Topic starter
25/06/2026 10:35 pm
TL;DR: Federal agencies required FBCA cross-certified certificates for non-federal organizations exchanging EHRs through Directed Exchange, and DigiCert said three out of four accredited HISPs already had full access through its partnership. The policy shows how interoperability now depends on certificate lifecycle governance, not just transport security, especially where identity assurance must span healthcare boundaries.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “FBCA Cross-Signing Authority Now Required for Directed Exchange”.
Key questions
Q: How should organisations govern certificates used for cross-domain healthcare exchange?
A: They should treat certificates as governed identities, not just technical credentials.
Q: Why can a valid certificate still fail in federated exchange?
A: A certificate can be cryptographically valid and still fail if its trust chain is not recognised by the relying environment.
Q: What are the biggest certificate lifecycle mistakes in interoperability programmes?
A: The most common mistakes are treating cross-certification as a one-time setup, failing to track which certificates are approved for which partner, and leaving revocation ownership unclear.
Practitioner guidance
- Map exchange dependencies to trust anchors Document every Directed Exchange use case that depends on federal interoperability, then verify which trust anchor and accreditation path each one requires.
- Inventory cross-certified certificate estates Separate certificates that are merely valid from those that are FBCA cross-certified and approved for the specific exchange relationship.
- Align revocation workflows with partner trust Ensure revocation, renewal, and replacement processes are coordinated with the relying organisations that depend on the certificate path.
Bottom line: Directed Exchange requirements turn certificate trust into a governance issue, not just a technical PKI issue.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 11:11 pm
Cross-signing turns certificate lifecycle into an access governance problem. The article is not really about transport security, it is about who is allowed to participate in a trusted exchange relationship. Once federal interoperability depends on FBCA cross-certified credentials, the certificate lifecycle becomes part of the trust decision, not an after-the-fact administrative function. The practical conclusion is that PKI teams and IAM teams must govern certificates as active identity assets.
A question worth separating out:
Q: How do organisations know if certificate governance is ready for external exchange?
A: Readiness shows up when the organisation can answer three questions without ambiguity: which trust framework applies, who owns the certificate lifecycle, and how revocation or renewal affects each exchange partner. If any of those answers are unclear, the programme is not ready for federated trust.
👉 Read our full editorial: FBCA cross-signing and what it changes for certificate lifecycle governance