Managing your Site and NASH certificates

The NASH and Site Certificates for many Bp Premier practices will expire on Sunday 13 March 2022 at midday. These certificates are used for several important functions and must be renewed on expiry for continued access to the features listed below.

The PKI Site certificate is used for all Medicare integration including:

  • Medicare Online Eligibility Checks
  • Medicare Patient Claiming
  • Medicare Bulk Bill Claiming
  • DVA Bulk Bill Claiming
  • Australian Immunisation Register

The NASH certificate is used for:

  • My Health Record
  • Health Identifier (HI) Service
  • eRx Prescription Exchange
  • National Cancer Screening Register

Check and update the PKI Site Certificate

Check and update the NASH certificate

Check and update the PKI Site Certificate

The PKI Site Certificate is used for Medicare and DVA claiming for all versions prior to Saffron SP3. If your practice has updated to Saffron SP3 and is now using Medicare Web Services, no action is required with regards to the site certificate.

For practices that are using a version prior to Saffron SP2, the site and Medicare certificates must be renewed before March 13 to continue Medicare claiming. These certificates are normally auto-renewed by Services Australia. However, Best Practice Software has been made aware that this may not be the case for all practices.

To prevent disruptions to claiming Best Practice Software recommend that you confirm all certificates have been updated, and follow the instructions if any certificates require updating.

After March 13, if you receive the 'Location Certificate (HCL) has expired' error message shown below, your site certificate has expired and must be renewed.

Check Certificate Expiry

  1. Log in to Bp Premier.
  2. Select Setup > Configuration > Online Claiming.
  3. Click Check certificate expiry. The HeSA Certificates screen will appear.

    4. Test certificates are shown in the screen example above. In your screen, the site certificate will have your practice name under the Certificate owner column and your practice's email registered with Medicare in the E-mail column.

  4. Check the practice’s site certificate has an expiry beyond March 13 2022 (the expiry will likely be 2024).
  5. Check Medicare certificates also have an expiry beyond March 13 2022.
  6. Click Cancel to close.
  7. If any certificates expire on or before March 13, follow the instructions in Update expired certificates.

NOTE  Old certificates are not automatically removed from the store when they expire, and can be ignored as long as there is a more current version that has the same Certificate owner and Usage.

Update expired certificates

There are seven certificates required for Medicare claiming. The ones requiring attention are listed below and the actions required if they expire on March 13 2022.

Certificate owner

Usage

Action

<Practice Business Name>

Digital Signature

These certificates are the practice’s site certificate. If they expire on March 13, or you have renewed the certificate but still receive errors on attempted transmission (such as a '1705 Secure Failure'), follow the instructions below.

IMPORTANT  Do not delete old versions of these certificates from the Bp Premier certificate store. If old certificates are removed, new certificates obtained from Certificates Australia will not work when imported.

If you have a previous site certificate:

  1. In a browser, open the Certificates Australia website.
  2. Download the site certificate for your practice.
  3. In Bp Premier, import the new certificate into the certificate store.

If your site certificate cannot be found on the Certificates Australia website, your practice may have received an updated certificate on a CD.

  1. Locate the CD and insert into a Bp Premier workstation.
  2. Open Bp Premier and go to Setup > Configuration > Online Claiming.
  3. Import the certificates from the disk.

If you have a CD with an updated certificate AND you also find an updated certificate on the Certificates Australia website:

  1. In Bp Premier Setup > Configuration > Online Claiming, try importing the certificate from the CD first.
  2. If that continues to produce a 1705 error, try importing the certificate from the Certificates Australia website.

If your practice has not received a disk and the certificate cannot be found on the Certificates Australia website, or you are still getting errors after importing a new certificate, you will need to contact Services Australia eBusiness on 1800 700 199 to request a new site certificate.

<Practice Business Name>

Key Encipherment

Medicare Australia

Digital Signature

These two certificates should auto-renew on the 11 March 2022. If they have not auto-renewed, Best Practice Software has supplied updated versions of these certificates that you can download and import into Bp Premier.

  1. Right-click and select Save Target As or Save Link As to download the following certificate files:
    1. Medicare_Australia_Encrypt.cer
    2. Medicare_Australia_Sign.cer
  2. Copy both files to the Bp Premier server.
  3. Log in to Bp Premier and go to Setup > Configuration > Online Claiming.
  4. Click Import Medicare certificate.
  5. Click Change folder to browse to the location where you saved the two .cer files.
  6. Click the row for the 'Medicare Australia Organisation Certification Authority' that is expiring.
  7. Click Attach. Bp Premier will report that the certificate was successfully imported.
  8. Repeat for the Medicare Australia Root Certification Authority.
  9. Close out of the Configuration screen.

Medicare Australia

Key Encipherment

Medicare Australia Organisation Certification Authority

Digital Signature

These certificates should not be expiring on March 13. However, if they are not configured correctly, you can reimport these certificates by following the instructions in this Bp Premier Knowledge Base article.

Medicare Australia Root Certification Authority

Digital Signature

SecureNet Limited Root Certification Authority

Digital Signature

This certificate should expire later in 2022 and does not need renewing yet.

Check and update the NASH certificate

Yyou will need to confirm that your NASH certificate has been renewed and imported to prevent any disruptions after 13 March 2022.

Historically, both the HI Service and eRx Prescription Exchange have used the PKI Site certificate. However, both those services now support the use of a NASH certificate. If you have run the March 2020 Data Update, eRx has already been configured to use the NASH certificate.

After March 13, if you receive the error messages shown below, your NASH certificate has expired and must be renewed.

Check NASH Certificate Expiry Date

Best Practice Software has created a script that can be run on any workstation to confirm the expiry date and type of certificate that has been imported for the My Health Record and HI Service. To check the expiry, follow the steps below.

  1. Download the file DisplayCertificateDetails.bpscript here and copy the file to any workstation.
  2. Run the downloaded script using the Bp Script Runner Utility. Instructions on running the Bp Script Runner are included in the link.

The script will output the type of certificate used for each function, when the certificate expires, and whether it needs to be renewed. If Yes is listed under the Requires Renewal column for any of the functions, you will need to renew and import the renewed NASH certificate.

Renew the PKI NASH Certificate

If the script indicates that your NASH requires renewal, you will need to obtain a new one from Services Australia through HPOS. Services Australia have a Quick Reference Guide on downloading a new NASH certificate.

Any questions regarding renewing the NASH certificate or using HPOS should be directed to Services Australia using the following details:

NASH Certificates

HPOS

Phone: 1800 700 199 and select Option 1

Monday to Friday 8am to 5pm AWST

Email: ebusiness@servicesaustralia.gov.au

Phone: 132150

Select Option 6 Electronic Claiming or Health Professional Online Service (HPOS)

Monday to Friday 8am to 5pm AWST

Your passphrase for the new certificate will be sent separately, to the email address or mobile phone number your practice has registered in your HPOS account.

1. Import a new NASH certificate for the HI Service and My Health Record

If the script reports either Site certificate or NASH certificate used for the My Health Record or HI Service requires renewal, or reports ‘Not Found’, you must import the renewed NASH certificate through Bp Premier.

Select Setup > Configuration > General and follow the instructions in this Knowledge Base article. Browse and select the renewed certificate you received from Services Australia.

When importing or renewing the NASH certificate, if you only have a single HPI-O for the practice then the NASH certificate should always be imported for the 'Default' location. If you have multiple locations with different HPI-O numbers then a NASH can be imported for each location. However one NASH certificate still needs to be imported for the 'Default' location as this certificate will be used for the nightly check on whether a patient has a My Health Record.

The certificate chosen for the 'Default' location can be any NASH certificate as long as it matches the HPI-O entered under Setup > Practice details > Change.

NOTE  Ensure the updated NASH certificate has been imported as the default in the Bp Certificate Import tool as the utility will perform the update using this certificate.

2. Import new NASH certificate for eRx Prescription Exchange

You must import the renewed NASH certificate into Bp Premier for My Health Record as described above before you import the same certificate for eRx.

The March 2022 Data Update will automatically update eRx to use the NASH certificate, if the NASH certificate has been imported into Bp Premier and expires after 13 March 2022. This update will only use the NASH certificate imported under the location of 'Default', so you will need to make sure this has been updated in addition to any specific locations.

Best Practice Software has made available a utility that automatically updates the NASH PKI certificate used by Bp Premier in the Windows certificate store.

Notes on running the certificate update utility

  • You must run the utility on the Bp Premier server.
  • You must run the utility as an administrator.
  • Your current NASH certificate must expire after 13 March.
  • Your current NASH must be imported as the default in the Bp Certificate Import tool.
  1. Download the utility according the version of Bp Premier you have installed:

    2. Bp Premier Version

    Build Number

    Utility

    Saffron SP2

    1.11.2.952

    Download

    Saffron SP3

    1.11.3.968

    Download

    Your browser may alert that the file is a security risk. You can safely keep this file. If necessary, right-click on the link and select Save Target/Link as.

  2. Copy this file to the Bp Premier server.
  3. Right-click the file BP_eRxNASH_Cert_Updater.exe and select Run as Administrator. The utility needs Windows Administrator permissions to access the certificate store.
  4. When presented with the wizard, click Next.

    5. The utility will first check the expiry date of the current stored certificate, and will ask you to renew the certificate first if the expiry date is before 13 March 2022. Please update your certificate if it is displayed as expiring on the 13 March 2022.

  5. Otherwise, click Update eRx Certificates.

  6. The utility will update the NASH certificate for eRx and display the outcome of the update.

The following wizard window displayed behind will always show it has completed successfully when the Update eRx Certificates utility has been run. It can be closed out by clicking the Finish button after the Update eRx Certificates utility has provided an outcome in step 6.

Confirm eRx is working for all doctors

A known issue has been identified for a small number of practices after the eRx certificate import utility has been run. If eRx has stopped working for any doctors after you run the utility, follow the instructions below.

  1. In a Windows File Explorer, browse to the folder C:\Program Files\Best Practice Software\BPS and double-click the file eRx setup.exe.
  2. Log in with a Bp Premier username and password and click Setup users.
  3. Retrieve the thumbprint assigned to the entityIDs of the doctors affected.
  4. Call eRx support and confirm that the thumbprint at the eRx gateway matches the thumbprints from eRx setup.exe.
  5. If there are differences, request eRx support to update the thumbprint at the gateway to match the thumbprints from eRx setup.exe.
  6. Once thumbprints have been updated by eRx, test eRx for the doctors affected in Bp Premier to confirm eRx is now working.

 

 

Last updated 23 March 2022