File Exchange Between Healthcare Providers

File exchange between healthcare providers happens through four main channels: Direct secure messaging over S/MIME (ONC's Direct Project), FHIR-based APIs per 21st Century Cures Act rules, HIE query-based exchange via Carequality or CommonWell, and ad-hoc encrypted file transfer for anything that doesn't fit the standardized pipes. Hospitals, specialty clinics, skilled nursing facilities, and home health agencies each sit at different points on this spectrum, and most real-world exchanges involve at least two channels — a FHIR query for the summary plus an encrypted .pdf transfer for the full operative note or the imaging study.

Why Provider-to-Provider Exchange Still Breaks

Interoperability has improved dramatically since the 2020 ONC Cures Act Final Rule, but daily friction remains. A patient discharged from Hospital A shows up at Clinic B the next morning. The clinic wants the discharge summary, medication reconciliation, and the CT read. Ideally, a FHIR query to Hospital A's API returns a DocumentReference bundle and a DiagnosticReport. In practice, the CT read is a 400 MB DICOM study that FHIR endpoints don't serve efficiently, and the discharge summary PDF is stuck in an attachment field the API doesn't expose.

So someone faxes it. Or burns a CD. Or emails an unencrypted attachment and violates HIPAA.

The gap between the standardized exchange rails and the messy reality is where most data breaches live.

The Four Exchange Channels in Practice

Direct Secure Messaging uses S/MIME over SMTP with certificates issued by DirectTrust-accredited HISPs. It's push-based, asynchronous, and ideal for referrals and transitions of care. Epic's Care Everywhere, Cerner/Oracle Health's Millennium, and athenahealth all support Direct. Attachment size usually caps at 50-100 MB depending on the HISP.

FHIR APIs per ONC USCDI v3 and the HL7 FHIR R4 specification give query-based access to structured data: conditions, medications, allergies, lab results, vitals. Good for machine-readable exchange. Weak for binary attachments.

HIE query exchange via Carequality (connecting Epic, Cerner, athenahealth, eClinicalWorks participants) or CommonWell Health Alliance uses IHE XCA and XCPD profiles for cross-enterprise document query. Returns CDA documents and sometimes attached files. Good for "pull whatever exists on this patient" workflows.

Ad-hoc encrypted transfer handles everything else — imaging studies too big for Direct, legal holds, research collaborations, referral packets with dozens of attachments. This is where the compliance risk concentrates.

HIPAA's Technical Safeguards Applied to File Exchange

HIPAA's Security Rule at 45 CFR 164.312 requires access control, audit controls, integrity controls, and transmission security. For file exchange, that translates to:

• Access control (164.312(a)) — unique user identification and automatic logoff. A shared "frontdesk@clinic.com" inbox receiving patient records fails this.
• Audit controls (164.312(b)) — recording who accessed what. The transfer log is part of this.
• Integrity (164.312(c)) — detecting improper alteration. SHA-256 hashes on transferred files.
• Transmission security (164.312(e)) — encryption in transit. TLS 1.3 is the practical floor.

Addressable specifications like encryption at rest (164.312(a)(2)(iv)) become de facto required after the HHS OCR's 2024 guidance signaling that "addressable" doesn't mean "optional."

Business Associate Agreements and the Vendor Chain

Every vendor that touches PHI during exchange needs a Business Associate Agreement under 45 CFR 164.504(e). That includes:

• The EHR vendor (Epic, Cerner, Meditech)
• The HISP routing Direct messages
• The HIE (if it's a separate entity)
• Any file transfer platform used for ad-hoc exchange
• Cloud storage holding the staging data

If your clinic uses Dropbox Business for patient files, Dropbox will sign a BAA — but only on the Advanced or Enterprise tier. Consumer Dropbox and consumer Google Drive won't. A free WeTransfer link to a radiologist is a HIPAA violation unless WeTransfer has signed a BAA, which the free tier doesn't include.

Referral Packets: The Largest Single File Exchange Category

A typical cardiology referral packet runs 40-200 MB:

• Office visit notes (.pdf, 500 KB-5 MB each)
• ECG tracings (PDF or proprietary)
• Echocardiogram report and DICOM study (50-300 MB)
• Labs and medication list (CCD/CCDA)
• Prior cath reports

Direct messaging chokes on the DICOM. Faxing loses image quality. A secure web link with client-side encryption and a short expiration handles it. Most referral coordinators want to click once, drop files, send a link. That workflow, with AES-256-GCM and a 7-day expiration, closes the referral loop without inventing a new IT project.

HexaTransfer handles exactly this shape of transfer: drop files, encrypt in the browser, share a link, set a passphrase. Try it at hexatransfer.com — free, no account, 10 GB max.

Emergency and After-Hours Transfers

At 2 AM, a community ER transfers a stroke patient to a regional stroke center. They need the CT head, the POLST, and the code status documented before the patient arrives. The ER nurse has 5 minutes.

The workflow has to work on a locked-down ER workstation, without installing anything, without creating an account. That's the brutal filter on healthcare transfer tools. If it requires IT to whitelist a new domain, it won't exist when the nurse needs it.

Pre-approved transfer tools in a hospital's "clinical shortcuts" browser folder work. Pre-printed instructions with URLs at the nursing station work. Complicated SSO flows don't.

Post-Acute Care Coordination

Skilled nursing facilities, home health, and hospice agencies exchange files with acute-care hospitals constantly. A discharge packet for a SNF admission typically includes:

• H&P (history and physical)
• Discharge summary
• Medication reconciliation
• PT/OT evaluations
• Current wound photos
• Code status and advance directives

Under CMS Conditions of Participation and the IMPACT Act, transfer of this data has to happen at the discharge touchpoint. Many SNFs still receive these packets by fax because their EHR (PointClickCare, MatrixCare) doesn't have a Direct address the hospital can route to. Secure web transfer with a download link emailed to a monitored SNF inbox is a bridge until the FHIR APIs catch up.

Audit Requirements Across State Lines

State medical record laws vary. California's CMIA (Confidentiality of Medical Information Act), Texas HB 300, and New York's SHIELD Act all add to HIPAA. If you exchange records across state lines, your audit system has to record enough metadata to satisfy the strictest regime.

Minimum audit fields:

1. Date and time (UTC plus local)
2. Sender NPI and organization
3. Recipient NPI and organization
4. Patient identifier (not name in the audit log)
5. File type and size
6. SHA-256 hash
7. Success or failure
8. Legal basis (treatment, payment, operations, authorization)

Keep these logs for at least 6 years per HIPAA, longer per state laws.

Handling Patient-Requested Transfers

21st Century Cures information blocking rules give patients the right to direct their records wherever they want — another provider, a research app, a personal health record. When a patient says "send my chart to Dr. Smith," the organization can't refuse because Dr. Smith uses an EHR you don't integrate with.

The fallback is secure file transfer with the patient as intermediary, or patient-directed transmission through a DocumentReference API call. Document the patient's request, send the package, log the transmission. An information blocking complaint at the ONC costs more than ten transfer tools combined.

Making It Sustainable

Healthcare file exchange isn't going to consolidate onto one protocol in the next five years. The realistic target is a layered workflow: Direct for routine referrals and transitions, FHIR for structured data queries, HIE for broad patient-record lookups, and encrypted ad-hoc transfer for everything else. Pick tools that your least-technical user can operate at the worst moment of their shift, and document the workflow in the SOP before you need it. That's what keeps patients moving through the system safely.