whatever system they use. It has to arrive in a form the recipient can use, ideally structured data that files into the chart rather than an image that someone has to read and re-key. It has to be secure in transit and traceable afterward. And it has to be cheap enough and easy enough that staff will use it without workarounds. No single channel wins on all four, which is why most practices end up running two or three.
Cloud fax
Cloud fax replaces the fax machine and phone line with a hosted service that sends and receives faxes as documents through a web portal, email gateway, or integration with the EHR. Its defining strength is reach: every provider, pharmacy, payer, and agency in the country has a fax number, and sending requires no relationship, enrollment, or directory lookup. Its defining weakness is that the payload is an image. Received faxes must be indexed to a patient and encounter by a person, and the clinical content is not computable.
Security is a mixed picture. Transmission over the public switched telephone network is not encrypted in the modern sense, but it has historically been treated as acceptable under HIPAA as a permitted communication method when reasonable safeguards are used. The hosted portion, including storage and web access, should be encrypted and covered by a business associate agreement with the vendor. Misdirected faxes remain one of the most common reported disclosure incidents, and a cloud service does not fix a wrong number. Cost is low per page and predictable, though high-volume practices pay meaningful monthly fees.
Direct Secure Messaging
Direct is a standards-based, encrypted email-like protocol for sending health information between known, trusted parties. Every participant has a Direct address issued by a health information service provider, identity is verified at enrollment, and messages are encrypted end to end using certificates. Direct can carry attachments including structured clinical documents such as a Consolidated Clinical Document Architecture summary, which many EHRs can receive and file to the chart automatically. Certified EHRs are required to support it, and it is widely used for transitions of care and referral loops.
Direct's strengths are security, structure, and traceability. Its weakness is reach and discoverability: you can only send to a recipient who has a Direct address, and finding that address requires a directory that is often incomplete. Adoption is high among hospitals and larger groups and uneven among small practices, long-term care, and behavioral health. Cost is usually bundled into the EHR subscription or charged as a modest per-address fee.
Health information exchange and national networks
Health information exchanges shift the model from push to query. Instead of sending a document, a clinician looks up the patient in a regional exchange or a national network and retrieves records that participating organizations have made available. National frameworks, including the networks operating under TEFCA and the large vendor-driven exchange networks, have made query-based exchange available to a growing share of practices, often through the EHR itself. Some exchanges also support event notifications, such as an alert when a patient is admitted or discharged.
The strengths are breadth of information and no need to know where the patient was seen. The weaknesses are that query retrieves what others have shared, not necessarily the document you needed, and that participation, governance, and fees vary by exchange. For a small practice, the practical question is whether the EHR vendor participates on your behalf and at what cost, and whether the exchange covers the hospitals and specialists your patients use.
FHIR-based exchange and payer or app APIs
FHIR APIs are the newest option. Certified EHRs must expose a standardized FHIR API that patients and their apps can use, and federal rules require many payers to expose FHIR APIs for patient access, provider access, payer-to-payer exchange, and prior authorization. For document exchange, FHIR is most relevant today in three places: apps that pull a patient's records into a personal record and can share them, payer APIs that return coverage and authorization information without a fax, and vendor-to-vendor integrations that move structured data directly. It is the direction the industry is heading, and the most computable of the options, but it is not yet a general-purpose way to send a referral to a provider you have never worked with.
Side-by-side comparison
| Dimension | Cloud fax | Direct Secure Messaging | HIE / national network | FHIR API |
|---|---|---|---|---|
| Reach | Universal | Participants with a Direct address | Participating organizations | Certified EHRs, impacted payers, apps |
| Model | Push | Push | Query, plus notifications | Query and push, app-driven |
| Payload | Image | Attachments; structured documents supported | Structured documents | Structured resources |
| Filing effort | Manual indexing | Often automatic | Usually automatic | Automatic |
| Security and traceability | Vendor-side encryption; misdirection risk | Encrypted end to end; verified identities | Governed by exchange policies | OAuth-secured, audited |
| Typical cost | Per page or monthly tier | Bundled or per address | Membership or vendor pass-through | Bundled with certified EHR |
| Best for | Anyone, anywhere, once | Referral loops and transitions with known partners | Finding records you did not know existed | Payer data, patient apps, integrations |
Choosing a mix for your practice
Start by measuring where your documents go. Pull a month of outbound faxes and sort them by recipient. Most practices find that a small number of hospitals, specialists, and payers account for the majority of volume. Those high-volume partners are candidates for Direct or exchange participation, which removes manual indexing on both ends and closes referral loops automatically. The long tail of one-time recipients stays on fax, ideally a cloud service integrated with the EHR so that received documents can be indexed from the chart rather than a separate portal.
Then check what you already own. Your certified EHR almost certainly includes Direct and a FHIR API, and may include national network connectivity, and many practices are paying for cloud fax while leaving those features unconfigured. Ask your vendor to enable and demonstrate them. Confirm that a business associate agreement covers every vendor in the chain, including the fax service and the health information service provider.
Measure the loop, not the send. The goal is not fewer faxes; it is fewer referrals that never come back with a consult note. Track referral loop closure rate by channel, and shift volume toward whatever channel closes loops fastest with the least staff time.
Finally, plan for the trajectory. Payers are moving to APIs, national networks are expanding, and patients increasingly arrive with records in an app. A practice that has Direct configured, participates in an exchange through its EHR, and keeps fax for the long tail is positioned for that shift without having to rebuild its workflows when the next rule takes effect.
Common questions
Is fax still allowed under HIPAA?
Yes. Fax is a permitted way to communicate protected health information when reasonable safeguards are used, such as confirming numbers, using cover sheets, and securing the receiving device or portal. Cloud fax vendors should sign a business associate agreement.
Do we have to pay extra for Direct Secure Messaging?
Usually not. Certified EHRs must support Direct, and most bundle it into the subscription or charge a modest per-address fee. Ask your vendor to enable and configure it if you have never used it.
What is the difference between an HIE and TEFCA?
A health information exchange is an organization that enables record sharing among its participants, often regionally. TEFCA is a federal framework under which qualified networks connect to one another so that participants in one network can exchange with participants in others.
Can FHIR replace fax for referrals today?
Not generally. FHIR is well established for patient apps, payer data, and specific integrations, but there is not yet a universal way to send a referral to any provider through FHIR. Direct and fax remain the practical channels for that.