--- title: XDR Overview slug: xdr/guide docTags: createdAt: 2026-07-30T21:09:38.877Z --- ## Introduction Surescripts Clinical Direct Messaging (CDM) enables the secure, electronic exchange of clinical information between health care organizations. Built on the Direct standard maintained by DirectTrust, CDM allows providers, hospitals, health plans, and other authorized participants to send and receive clinical documents - such as referrals, transitions of care, discharge summaries, and care coordination notes - within their existing workflows. Surescripts is an accredited Health Information Service Provider (HISP), Direct Certificate Authority (CA), and Direct Registration Authority (RA) through DirectTrust. Together, these accredited roles allow Surescripts to issue and manage the trust credentials, validate participant identity, and operate the messaging infrastructure that makes secure Direct message exchange possible across the community of DirectTrust-accredited HISPs. CDM holds Certified Health IT status under Office of the National Coordinator (ONC) requirements and supports Promoting Interoperability program measures. Cross-Enterprise Document Reliable Interchange (XDR) is one of the connectivity methods CDM supports. This guide focuses on the XDR-based messaging model as implemented by Surescripts. ## About XDR **What it is.** XDR is an IHE (Integrating the Healthcare Enterprise) integration profile that defines how clinical documents are securely exchanged between systems using web services and standardized metadata. It is one of the transport methods supported by CDM for exchanging clinical documents between participants, and it enables secure exchange even in the absence of a document-sharing infrastructure such as an XDS Registry and Repository. **How it works.** XDR packages clinical content and its required metadata into a single message that is electronically routed between a sending system and a receiving system. Each message is delivered using the IHE Provide and Register Document Set-b transaction \[ITI-41], carried over web services. For each message that is sent, a response message is returned, and the type of response defines the status of the delivery. **Why it matters.** XDR allows participants to exchange clinical documents while preserving message integrity and traceability throughout delivery. Depending on how each participant is configured, XDR can also support Delivery Status Notifications that communicate the outcome of message processing. **Bottom line.** XDR provides a secure, standards-based method to move clinical documents between health care systems, with visibility into message processing and delivery. ## Scope, Limitations, and What Is Included This guide describes base XDR-based messaging as implemented by Surescripts. It covers how customers send and receive XDR messages, how messages are addressed and routed, how notifications and tracking work, how clinical documents and metadata are packaged, the connectivity and certificate requirements, and the requirements a customer's application must meet to be certified on the Surescripts network. As a CDM connectivity method, XDR-based messaging includes the Surescripts HISP, Direct CA, and Direct RA services. Message routing across the Surescripts network and electronic message delivery are included with the service. XDR is well suited to point-to-point exchange of clinical documents (for example, Consolidated Clinical Document Architecture \[C-CDA] documents and PDFs), transitions of care and discharge summaries, and public health reporting. Specific use cases built on XDR - such as electronic case reporting (eCR) and closed-loop referrals (360X) - are outside the scope of this version of the guide and may be addressed in a future revision. Surescripts places specific limitations on XDR relative to the base IHE profile. Those limitations are detailed in [Differences from Standard IHE XDR](docId\:daGa7Uw8ataRiYlZ3RtU9). ## Trust Framework and Flow-Down Terms XDR-based messaging operates within the DirectTrust trust framework. Certain trust-framework obligations flow down to every participant that sends or receives messages on the Surescripts network. These flow-down terms are an important part of participating in the network. :::hint{type="info"} **Note:** The full flow-down terms are provided in [DirectTrust Trust Framework and Flow-Down Terms](docId\:pmVq7Uy_7YMaKt3XdRoA1). ::: ## About This Guide This guide provides an overview of the XDR specifications and describes the message structures, workflows, and examples required to support XDR-based document exchange. It is intended for participants responsible for designing, developing, or supporting system integrations that use XDR-based messaging. This guide supports and further clarifies the applicable IHE and DirectTrust specifications as used on the Surescripts network; it does not reproduce those standards in full. Requirements beyond those in the referenced standards are called out in this guide and are enforceable. Customers should read and understand the associated standards, listed in the document references below, before implementing. ## Document References This guide should be read together with the following materials. External standards must be obtained by the customer from the issuing organization. **Surescripts-provided materials:** | **Reference** | **Description** | | --------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Connectivity and Authentication Guide](docId\:yJ54zGjRQH5Jj6R71e7w_) | Communication and security protocol requirements, mutual TLS and certificate details, and the IP addresses associated with Surescripts services. | | [Directory Implementation Guide](docId\:weWxqY1rX7_g9QXaSPWYx) | Direct address search, display, and publishing requirements (see [Application Certification Requirements](docId\:WsFITp7Dv6u1yRn7zBxD8), ACRs C.200-C.202). | | [Network Operations Guide](docId\:WYnGriKD7VJk2a6AvMEbn) | Network operations, support, and the Escalation Matrix. | **External materials to be obtained by the customer:** | **Reference** | **Where to obtain** | | -------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | | DirectTrust *XDR and XDM for Direct Secure Messaging Specification*, Version 2.1 | [https://directtrust.org/standards](https://directtrust.org/standards) | | IHE ITI Technical Framework, Volume 1, Section 15 - XDR (Cross-Enterprise Document Reliable Interchange) | [https://profiles.ihe.net/ITI/TF/Volume1/ch-15.html](https://profiles.ihe.net/ITI/TF/Volume1/ch-15.html) | | IHE ITI Technical Framework, Volume 1, Section 16 - XDM (Cross-Enterprise Document Media Interchange) | [https://profiles.ihe.net/ITI/TF/Volume1/ch-16.html](https://profiles.ihe.net/ITI/TF/Volume1/ch-16.html) | | IHE ITI Technical Framework, Volume 2b, Section 3.41 - Provide and Register Document Set-b \[ITI-41] | [https://profiles.ihe.net/ITI/TF/Volume2/](https://profiles.ihe.net/ITI/TF/Volume2/) | | IHE ITI Technical Framework, Volume 3 - Metadata | [https://profiles.ihe.net/ITI/TF/Volume3/](https://profiles.ihe.net/ITI/TF/Volume3/) | | W3C SOAP Version 1.2 | [https://www.w3.org/TR/soap12/](https://www.w3.org/TR/soap12/) | | W3C Web Services Addressing 1.0 - Core | [https://www.w3.org/TR/ws-addr-core/](https://www.w3.org/TR/ws-addr-core/) | | W3C SOAP Message Transmission Optimization Mechanism (MTOM) | [https://www.w3.org/TR/soap12-mtom/](https://www.w3.org/TR/soap12-mtom/) | | WS-I Basic Profile 2.0 | [http://ws-i.org/Profiles/BasicProfile-2.0-2010-11-09.html](http://ws-i.org/Profiles/BasicProfile-2.0-2010-11-09.html) | | HL7 Consolidated CDA (C-CDA) | [https://www.hl7.org/ccdasearch/](https://www.hl7.org/ccdasearch/) | | HL7 OID Registry | [https://www.hl7.org/oid/index.cfm](https://www.hl7.org/oid/index.cfm) | ## Sources of Authority Different aspects of an XDR implementation are governed by different documents. This guide clarifies how they apply on the Surescripts network but does not supersede them; where it states a requirement beyond the referenced standards, that requirement is called out and is enforceable. | **Area** | **Source of Authority** | | ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Message structure and the ITI-41 transaction | IHE IT Infrastructure Technical Framework ([Document References](docId\:zT9Op0w2lVchwQV38E85W)), as clarified in this guide. | | Metadata requirements | IHE and DirectTrust XDR/XDM specifications ([Document References](docId\:zT9Op0w2lVchwQV38E85W)); Surescripts does not enforce metadata beyond the standards. | | Connectivity, certificates, endpoints, networking, and transport | Surescripts Connectivity and Authentication Guide. | | Direct address directory (publishing, search, and use) | Surescripts Directory Implementation Guide and the DirectTrust Aggregated Directory Data Sharing Policy. | | What Surescripts validates for production | Surescripts Application Certification Requirements and additional business rules applied during certification. | | Trust framework and flow-down obligations | [DirectTrust Trust Framework and Flow-Down Terms](docId\:pmVq7Uy_7YMaKt3XdRoA1) | | Best-practice guidance (recommended, not required) | [Application Certification Requirements](docId\:WsFITp7Dv6u1yRn7zBxD8) |