Medicare Online claiming: installation and authentication

About this guide

HealthOS is a hosted web application. "Installing" HealthOS for Medicare Online and ECLIPSE claiming therefore means: HealthOS provisions your organisation on the hosted platform; your organisation obtains its registrations from Services Australia and PRODA; and your administrator connects the two by activating a PRODA B2B device in HealthOS. Nothing is installed on staff workstations.

This guide covers installation and access (sections 2 to 4) and authentication — of your staff to HealthOS and of HealthOS to Services Australia (sections 5 and 6). Day-to-day claiming is in the companion HealthOS User Manual — Medicare Online, ECLIPSE and DVA Claiming.

To find a subject, press Ctrl+F (Cmd+F on a Mac) and type a word or phrase, or use Word's Navigation Pane / a PDF reader's bookmarks.

Contents

1. About this guide
2. 1. Support and contact details
3. 2. How HealthOS is delivered
4. 3. Requirements
5. 4. Installation (onboarding) steps
6. 5. Authenticating staff to HealthOS
7. 6. Authenticating HealthOS to Services Australia (PRODA B2B)
8. 7. Troubleshooting installation and authentication
9. Appendix A. Configuration record

1. Support and contact details

When reporting a problem, give your organisation, what you were doing, the message shown, and any Transaction ID displayed.

2. How HealthOS is delivered

3. Requirements

3.1 Workstations and browsers

• A current, supported version of Microsoft Edge, Google Chrome, Mozilla Firefox or Apple Safari. Minimum versions: Edge/Chrome 107, Firefox 104, Safari 16.
• JavaScript enabled; cookies and local storage allowed for the HealthOS address (the session token is held in the browser).
• Pop-ups allowed for the HealthOS address, so claim documents (Statement of Claim and Benefit, Lodgement Advice, DB4, OEC report) open for printing.
• A printer available to the browser for claimant documents.
• Screen resolution of at least 1366 × 768; 1920 × 1080 recommended for the claiming screens.

There is no software, plug-in, certificate or card reader to install.

3.2 Network

• Outbound HTTPS (TCP 443) from workstations to your HealthOS address. No inbound connection to your site is needed.
• No firewall rule to Services Australia or PRODA is needed at your site: those calls are made from the HealthOS platform.
• If your network uses a filtering proxy, allow your HealthOS address (and, if single sign-on is used, your identity provider such as login.microsoftonline.com).

3.3 What your organisation needs from Services Australia

HealthOS supplies the values that belong to the software, with your Minor ID, when your organisation is set up: the X-IBM-Client-Id (generated for HealthOS by Services Australia's Health Systems Developer Portal), the product name (HealthOS_Prod_MCOL_v1.0) and the product version.

4. Installation (onboarding) steps

4.1 Overview

4.2 Step 2 — provisioning by HealthOS

HealthOS staff create your organisation on the hosted platform: its facilities and organisation structure, the HealthOS modules you use, the eclipse (Medicare Online / ECLIPSE) and proda connectors in your organisation's licence, and an administrator account for your nominated administrator. HealthOS then gives you:

• your staff portal address (and the admin portal at that address followed by /admin/),
• the administrator's username and how to set the password (or the single sign-on arrangement),
• the X-IBM-Client-Id, product name and product version to enter in the Guided Setup.

4.3 Step 3 — users, roles and sign-in policy

1. Sign in to the admin portal as the administrator.
2. Organisation → Users & Roles: create an account for each staff member and assign roles. Claiming staff need a role with access to the patient chart and to PAS → Billing & Claims (for example Finance Officer). Configuration of PRODA, Medicare Online / ECLIPSE, health funds and MBS items is done by an administrator in the admin portal.
3. Platform → Authentication & Identity: configure single sign-on if used (for example Microsoft Entra ID), and the session policy:

- Inactivity timeout — idle sessions sign out automatically; 15 minutes by default, configurable up to 120. - Enforce MFA for administrators — administrator accounts must sign in through single sign-on with multi-factor authentication. - Require MFA for all accounts — extends that to every account (only switch on once single sign-on is configured). - Account inactivity — accounts not used for 45 days (by default) are disabled automatically.

4.4 Step 4 — register the B2B device in PRODA

See section 6.2, steps 1 to 4.

4.5 Step 5 — Medicare / ECLIPSE Guided Setup

See section 6.2, steps 5 to 7, and section 6.3 for checking the result.

4.6 Step 6 — reference data

• Care Admin → Health Funds → Get Participants loads the current health fund list from Services Australia (GPRW).
• Care Admin → MBS Items — check the schedule is current (User Manual section 16.1).
• Record practitioners' Medicare provider numbers (User Manual section 16.3).

4.7 Step 7 — confirm it works

1. In the admin portal, PRODA settings → Test Authentication shows Authentication Test Passed; Eclipse / Medicare Online settings → Test Connection succeeds.
2. In the staff portal, open a patient's chart → Intake → System: Intake — Coverage & Eligibility and run a Patient Verification (User Manual section 5). A Transaction ID beginning with your Minor ID is shown.

5. Authenticating staff to HealthOS

5.1 Signing in

1. Open your organisation's HealthOS address.
2. Enter Username and Password, or choose your organisation's single sign-on button (for example Microsoft).
3. Where your organisation requires multi-factor authentication, password sign-in is refused with "Your organisation requires multi-factor authentication. Please sign in with Microsoft single sign-on." (administrators: "Administrator accounts must sign in with Microsoft single sign-on…"). Use the single sign-on button.

5.2 Sessions and access

• A signed-in session is bound to one organisation; every request is checked against it, and data from other organisations is never visible.
• The session signs out after the inactivity period set in section 4.3.
• What a user can see and do is set by their roles. Every call made to Services Australia is recorded with the user, time and Transaction ID and can be reviewed on PAS → Billing & Claims → Online Claiming → Transactions.
• Staff never sign in to PRODA to claim; HealthOS authenticates to Services Australia on the organisation's behalf (section 6).

6. Authenticating HealthOS to Services Australia (PRODA B2B)

6.1 How it works

HealthOS uses PRODA B2B unattended authentication for every Medicare Online and ECLIPSE web service:

1. Your organisation registers a B2B device for HealthOS in PRODA.
2. HealthOS activates the device once, using the one-time device activation code: it generates an RSA key pair on the server and registers the public key with PRODA. The private key never leaves HealthOS; it is stored encrypted (AES-256-GCM) in your organisation's configuration and cannot be viewed by any user.
3. For each call, HealthOS signs an assertion with the device key (issuer: your RA number; audience: the Medicare Online service, https://medicareaustralia.gov.au/MCOL), exchanges it at PRODA for an access token, caches the token until shortly before it expires, and sends it with the request together with the X-IBM-Client-Id, the product identifier (dhs-productId) and your Location ID (dhs-auditId).
4. HealthOS refreshes the device key automatically before it expires (section 6.4).

For more information about PRODA see PRODA (Provider Digital Access) - Services Australia: https://www.servicesaustralia.gov.au/proda-provider-digital-access

6.2 Registering and activating the B2B device

In PRODA (a PRODA member of your organisation who can manage B2B devices):

1. Sign in to PRODA (https://proda.humanservices.gov.au), select Organisations and choose your organisation.
2. In the B2B Devices drop-down choose Register New B2B Device.
3. Enter a device name (for example HealthOS-B2B-Device) and a description, and choose Register Device. The name must be unique in your organisation; record it exactly.
4. Copy the device activation code PRODA displays (Copy to Clipboard). It works once and, in production, expires 1 day after it is issued (7 days in Services Australia's vendor test environment), so complete steps 5 to 7 straight away.

In the HealthOS admin portal (an administrator):

5. Open Interoperability → Integration Topology and select the PRODA or Eclipse / Medicare Online endpoint. In the Government gateways — Services Australia & Dept of Health panel choose Medicare / ECLIPSE Guided Setup.
6. Complete the four steps:

7. Apply runs four steps and shows the outcome of each: Save PRODA configuration, Save Eclipse configuration, Activate PRODA B2B device, Test connection (PRODA token + ping). On success: "Medicare Online / ECLIPSE claiming is configured".

The mode sets the PRODA token endpoint, the device activation address, the claiming address and the token audience together:

6.3 Checking the configuration

• The Government gateways panel lists PRODA and Eclipse / Medicare Online with status (Connected), last sync and the device expiry with days remaining.
• The PRODA row's edit action opens PRODA B2B Authentication Configuration. Test Authentication obtains a token and reports Authentication Test Passed or the reason it failed; "Last token" shows when HealthOS last authenticated. The activation code is never displayed.
• The Eclipse / Medicare Online row's edit action shows the values inherited from PRODA (mode, RA number, B2B device and whether it is activated, key expiry, API base URL), the X-IBM-Client-Id, Minor ID / Location ID, product details and the NOI number and dates. Test Connection checks the full path to Services Australia.

6.4 Device key refresh and device renewal

Notification. From 30 days before the earlier of the two dates, the admin portal's Government gateways panel shows "PRODA device expires in N days — renew the Device in PRODA", naming the device and the date. Within 7 days it becomes an error-style alert; after the date it reads "PRODA device has EXPIRED — re-activate the device in PRODA". It cannot be dismissed and appears every time the panel is opened until the device is renewed or the key refreshed. The aged care (ACWS) console in the staff portal shows the same banner with a Refresh key now button.

If the key or device has expired, claiming stops with an authentication error, because an expired key cannot sign a refresh. Generate a new device activation code in PRODA and re-activate: enter it in the Guided Setup's Device activation code ("Enter a new activation code to re-activate the device"), or in the PRODA settings' Device Activation Code and choose Re-activate Device.

6.5 Changing or revoking the device

• To move to a new device (for example after a PRODA administrator change), register the new device in PRODA and activate it in HealthOS with its name and activation code. The new key replaces the old one for your organisation.
• To stop HealthOS claiming for your organisation, switch off Enable PRODA Authentication in the PRODA settings, and deactivate the device in PRODA.

7. Troubleshooting installation and authentication

Appendix A. Configuration record

Keep a record of the values used for your organisation (never record the activation code — it is single-use).

Still stuck? Email support@healthos.net.au