NASH certificate renewal is done online by an Organisation Maintenance Officer (OMO): log in to PRODA, open HPOS, go to your organisation's Certificates tab and request a new NASH PKI site certificate. A PIC arrives by text, you download the certificate, then import it into your clinical or dispensing software. Certificates last two years, and Key IT tracks the expiry dates for its healthcare clients.
What does a NASH certificate do, and what stops when it lapses?
NASH stands for National Authentication Service for Health, and its certificate is the credential your practice software presents to prove it really is your organisation. Services Australia's Apply for NASH page lists what it unlocks: My Health Record, the Healthcare Identifiers (HI) Service, sharing health information through software that meets secure messaging or electronic prescribing requirements, and the NASH directory.
When it lapses, the features that rely on it stop working, and which ones depends on your software:
- Pharmacies on Fred Dispense Plus: Fred IT's NASH certificate help page says the certificate is required for the Health Identifier Service (ePrescriptions), My Script List and My Health Record.
- GP clinics on Best Practice: Bp Premier uses it for My Health Record and the HI Service, and a separate step passes the renewed certificate to eRx Script Exchange for e-prescribing.
- Dental practices: if your software connects to any of the services above, it relies on a current certificate. Your vendor can confirm which features use it.
How long does a NASH certificate last, and how do you check the expiry date?
Two years. Services Australia's Manage NASH PKI page says certificates expire two years from the date of issue, and you can see the expiry date on the HI Service certificate tab in HPOS. The OMO receives a renewal notice in HPOS mail 30 days before expiry, and your software vendor may also warn you.
Thirty days is a short runway when the notice lands in a mailbox nobody checks, or with an OMO who resigned last year. Some practice software shows the date too; the install table below shows where.
Who in the practice can renew a NASH certificate?
Only an Organisation Maintenance Officer. Services Australia says only OMOs can request and link NASH PKI certificates. Before you start, your organisation must be registered in the HI Service, you must be linked as an OMO, and your own PRODA account must be linked to your individual healthcare identifier record in HPOS.
Here is how the HI Service roles and outside helpers usually split the job:
| Who | Usually | Part in a NASH renewal |
|---|---|---|
| Responsible Officer (RO) | The chief executive officer | Answers for the organisation's dealings with the HI Service. A change of RO is lodged through HPOS. |
| Organisation Maintenance Officer (OMO) | The practice manager | Gets the 30-day notice, requests and downloads the certificate, and can add more OMOs. |
| Software vendor | Best Practice, MedicalDirector, Fred IT and others | Documents the import. Services Australia says to contact your vendor if the certificate hasn't installed correctly. |
| IT provider | In-house IT or a managed IT provider | Often holds the Windows administrator access some imports need, and can keep track of expiry dates. Key IT tracks these dates for its healthcare clients. |
One person can hold several roles; a sole trader can be the provider, the RO and the OMO. The weak point is a single OMO. Services Australia's guide to updating HI Service details says you can have as many OMOs as you need: an existing OMO adds one under My organisation details, OMO, Manage maintenance officers, and the newcomer links their OMO identifier to their own PRODA account. With two, one resignation can't strand the renewal.
How do you renew a NASH certificate in PRODA and HPOS?
Services Australia publishes these steps for requesting or renewing a certificate:
Log in to your individual PRODA account and select Go to service on the HPOS tile.
If prompted, choose No Organisation – Proceed as an individual only.
Select My programs, then Healthcare Identifiers and My Health Record.
Select Healthcare Identifiers - Manage existing records, then your organisation's record.
Select My organisation details, then the Certificates tab.
Select Request a NASH PKI site certificate or Renew, enter a mobile number and tick the two acknowledgement boxes.
Select Save Changes, then Submit.
When the certificate is ready, your Personal Identification Code (PIC) arrives by text. Download the certificate from the Certificates tab; the link stays available for 30 days from issue.
Fred IT's NASH renewal quick guide for pharmacy also shows a drop-down where you pick your software product version from a list of SHA-2 ready versions, so note which version you run before you log in.
Guard the certificate file and PIC closely: together they let software identify itself as your organisation to My Health Record and the HI Service. Keep them out of shared inboxes. If the certificate is lost or may be compromised, Services Australia lets you request revocation from the same Certificates tab, then request a replacement in HPOS.
How do you install the renewed certificate in your practice software?
A downloaded certificate does nothing until it is imported into the software that uses it, and Services Australia points you to your software developer for installation help. Three common products document it like this:
| Software | Check the current expiry | Import the new certificate | Watch for |
|---|---|---|---|
| Best Practice (Bp Premier) | Windows Internet Options, Content, Certificates: look for "general" plus your HPI-O; the latest expiry date is the current one | Setup, Configuration, Import Certificates; choose NASH and the Default location, then enter the PIC | Import on the server as a Windows administrator, then run the Update eRx Certificates utility on the database server for e-prescribing |
| MedicalDirector Clinical | The Certificates tab in HPOS | Tools, Options, Practice tab; edit the practice, choose Import Certificate and the My Health Record type, then enter the password | Save the certificate file somewhere easy to find before you start |
| Fred Dispense Plus | Setup, NASH Certificate: read the end validity date | Setup, NASH Certificate, Import Certificate; select the file and enter the PIC | Then enable the HI Service under Health Identifier Service Configuration, run Test HI Service and save |
Sources: Best Practice's renewal article and eRx update guide, and MedicalDirector's Clinical knowledge centre. Dental software varies, so ask your vendor where its import screen lives before the date arrives. For its dental and pharmacy clients, Key IT already raises software faults with vendors such as Centaur and Fred IT.
What else in PRODA and HPOS can expire?
Your B2B device. If your practice software connects to a service through a PRODA business-to-business (B2B) device, Services Australia's B2B device guide says it must be reactivated at least every six months. If it expires, your software won't work with that service until someone generates a new activation code. Expiry emails go to your organisation's listed address, and a PRODA member with the Device-Management attribute can extend the device beforehand.
How do you stop a NASH renewal catching the practice out?
Record every expiry date, including per-location certificates and B2B devices, with reminders at 90 and 60 days rather than relying on the 30-day notice.
Keep two OMOs linked, each with a working PRODA login, and recheck after staff changes.
Make sure someone reads HPOS mail, where the renewal notice lands.
Book the import with whoever holds administrator access to the server, at a quiet time, then test My Health Record, HI Service lookups and e-prescribing straight afterwards.
Clean up: store the certificate and PIC securely and delete stray copies from desktops and download folders, as part of wider cybersecurity for healthcare.
Watch other quiet admin changes, such as patient texts showing as 'Unverified' because the sender name isn't on the SMS Sender ID Register.
Key IT tracks the NASH, PRODA and HPOS expiry dates for each of its healthcare clients, so a renewal is planned rather than discovered mid-session. Everyday requests go to Key IT's helpdesk, open 8am to 5pm on weekdays, while an engineer from the rotating on-call roster handles anything urgent for managed clients after hours. See IT support for dental practices, pharmacy IT support and healthcare and medical IT. Quiet certificate expiries aren't unique to health: the Secure Boot certificate expiry affects Windows PCs too.
Frequently asked questions
How often does a NASH certificate need renewing?
Every two years. Services Australia says NASH PKI certificates expire two years from the date of issue, and the Organisation Maintenance Officer gets a renewal notice in HPOS mail 30 days beforehand. Check the date on the Certificates tab in HPOS and set your own reminders well ahead of that notice.
Can our IT provider renew the NASH certificate for us?
Generally not the request itself. Services Australia says only Organisation Maintenance Officers can request and link NASH PKI certificates, and the OMO is usually the practice manager. An IT provider can still track the expiry date, remind the OMO early, handle the import and chase the software vendor if it fails. Key IT tracks NASH, PRODA and HPOS expiry dates for its healthcare clients.
Our NASH certificate has already expired. What do we do?
Request a new one through the same HPOS steps on the Certificates tab. When the PIC arrives by text, download the certificate and import it into your software; Best Practice users then re-run the Update eRx Certificates utility. Until it is installed, services that depend on it may not work, so agree a manual workaround with clinical and dispensary staff.
Our practice manager was the only OMO and has left. What now?
Act before the next renewal notice goes to an empty mailbox. If another OMO is still linked, they can add a new one in HPOS under My organisation details. If nobody is, contact Services Australia's Healthcare Identifiers Service team on 1300 361 457, Monday to Friday, 8:30am to 5pm AEST, about your officer records. Then link at least two OMOs.
Do dental practices need a NASH certificate?
Yes, if the practice software connects to My Health Record, the Healthcare Identifiers Service, secure messaging or electronic prescribing, which are the services Services Australia says the certificate unlocks. Ask your dental software vendor which features use it and where the import screen is. Key IT looks after dental practices and tracks certificate expiry dates for its healthcare clients.
Is a NASH certificate the same as a PRODA B2B device?
No. A NASH certificate is your organisation's two-year credential for digital health services such as My Health Record, requested by an OMO in HPOS. A PRODA B2B device gives your organisation's software authorised access to a service through PRODA and must be reactivated at least every six months. They expire on different cycles, so Key IT suggests tracking both on one calendar.
Wondering how your own business measures up? A free IT & Cyber Security Review shows where you stand and what to fix first — no jargon, no obligation.
Book a Free Review