2 Cerner HISP SuscriberApplication_FINAL.pdf

© Cerner Corporation. All rights reserved. This document contains Cerner confidential and/or proprietary information belonging to Cerner Corporation and/or its related affiliates which may not be reproduced or transmitted in any form or by any means without the express written consent of Cerner.

Cerner Direct HISP

Welcome to Cerner Direct!

Congratulations on taking the first steps toward utilizing Cerner Direct for simple and secure exchange of health care information. The Cerner Direct Health Information Service Provider (“HISP”) is a full service HISP, compliant with national Direct Project standards and accredited through the Direct Trusted Agent Accreditation Program (DTAAP).

This application packet includes a Cerner Direct HISP Application. This application aligns with industry expectations that all trusted professional Directed exchange participants are part of an organization that is either (i) a HIPAA covered entity or a business associate, or (ii) a healthcare related organization which treats protected health information with privacy and security protections that are equivalent to those required by HIPAA. The end outcome is to establish a unique digital identity of the Subscriber. This is accomplished by issuing a digital certificate, which is subsequently used as a unique “signature” to ensure authenticity of any information being communicated via Cerner Direct by the Subscriber. Therefore, it is important for Cerner’s Registration Authority, DigiCert, to first verify the authenticity of the Subscriber and the Authorized Representative making the request by utilizing the information you will provide in the DigiCert Declaration of Identity agreement (sample available at www.cerner.com/cps).

After you successfully complete the Cerner Direct HISP and DigiCert Declaration of Identity application processes, you will become a Cerner Direct Subscriber, and your organization’s Direct addresses will be universally accepted by trusted recipients across the nation.

Instructions

Step 1: Complete the Cerner Direct HISP Application for the production Direct domain being requested and submit to Cerner. The form must be signed by an Authorized Representative. Submit completed form to eService (Solution Family of Community & Consumer Health, Solution of Cerner Direct). If you do not have access to eService, please contact your distributing partner for submission on your behalf or call Cerner Client Care at 1-866-221-8877 Option 6 and mention Cerner Direct Messaging and request to email the application in to be added as an SR attachment. Keep the original completed Application for your records.

Step 2: Once submitted to Cerner and processed for certificate request, you will be contacted shortly thereafter by DigiCert, our Registration Authority, to complete and submit the Declaration of Identity agreement to verify personal identity. Upon successful completion of these steps, you will be notified of a Direct certificate issuance.

For more information, visit Cerner Direct on uCern.

http://www.cerner.com/cps

Document Title: Cerner Direct HISP Application Rev: 002 Effective Date: 04/10/2015 Page 1 of 1 Page Identifier: 1322492822 Cerner Corporation. All rights reserved. This document contains confidential and/or proprietary information belonging to Cerner Corporation and/or its related affiliates which may not be reproduced or transmitted in any form or by any means without the express written consent of Cerner.

Submit completed form to eService (Solution Family: Community & Consumer Health, Solution: Cerner Direct). If you do not have access to eService, please contact your distributing partner for submission on your behalf or call Cerner Client Care at 1-8666-221-8877 Option 6 and mention Cerner Direct Messaging.

Cerner Direct HISP Application

Once submitted to Cerner and processed, you will be contacted by Cerner’s trusted partner, DigiCert, for completion of their Declaration of Identity form (sample available from http://www.cerner.com/cps) to confirm the Authorized Representative’s identity per DirectTrust standards.

Organization Information

Legal Business Name:

Mailing Street Address:

City: State: Zip:

Healthcare Category

If you are not a Covered Entity as defined by HIPAA, select one (no selection indicates Covered Entity Status):

Business Associate as defined by HIPAA Non-HIPAA Healthcare Entity defined as an entity that has an appropriate healthcare-related need to exchange Direct messages and which agrees to handle protected health information with privacy and security protections that are at least as protective as those required by HIPAA.

Direct Email Domain

The following Direct email domain has been selected for your organization:

Prod @____.cernerdirect.com NonProd @____.stagingcernerdirect.com

Authorized Representative Contact Information

First Name: Last Name:

Business Email: Phone:

Primary Contacts for Cerner Direct Notifications (optional)

Name: Phone: Email:

Authorized Representative Signature Subscriber’s use of Cerner Direct is subject to the parties’ agreements in Contract Number 410008-M16-EB4253A-RFP-01, effective June 28, 2016,and the Certification Practice Statement, which is available at http://www.cerner.com/cps and the Cerner Direct Terms of Use available at https://cernerdirect.com/mail/termsofuse.action.

Subscriber warrants: (i) the information contained herein is true and accurate, (ii) it will comply with all applicable federal and state privacy laws, including but not limited to HIPAA, (iii) the information provided above does not infringe on the intellectual property rights of another person or entity including any trademarks associated with the requested Direct email domain, (iv) it will limit access to employees, subcontractors or agents of the Subscriber and Subscriber’s Affiliates engaging in “Treatment,” “Payment,” and “Health Care Operations” as defined by HIPAA, each such employee, subcontractor or agent who is authorized by Client to use Cerner Direct shall be an “End User”, and (v) it will promptly remove an End User’s access to Cerner Direct upon (a) an End User leaving their practice or organization, (b) an End User violating any of the Cerner Direct Terms of Use, (c) reasonable request by Cerner, or (d) any event otherwise deemed appropriate by the Subscriber. Subscriber agrees to notify Cerner (y) of any actual or suspected abuse or misuse of Cerner Direct, and (z) in advance and in writing, of any changes to Subscriber’s “Healthcare Category” selected above.

Affiliate shall mean any company controlled by, controlling or under common control with Licensee. For purposes of this definition, “control” means the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of such person or entity, whether through ownership of more than fifty percent (50%) of the outstanding voting securities or other interests, or by contract.

I, as the Authorized Representative, am authorized to act in the name of the Subscriber and represent that I am an employee or agent of the Subscriber.

You understand that before you may use Cerner Direct, you must successfully complete this application and subsequently DigiCert’s Declaration of Identity application, which includes confirmation of your identity, as required by DirectTrust.

Signature:

Print Full Legal Name:

Title: Date:

Wisconsin Department of Corrections

3099 East Washington Ave

Madison WI 53704 widoc widoc

Cathy Jess cathy.jess@wisconsin.gov 608 240-5055

Cathy A Jess

Deputy Secretary

Robert Beaverson 608 240-5640 docdldmsbtmemrbusinessanalysts@wisconsin.gov https://cernerdirect.com/mail/termsofuse.action http://www.cerner.com/cps

Document Title: Cerner Direct HISP Application Rev: 002 Effective Date: 04/10/2015 Page 1 of 1 Page Identifier: 1322492822 Cerner Corporation. All rights reserved. This document contains confidential and/or proprietary information belonging to Cerner Corporation and/or its related affiliates which may not be reproduced or transmitted in any form or by any means without the express written consent of Cerner.

10/5/2017 Welcome to Cerner Direct https://cernerdirect.com/inboxes/welcome-terms 1/2

Terms of Use Cerner Direct is offered to you by Cerner Corporation ("Cerner"). Your use of Cerner Direct is governed by these terms of use ("Terms"), and by using or accessing Cerner Direct you agree to be bound by them. If you do not agree to these Terms, you may not use Cerner Direct. In certain circumstances Cerner may have a separate agreement directly with you or your system administrator governing your use of Cerner Direct; in the event of any conflict between these Terms and terms of such other agreement, the terms of such other agreement shall prevail.

Creating and Accessing Your Account Your system administrator, such as your employer or a health information exchange or an accountable care organization, will assign your Cerner Direct account to you.

You may not permit any other person to access your account using your user name and password. The security of your password and the use of your account is your responsibility. If you learn or suspect that your user name or password has been wrongfully used or disclosed, you should promptly notify Cerner and your system administrator and immediately reset your password. To help ensure the security of your password or account, please sign out of your account at the end of each session. You must be at least 18 years old to establish an account.

You are responsible for ensuring your account information is current, accurate, and complete.

Cerner Direct Service Information Exchange. Cerner Direct is designed to enable the secure exchange of healthcare-related information between providers and organizations engaged in providing care and consumers receiving care. Cerner is not responsible for the timeliness, deletion, mis-delivery or failure to store any communications or personalization settings within, by or through Cerner Direct. Cerner Direct is not a replacement for an electronic medical record and is not for use in emergencies. In the event of a true emergency, you should use another means of communication.

Prohibited Activities. You may not use Cerner Direct for any prohibited activities. By way of example, and not as a limitation, you agree that when using Cerner Direct, you will not:

Defame, abuse, harass, stalk, threaten, damage the reputation of or otherwise infringe or violate the legal rights (such as rights of privacy and publicity) of others;

breach any legal duty owed to others nor advocate, promote or incite any third party to commit or assist any unlawful or criminal act.

Publish, post, upload, transmit, distribute or disseminate any inappropriate, profane, defamatory, infringing, obscene, offensive, discriminatory, indecent, illegal or unlawful topic, name, material or information.

Intentionally transmit or distribute inaccurate, false or misleading information or information containing your personal opinions not genuinely held by you.

Upload files that contain software or other material protected by intellectual property laws (or by rights of privacy of publicity) unless you own or control the rights thereto or have received all necessary consents.

Publish, post, transmit, upload or distribute another's confidential, proprietary, sensitive or personal information or any information relating (directly or indirectly) to any past or existing commercial arrangements, contracts, engagements or provision of goods and services between any persons or organizations which is in violation of any arrangements, contracts, engagements, professional rules of ethics or any applicable law or regulation.

Intentionally upload files that contain viruses, worms, corrupted files, or any other similar software, programs or malicious content that may damage the operation of systems hosting Cerner Direct or another's computer.

Advertise or offer to sell or buy or make available any goods or services for any business purpose, unless Cerner Direct specifically allows such messages in which case you shall not advertise or offer to sell or buy or make available any unlawful goods or services.

Influence or attempt to influence, for commercial purposes, (through economic incentives or otherwise) any diagnostic or treatment-related decisions of a healthcare provider.

Conduct or forward surveys (unrelated to your business), contests, pyramid schemes or chain letters.

Generate or facilitate unsolicited commercial email ("spam").

Download any file posted by another user of Cerner Direct that you know, or reasonably should know, cannot be legally distributed in such manner.

Falsify or delete any author attributions, legal or other proper notices or proprietary designations or labels of the origin or source of software or other material contained in a file that is uploaded.

Restrict or inhibit any other user from using and enjoying Cerner Direct.

Violate any applicable laws or regulations.

Communication Tool. Cerner Direct is provided as a communication tool only. It is your responsibility to ensure that you (i) comply with all applicable laws, rules and regulations as you use Cerner Direct, (ii) comply with any policies and procedures imposed by your system administrator, if applicable, regarding your use of Cerner Direct and (iii) obtain all appropriate and necessary consents to use or disclose any personally identifiable information in compliance with all federal and state privacy laws, including but not limited to the Health Insurance Portability and Accountability Act ("HIPAA").

Viruses. Cerner takes commercially reasonable measures to check that messages sent through Cerner Direct are free from viruses and other malicious computer instructions, devices or techniques ("Viruses"), however, Cerner does not guarantee the messages have not been infected with a Virus. It is your responsibility to protect your computer systems from Viruses.

Record Retention and Classification. Cerner Direct is not a medical record. It is your responsibility to ensure that messages sent through Cerner Direct are incorporated into a patient's medical record as necessary. Termination of your account will result in permanent deletion of all messages contained within your account. You are responsible for creating and maintaining your own records retention policy for Cerner Direct messages.

Operation and Termination. Cerner reserves complete and sole discretion with respect to the operation of Cerner Direct. Cerner may, among other things, delete email if it has not been accessed by a user within the time established by any posted Cerner policies. Cerner will not review the contents of email except as required or allowed by applicable law or legal process.

Cerner may terminate or suspend your access to Cerner Direct and may delete your personal account, at any time, without providing notice to you. Any such termination or suspension may be subject to the terms of other applicable agreements (i) directly between you and Cerner, or (ii) between your system administrator and Cerner.

Participating in the Directory Your system administrator may enable your participation in a Health Care Directory ("Directory"), which contains information about individuals outside of your organization (such as name, title and practice specialty) in an effort to facilitate your communication with them. If you use the Directory, you agree not to:

Copy, or allow to be copied, the information contained in the directory.

Sell the information contained in the directory.

Disclose the information contained in the directory.

Use, or allow use of, the directory for direct marketing, database marketing, telemarketing, marketing analysis, or research purposes.

Use of the Directory is subject to the Directory Terms available here.

Cerner Direct http://www.cerner.com/Health_Care_Directory_Policy/ https://cernerdirect.com/inboxes/

10/5/2017 Welcome to Cerner Direct https://cernerdirect.com/inboxes/welcome-terms 2/2

Disclosure of Information Cerner may, in Cerner's sole and reasonable discretion, disclose any information necessary to satisfy applicable law, regulation, legal process or governmental request.

Privacy You agree to the terms and conditions of the Privacy Policy, which is hereby incorporated into and made part of these Terms.

No Warranties; Limitation of Liability Cerner Direct is a communication tool only. You are responsible for any acts or omissions relating to your use of Cerner Direct and for any damages incurred as a result thereof. CERNER DIRECT IS PROVIDED TO YOU "AS IS" WITHOUT WARRANTY OF ANY KIND. CERNER DOES NOT WARRANT THE RELIABILITY OR AVAILABILITY OF CERNER DIRECT, NOR DOES CERNER GUARANTEE THAT CERNER DIRECT WILL BE ERROR-FREE OR UNINTERRUPTED OR THAT DEFECTS WILL BE CORRECTED. TO THE EXTENT PERMITTED BY LAW, CERNER AND ITS SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESS AND IMPLIED. TO THE EXTENT PERMITTED BY LAW, NEITHER CERNER NOR ITS SUPPLIERS WILL BE RESPONSIBLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR LOST PROFITS, REVENUES OR DATA. NEITHER CERNER NOR ITS SUPPLIERS WILL BE LIABLE TO YOU FOR ANY DAMAGES EXCEEDING THE GREATER OF (A) THE FEES YOU PAID FOR USE OF CERNER DIRECT, OR (B) ONE THOUSAND DOLLARS. IF YOU ARE DISSATISFIED WITH CERNER DIRECT, OR WITH THESE TERMS, YOUR SOLE AND EXCLUSIVE REMEDY IS TO DISCONTINUE USING

CERNER DIRECT.

Indemnification YOU AGREE TO INDEMNIFY, DEFEND, AND HOLD CERNER AND ITS SUPPLIERS HARMLESS FROM AND AGAINST ALL CLAIMS, DAMAGES, AND EXPENSES ("CLAIMS") ARISING OUT OF OR RELATED TO YOUR USE OF CERNER DIRECT, OTHER THAN THOSE CLAIMS ARISING OUT OF OR RELATED TO CERNER'S

NEGLIGENCE OR WILLFUL MISCONDUCT IN PROVIDING CERNER DIRECT.

Feedback Cerner welcomes your suggestions to improve Cerner Direct. If you provide feedback to Cerner, you agree that such feedback, including all ideas and concepts within the feedback, shall be the property of Cerner and you assign to Cerner your ownership rights in the feedback.

Notices Cerner may deliver notice to you by means of electronic mail, a general notice on Cerner's website, or by written communication delivered by first class U.S. mail to your address on record within your account in Cerner's account information. You may give notice to Cerner at any time by letter delivered by first class postage prepaid U.S.

mail or overnight courier to the following address:

Cerner Corporation 2800 Rockcreek Parkway Kansas City, Missouri 64117 U.S.A.

Attention: Chief Legal Officer

General These terms are governed by the laws of the State of Missouri, U.S.A. You consent to the exclusive jurisdiction and venue of courts in Clay County, Missouri, U.S.A. in all disputes arising out of or relating to your use of Cerner Direct. Any cause of action or claim you may have with respect to Cerner or its suppliers must be commenced within one (1) year after the claim or cause of action arises. Cerner's failure to enforce strict performance of any provision of these Terms shall not be construed as a waiver of any provision or right. Cerner may assign its rights and duties to any party at any time without notice to you.

Cerner's performance of these Terms is subject to existing laws and legal process, and nothing contained in these terms is in derogation of Cerner's obligation to comply with governmental, court and law enforcement requests or requirements relating to your use of Cerner Direct or information provided to or gathered by Cerner with respect to such use. If any part of these Terms is determined to be invalid or unenforceable then the invalid or unenforceable provision shall be superseded by a valid, enforceable provision that most closely matches the intent of the original provision and the remainder of these Terms shall continue in effect. Unless specified otherwise as you use Cerner Direct, these Terms constitute the entire agreement between you and Cerner with respect to Cerner Direct and these Terms supersede all prior or contemporaneous communications and proposals, whether electronic, oral, or written, between you and Cerner with respect to Cerner Direct.

Modification of Terms Cerner may change these Terms at any time without advance notice to you. You are responsible for regularly reviewing these Terms. Your continued use of Cerner Direct constitutes your acceptance of the revised terms.

Last Modified: March 9, 2016

COPYRIGHT © 2016 CERNER CORPORATION. ALL RIGHTS RESERVEDPRIVACY POLICY TERMS OF USE CONTACT US https://cernerdirect.com/inboxes/welcome-privacy https://cernerdirect.com/inboxes/welcome-contact-info https://cernerdirect.com/inboxes/welcome-terms https://cernerdirect.com/mail/privacypolicy.action http://www.cerner.com/public

Health Care Directory Policy

Organizations who sign up to use Cerner Direct (“Subscriber”) may contribute to and use the Health Care Directory (the “Directory”). The Directory is a consolidated listing of information about individuals who participate in one or more health care information exchange community(ies) (such as DirectTrust) (“Participant”). The purpose of the Directory is to better facilitate health care information exchange between providers. Subscribers must contribute Participant information to the Directory to have access to it.

How to Contribute to the Directory

A Subscriber may proactively choose to contribute its information into the Directory or Cerner may choose populate the Directory itself with information that is made available to it by the Subscriber.

Subscribers may contribute information by using the administrative capabilities Cerner has provided. If a Subscriber does not wish to have its information contributed to the Directory it can opt-out, at any time, by logging a service request to Cerner’s support organization requesting to not contribute to the Health Care Directory. Regardless of how information is contributed, Subscribers are responsible for managing all Directory contributions.

Directory Information

The following minimum Participant information will be made available within the Directory: Participant full name, Direct email address, National Provider Identifier (if applicable), business address, and the Subscriber name. Additional information, such as provider specialty, may be available within the Directory as elected by the Subscriber. The Subscriber is the authoritative source of all Participant information published in the Directory and is solely responsible for keeping the information accurate and complete. Participants must contact the Subscriber to make necessary updates to their information.

Cerner updates the Directory on a daily basis.

Directory Usage

Participants may use the information from the Directory solely for the purposes of supporting the exchange of health care information from within Cerner’s solutions (e.g. Cerner Millennium, Cerner Direct). Participants may search the Directory and save search results in a local address book, made available within Cerner’s solutions. Subscribers may choose to store local copies of information obtained from the Directory; in such an event the Subscriber is responsible for regularly synchronizing the local copies with updates made by Cerner to the Directory at a recommended interval of every 24- 48 hours.

If a Participant receives unwanted messages, the Participant must notify the sender of his/her desire to stop receiving the unwanted messages. Cerner does not control these messages.

Directory Restrictions

Subscriber and Participant agree not to:

Copy, or allow to be copied, the information contained in the Directory (other than as specifically allowed under the paragraph entitled “Directory Usage” above);

Sell the information contained in the Directory;

https://eservice.ucern.com/default.aspx

Disclose the information contained in the Directory outside of the Subscriber organization;

Use, or allow use of, the Directory for direct marketing, database marketing, telemarketing, marketing analysis, or research purposes;

Intentionally transmit or distribute inaccurate, false or misleading information;

Advertise or offer to sell, buy or make available any goods or services for any business purpose, unless Cerner specifically allows such messages in writing (provided however, that in no event may Subscriber or a Participant advertise, offer to sell, buy or make available any unlawful goods or services or any goods or services for an unlawful purpose);

Influence or attempt to influence, for commercial purposes (through economic incentives or otherwise) any diagnostic or treatment-related decisions of a healthcare provider;

Conduct or forward surveys (unrelated to your business), contests, pyramid schemes or chain letters;

Generate or facilitate unsolicited commercial email, spam or mass mailing; or

Violate any applicable laws or regulations.

DirectTrust Directory

One of the communities Cerner participates in is DirectTrust. As a member of that community, Cerner is required to uphold the expectations set forth in the DirectTrust Directory Data Sharing Policy (“DirectTrust Directory Policy”) available at https://www.directtrust.org/about-policies/. This Policy shall at all times be interpreted in accordance with the DirectTrust Directory Policy.

Termination of Directory or Directory Access

Cerner may, in its sole discretion, (i) terminate or suspend a Subscriber’s access to the Directory for violation of this policy, or (ii) terminate or suspect its provision of the Directory to all Subscribers and Participants. Cerner will take reasonable steps to notify you of any such termination or suspension.

Modification of Terms

Cerner may change these Terms at any time without advance notice to you. You are responsible for regularly reviewing these Terms. Your continued use of the Directory constitutes your acceptance of the revised terms.

Last Modified: March 9, 2016 https://www.directtrust.org/about-policies/

Page Version:

Page Identifier:

984711713

Page Title:

Cerner Direct HISP Overview

Page Effective Date:

Jul 7, 2015

© Cerner Corporation and affiliates. All rights reserved. Contains Cerner confidential and/or proprietary information belonging to Cerner Corporation and/or its related affiliates which may not be reproduced or transmitted in any form or by any means without the express written consent of Cerner. Use may be subject to the "DHMSM License and Distribution Restrictions" in the Terms of Use ( ). The Terms of Usehttp://www.cerner.com/Terms_Of_Use/ contain restrictions on use and distribution of this content, including use and distribution restrictions applicable to DHMSM and other government users.

1.

2.

3.

4.

5.

Cerner Direct HISP Overview

Introduction For uninterrupted Directed exchange to occur, it takes both technology and policy. The HISP (Health Information Service Provider) combines theCerner Direct technology of the standards with the policy and best practices defined by . By industry terms, it is a full-service HISP providing theDirect Project DirectTrust.org transport for Direct messages as well as Registration Authority and Certificate Authority services. Direct certificates are issued at the Organization level and follow the processes documented in our .Certificate Practices Statement

The HISP is the mechanism used to provision users with a Direct email address. The HISP provides the infrastructure necessary toCerner Direct Cerner Direct manage message encryption, the parties who can be communicated with, and the incorporation of appropriate policies and procedures necessary to ensure a level of confidence in provisioning members on the network appropriate to health care.

For more information, visit on uCern Connect.the uCern GroupCerner Direct

Cerner Direct Terminology CA (Certificate Authority) - An entity that issues digital certificates. The digital certificate certifies the ownership of a public key by the named subject of the certificate. This allows others (relying parties) to rely upon signatures or assertions made by the private key that corresponds to the public key that is certified. In this model of trust relationships, a CA is a trusted third party that is trusted by both the subject (owner) of the certificate and the party relying upon the certificate.

Cerner utilizes a third party agency that is DTAAP accredited and acts the CA for the HISP.Cerner Direct

CAMM (CareAware Multimedia) - Cerner's enterprise storage solution for PACS and Digital Objects

CDA ( Administrator) -Cerner Direct Each organization using the Web Inbox will have an CDA who is responsible for sending invitations toCerner Direct people within their organization(s) that are authorized to have a web mailbox. The CDA will have access to .Cerner Direct https://cernerdirect.com/administration Could also mean Clinical Document Architecture (an HL7 standard).

CDG (Cerner Document Generator) - The Clinical Document Generator is a service that generates an HL7 Continuity of Care Document (CCD) for a given patient or encounter.

CPS (Certification Practice Statement) - A public statement describing the practices that a Certification Authority employs for issuing, renewing, revoking and validating Digital Certificates and for supporting reliance on Certificates. A CPS expands on the Certificate Policies of a particular Certification Authority. In Cerner's case, our past and third party's current CPS is accessible through and complies with the DirectTrust.org Certificate Policy.http://www.cerner.com/cps

Digital Certificate (also known as a Certificate or Direct Certificate) - A digital representation of information which:

Identifies the Certification Authority issuing it Names or identifies its Subscriber Contains the Subscriber's Public Key Identifies its operational period Is digitally signed by the Certification Authority issuing it.

Cerner Direct HISP leverages a third party CA to issue X.509 digital certificates at the Organization level per the CPS. The Direct specification requires digital certificates for encrypting and decrypting Direct messages, signing Direct messages, and verifying trust of Direct messages.

DSN (Disposition Status Notification) - A DSN is commonly referred to as a bounce message. It is a email message that complies with .RFC 3464

DTAAP (Directed Trusted Agent Accreditation Program) - A national accreditation program for health information — trusted agent — service providers, including health information service providers (HISPs), certificate authorities (CAs) and registration authorities (RAs). The purpose of this program is to establish trust between Direct entities. Electronic Healthcare Network Accreditation Commission (EHNAC) partnered with DirectTrust.org and created DTAAP. The Cerner

HISP is DTAAP accredited as a HISP and utilizes a third party CA that is a DTAAP accredited RA and CA.Direct

HISP (Health Information Service Provider) - An entity that processes Direct-compliant messages to and from Direct addresses, each of which is bound to a Direct-compliant X.509 digital certificate. Acting in the capacity of an agent for the Subscriber, the HISP may hold and manage PKI private keys associated with a Direct digital certificate on behalf of the Subscriber. The HISP for all Direct-enabled Cerner solutions is .Cerner Direct

MDN (Message Disposition Notification) - An MDN is commonly referred to as a read receipt. It is an email message that complies with .RFC 3798

PKI (Public Key Infrastructure) - Set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates

RRD (Remote Report Distribution) - Millennium solution which automatically sends clinical reporting to predefined destinations; traditionally fax stations but now can use secure email via the HISP.Cerner Direct

S/MIME (Secure/Multipurpose Internet Mail Extensions) - Used to encrypt message content while in transit.

SMTP (Simple Mail Transfer Protocol) - The Internet standard for electronic mail (email) transmission used by Network Messaging.

1/2

Page Version:

Page Identifier:

984711713

Page Title:

Cerner Direct HISP Overview

Page Effective Date:

Jul 7, 2015

© Cerner Corporation and affiliates. All rights reserved. Contains Cerner confidential and/or proprietary information belonging to Cerner Corporation and/or its related affiliates which may not be reproduced or transmitted in any form or by any means without the express written consent of Cerner. Use may be subject to the "DHMSM License and Distribution Restrictions" in the Terms of Use ( ). The Terms of Usehttp://www.cerner.com/Terms_Of_Use/ contain restrictions on use and distribution of this content, including use and distribution restrictions applicable to DHMSM and other government users.

TPO (Treatment, Payment, and Health Care Operations) - Our Certificate Policy guarantees that the work of a trusted organization is involved with TPO.

X.509 - A widely used standard for defining digital certificates. Current version is X.509 version 3. See Digital Certificate.

Major Features Uses safe, HIPAA-compliant communication methods.

Based on latest available Direct Project standards for sending and receiving of encrypted messages for purposes for treat, payment, or health care operations with recipients using any trusted Direct Project compatible system.

Supports transport of a wide variety of content (for example, CCDs, images, plain text) between people and system-level endpoints or both.

Includes familiar email standards, such as read receipts, bounce messages, and multiple recipient addressing (for example, To, CC).

Services Provisioning Service

Cloud-based Web service to allow authorized service clients to register Direct addresses for their authorized Direct email domains. (For more information, see .)Troubleshoot Provisioning Service for Cerner Direct HISP

Outbound Messages Service

Cloud-based Web service to allow authorized service clients to send messages that are compliant with and the .RFC5322 Direct Project Applicability Statement (For more information, see .)Troubleshoot Outbound Messages for Cerner Direct HISP

Inbound Message Routing

The HISP will push inbound messages to a web service hosted within the Direct email domain owner's system.Cerner Direct

This page includes links to external resources. These resources are provided for reference purposes and should be used with caution. Contact your Cerner support team for more information about third-party content.

2/2

Updated April 12, 2017

CERTIFICATE SERVICES AGREEMENT

By accepting a Purchase Schedule that incorporates this Certificate Services Agreement, together with any referenced exhibits, appendices, attachments, terms and schedules, (collectively the “Agreement”), the entity or person accepting the Agreement (“Customer”) is entering into a legally valid and enforceable agreement with DigiCert, Inc., a Utah corporation (“DigiCert”).

DigiCert is a trusted third-party certification authority and experienced provider of ITU X.509 v.3 digital certificates (“Certificates”). DigiCert operates a web-based interface and related API that facilitates and simplifies management of Certificates. Customer desires to use a DigiCert system account and API (collectively, “Account”) to obtain and manage Certificates containing subject information (e.g., domain names) which Customer is authorized to use.

1. Certificates.

1.1. Account Access. Subject to Customer’s compliance with the terms and conditions of this Agreement, DigiCert hereby grants Customer a license to use the Account, through either the API or DigiCert's provided web interface, to order and approve Certificates for use by Customer, an affiliate of Customer, or a third party who is providing IT services to Customer's operations. This Agreement applies to each Certificate issued to Customer, regardless of (i) the Certificate type (client, code signing, or TLS/SSL), (ii) when the Customer requested the Certificate, or (iii) when the Certificate issues. This Agreement constitutes the subscriber agreement, as required under industry standards, for all Certificates issued through the Account. Customer must maintain security over access to the Account. Customer is liable for any use of the Account by individuals obtaining access credentials from Customer. Customer will not scan a DigiCert IP address without obtaining DigiCert’s prior written consent. DigiCert reserves the right to block an IP address that DigiCert believes has been used to initiate a scan without such consent. DigiCert may throttle any access to the Account if DigiCert believes a system has initiated excessive connections to DigiCert’s services.

1.2. Account Users. Customer authorizes each individual listed as an administrator in the Account to act as a

Certificate Requester, Certificate Approver, and Contract Signer (as defined in the EV Guidelines) and to communicate with DigiCert regarding the management of Certificates and key sets. “EV Guidelines” means the Extended Validation Guidelines published by the CA/Browser Forum and made publicly available at www.cabforum.org . Customer may revoke this authority by sending notice to DigiCert. Customer is responsible for periodically reviewing and reconfirming which individuals have authority to request and approve Certificates. If Customer wishes to remove an account user, then Customer will take the steps necessary to prevent the user's access to the Account, including changing its password and other authentication mechanisms. Customer must notify DigiCert immediately if any unauthorized use of the Account is detected.

1.3. Certificates. Customer will order and use Certificates in accordance with the Certificate Terms of Use which are available at https://www.digicert.com/certificate-terms.htm, which terms are hereby incorporated by reference.

1.4. Accurate Information. Customer will notify DigiCert within 5 Business Days if any information relating to the

Account changes. “Business Day” means Monday through Friday, excluding U.S. Federal Holidays, which are set forth in 5 U.S.C. § 6103. Customer will respond to any inquiries from DigiCert regarding the validity of information provided by Customer within 5 Business Days after Customer receives notice of the inquiry.

2. Fees.

2.1. Fees. Customer will pay DigiCert the fees posted in Customer’s Account or set forth in the Purchase Schedule for Certificates. Prices of Certificates available for purchase on a per-Certificate basis are subject to change;

updates to pricing will be posted in Customer’s Account prior to purchase. All payments are due and payable either within 30 days of the date of purchase or such other period, if any, stated in the Purchase Schedule. This fee is for the services provided by DigiCert and is not a royalty or license fee. DigiCert may suspend or limit Customer's access to the Account without notice if Customer fails to pay the fees when due.

http://www.cabforum.org/ https://www.digicert.com/certificate-terms.htm

2.2. Purchase Schedule. “Purchase Schedule” means the ordering document, invoice, purchase order or other order form accepted by Customer to purchase Certificates. The Purchase Schedule references the number, type, validity period, term, and pricing of Certificates, and number of domains.

2.3. Taxes. This Agreement is entered into, and all of the services are performed and provided, entirely within the United States of America. All fees for services are exclusive of any taxes however imposed, e.g. sales tax, income tax, GST, or VAT. Customer is solely responsible for calculating and paying all tax obligations resulting from Customer's acceptance of this Agreement, including sales tax, income tax, GST, or VAT but excluding all taxes based on DigiCert's income. Customer may not withhold or offset any amount owed to DigiCert for any reason. If a withholding or deduction is required by law, then Customer will pay an additional amount that is equal to the amount withheld or deducted, causing DigiCert to receive a net amount from Customer that is equal to the amount DigiCert would receive if a withholding or deduction was not required.

3. Intellectual Property Rights.

3.1. DigiCert Intellectual Property Rights. DigiCert retains, and Customer will not obtain or claim, any title, interest, or ownership rights in the Certificates, API, and Account, including all software associated with the Account and API and any techniques and ideas embedded therein, all copies or derivative works of the Certificates or software provided by DigiCert, regardless of who produced, requested, or suggested the copy or derivative work, all documentation and marketing material provided by DigiCert to Customer, and all of DigiCert's copyrights, patent rights, trade secret rights and other proprietary rights.

3.2. Restrictions. Each party will protect the other party’s intellectual property, good will, and reputation when accessing or using the other party’s services or products. DigiCert may terminate this Agreement or restrict access to the Account if DigiCert reasonably believes that Customer is using the Account or Certificates to post or make accessible any material that infringes DigiCert’s or any third party’s rights. Customer will not use any marketing material or documentation that refers to DigiCert or its products or services without receiving written prior approval from DigiCert, except as outlined in section 3.3.

3.3. Trademark Usage. Either party may use the trademarks of the other to indicate that Customer is receiving DigiCert’s services provided that such use would not foreseeably diminish or damage the other party’s rights in the trademark, create a misrepresentation of the parties’ relationship, or diminish or damage a party’s reputation, including using a Certificate with a website that could be considered associated with crime, defamation, or copyright infringement. Neither party may register or claim any right in the other party’s trademarks.

4. Confidentiality.

4.1. Definition. “Confidential Information” means any information, documentation, system, or process disclosed by a party or a party's affiliate that is (i) designated as confidential (or a similar designation) at the time of disclosure, (ii) disclosed in circumstances of confidence, or (iii) understood by the parties, exercising reasonable business judgment, to be confidential. Confidential Information does not include information that

(a) was lawfully known or received by the receiving party prior to disclosure, (b) is or becomes part of the public domain other than as a result of a breach of this Agreement, (c) was disclosed to the receiving party by a third party, provided such third party, or any other party from whom such third party receives such information, is not in breach of any confidentiality obligation in respect to such information, or (d) is independently developed by the receiving party as evidenced by independent written materials.

4.2. Obligations. Each party will keep confidential all Confidential Information it receives from the other party or its affiliates. Each party will use disclosed Confidential Information only for the purpose of exercising its rights and fulfilling its obligations under this Agreement and will protect all Confidential Information against disclosure using a reasonable degree of care. Each party may disclose Confidential Information to its contractors if the contractor is contractually obligated to confidentially provisions that are at least as protective as those contained herein. If a receiving party is compelled by law to disclose Confidential Information of the disclosing party, the receiving party will use reasonable efforts to (i) seek confidential treatment for the Confidential Information, and (ii) send sufficient prior notice to the other party to allow the other party to seek protective or other court orders.

4.3. Publication of Certificate. Customer consents to (i) DigiCert's public disclosure of information embedded in an issued Certificate and (ii) DigiCert's transfer of Customer's information to servers located inside the United States. This consent survives termination of this Agreement. DigiCert may rely on and use information provided by Customer for any purposes connected to the services, only if such use is in compliance with the DigiCert's Privacy Policy available at https://www.digicert.com/digicert-privacy-policy.htm and complies with the confidentiality obligations in Section 4.2.

5. Termination.

5.1. Term. This Agreement is effective upon Customer's acceptance and will remain in effect unless earlier terminated in accordance with this Agreement.

5.2. Termination for Convenience. Customer may terminate this Agreement for any reason upon 7 days’ written notice if Customer has paid all fees due.

5.3. Other Termination. Either party may terminate this Agreement immediately if the other party (i) materially breaches this Agreement and fails to remedy the material breach within 7 days after receiving notice of the material breach, (ii) engages in illegal or fraudulent activity or an activity that could materially harm the terminating party's business, (iii) has a receiver, trustee, or liquidator appointed over substantially all of its assets, (iv) has an involuntary bankruptcy proceeding filed against it that is not dismissed within 30 days of filing, or (v) files a voluntary petition of bankruptcy or reorganization.

5.4. Events Upon Termination. If this Agreement is terminated under Section 5.3, DigiCert may revoke the Certificates issued under this Agreement. In the case of termination under any other circumstance, provided that Customer remits full payment for the Certificate prior to this Agreement’s termination date, (i) any Certificate issued prior to termination will remain valid until the earlier of the expiration of the Certificate's validity period or the Certificate is revoked as permitted under the Certificate Terms of Use, and (ii) Customer may access and use the Account solely to manage existing Certificates. Upon termination: (a) Customer may continue to use unrevoked Certificates in accordance with the Certificate Terms of Use, (b) except as otherwise specified, all other rights and licenses granted herein terminate, (c) each party will immediately discontinue all representations or statements that could imply that a relationship exists between DigiCert and Customer, (d) each party will continue to comply with the confidentiality requirements in this Agreement, and (e) Customer will, within 30 days of termination, pay to DigiCert any fees, or part thereof, still owed as of the date of termination and destroy or deliver to DigiCert all sales manuals, price lists, literature and other materials relating to DigiCert.

5.5. Survival. The Certificate Terms of Use survive termination of this Agreement until all Certificates issued expire or are revoked. In addition, the obligations and representations of the parties under Section 3.1, Section 3.2, Section 4 (Confidentiality), Section 5 (Termination), Section 6 (Disclaimers of Warranties, Limitation of Liability, and Indemnification), and Section 7 (Miscellaneous) survive termination of this Agreement. All amounts owed by Customer for services and products issued prior to termination remain owed after termination of this Agreement.

6. Disclaimer of Warranties, Limitation of Liability, and Indemnification.

6.1. Warranty Disclaimers. THE ACCOUNT, CERTIFICATES, AND ANY RELATED SOFTWARE ARE PROVIDED "AS IS" AND "AS AVAILABLE." TO THE MAXIMUM EXTENT PERMITTED BY LAW, DIGICERT DISCLAIMS ALL EXPRESS AND IMPLIED WARRANTIES, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. DIGICERT DOES NOT WARRANT THAT ANY SERVICE OR PRODUCT WILL MEET CUSTOMER'S EXPECTATIONS OR THAT ACCESS TO THE ACCOUNT WILL BE TIMELY OR ERROR-FREE. DigiCert does not guarantee the availability of any products or services and may modify or discontinue any product or service offering at any time.

6.2. Limitation of Liability. This Agreement does not limit a party’s liability for (i) death or personal injury resulting from the negligence of a party or (ii) fraud or fraudulent statements made by a party. TO THE FULL

EXTENT PERMITTED BY APPLICABLE LAW AND NOTWITHSTANDING ANY FAILURE OF ESSENTIAL

PURPOSE OF ANY LIMITED REMEDY OR LIMITATION OF LIABILITY: (A) DIGICERT AND ITS AFFILIATES, SUBSIDIARIES, OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, PARTNERS AND LICENSORS (THE “DIGICERT https://www.digicert.com/digicert-privacy-policy.htm

ENTITIES”) WILL NOT BE LIABLE FOR ANY SPECIAL, INDIRECT, INCIDENTAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES (INCLUDING ANY DAMAGES ARISING FROM LOSS OF USE, LOSS OF DATA, LOST PROFITS, BUSINESS INTERRUPTION, OR COSTS OF PROCURING SUBSTITUTE SOFTWARE OR SERVICES) ARISING OUT OF OR RELATING TO THIS AGREEMENT OR THE SUBJECT MATTER HEREOF; AND (B)

DIGICERT ENTITIES' TOTAL CUMULATIVE LIABILITY ARISING OUT OF OR RELATING TO THIS

AGREEMENT OR THE SUBJECT MATTER HEREOF WILL NOT EXCEED THE AMOUNTS PAID BY CUSTOMER TO DIGICERT IN THE TWELVE (12) MONTHS PRIOR TO THE EVENT GIVING RISE TO SUCH LIABILITY, IN EACH OF THE FOREGOING CASES (A) AND (B), REGARDLESS OF WHETHER SUCH LIABILITY ARISES FROM CONTRACT, INDEMNIFICATION, WARRANTY, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY OR OTHERWISE, AND REGARDLESS OF WHETHER DIGICERT HAS BEEN ADVISED OF THE POSSIBILITY OF

SUCH LOSS OR DAMAGE.

6.3. Indemnity. Customer will indemnify, defend and hold harmless DigiCert and DigiCert’s employees, officers, directors, shareholders, affiliates, and assigns against all third party claims and all related liabilities, damages, and costs, including reasonable attorneys’ fees, arising from (i) Customer’s breach of this Agreement, (ii) Customer’s failure to protect the authentication mechanisms used to secure the Account,

(iii) an allegation that personal injury or property damage caused by the fault or negligence of Customer, (iv) Customer’s failure to disclose a material fact related to the use or issuance of the Account or Certificate, or

(v) an allegation that the Customer, or an agent of Customer, used DigiCert’s products or services to…