Connecticut Ave NW, Washington, DC :00 pm ET, June 15, (626) # 1

Connecticut Ave NW, Washington, DC Agenda  Reasons we are considering the DTAAP-PHR Privacy and Security Beta  What is DTAAP and how do DirectTrust and EHNAC work together?  Process of accreditation and audit  Involvement and commitment required of Beta program participants.  Costs for participation in a Beta program 2

Connecticut Ave NW, Washington, DC Reasons for the DTAAP-PHR Beta The Direct Trusted Agent Accreditation Program (DTAAP) – Patient Health Record (PHR) Beta is being developed for PHR vendors who provide services enabling healthcare patients to implement secure communications in support of “Meaningful Use” requirements of the Office of National Coordinator (“ONC”) in a low cost and simple manner using the specifications and protocols of the Direct Project. Direct Trusted Agent Accreditation Program (DTAAP) Third party accreditation is critical as Trusted Entities are responsible for: 1.Handling health information in a manner that is consistent with privacy and security laws, and in particular HIPAA. The Beta accreditation will provide the establishment of: 1.Criteria, standards and framework that has been developed by the Industry that creates a core set of requirements for meeting or exceeding HIPAA privacy and security rules. 2.Trust between the various stakeholders for secure exchange of messages 3.A trust standard for providers and patients to use to meet Meaningful Use Stage 2/3 compliance and achieve any additional incentives that are available to them. 3

Connecticut Ave NW, Washington, DC Summary of Accreditation Process 1.Application Process: 1. Complete the electronic pre-application on the EHNAC website.pre-application a. A clarification letter is ed to the organization with the detailed instructions on the application process. b. Complete an electronic application for the program applied for. c. Upload with the application, the signed Beta Agreement, Applicant Agreement, Sentinel Events document, and revenue verification in PDF format or fax to (860) (860) d. Mail payment of applicable application fees [Annual fee, Multiple Program & site visit fee(s)] to EHNAC. 2.Upon completion of the Application Process and approval, the EHNAC Self-Assessment zip file will be made available to the organization, the Site Reviewer will be assigned and they will be added to the EHNAC website Accreditation Status page as a Candidate.Accreditation Status 3.Submit complete Self-Assessment via EHNAC by the due date as outlined in the DTAAP-PHR Beta Agreement. 4.If the Self-Assessment contains sufficient satisfactory information and documentation to support the candidate’s application, a site visit(s) will be scheduled to verify the information contained in the Self-Assessment. If the assigned site reviewer has questions or do not feel it is complete, it may request the Self-Assessment be resubmitted before a date is set for the site visit(s). 5.Site visits are completed and the Site Reviewer completes the Site Visit Report. 6.Mail payment of the site visit expense fee to EHNAC. 7.Applicant organization approves Site Visit Report. 8.The Commission reviews and votes on the Site Visit Report. 9.The organization will be informed whether the accreditation has been approved or denied. 10.Upon approval of accreditation the organization’s status is changed to Accredited on the EHNAC website Accreditation Status page.Accreditation Status 4

Connecticut Ave NW, Washington, DC EHNAC Accreditation Process Pre-application Ensures qualification based on type of business Application Collects additional information and annual fees Self-Assessment Demonstrates evidence of compliance with criteria Site Review Tests Self- Assessment claims via on-site review Award Awards level of accreditation achieved (Full, Provisional, Interim, Failed) 5 Timeline for Non-beta Candidate is approved and has 1 year to complete. Maximum 8 mos. to submit the self-assessment allowing up to 4 mos. for site review(s), final report and approval process

Connecticut Ave NW, Washington, DC Involvement and commitment required of Beta program participants Terms Applicant receives a one time, first year 25% discount off the Annual Fee only if not already accredited. Applicant agrees to (i) provide EHNAC with its comments, criticisms, suggestions, and evaluations with respect to the Accreditation Program; and (ii) comply with (a) the Beta Agreement, (b) the EHNAC Applicant Agreement for the Accreditation Program (“Applicant Agreement”); and the (c) the Sentinel Events Document. 6

Connecticut Ave NW, Washington, DC Involvement and commitment required of Beta program participants Terms Applicant agrees to notify EHNAC of (i) all problems encountered with the Accreditation Program; and (ii) ideas for improvements to the Accreditation Program, which come to Applicant's attention until accreditation is achieved. Applicant agrees to provide written feedback on the criteria at a minimum of every 30 days and participate in scheduled conference calls. 7

Connecticut Ave NW, Washington, DC Involvement and commitment required of Beta program participants Terms The Accreditation Program contains valuable, confidential, trade secret information owned or licensed by EHNAC. Applicant hereby assigns to EHNAC all right, title and interest to improvements and all intellectual property rights therein, including without limitation all patent, copyright, trade secret, trademark or moral right. The Applicant, upon completion of the Beta Self-assessment, agrees to provide material, statistics or information that is not deemed confidential to Applicant’s business for use in press releases, customer testimonials, and as a reference in marketing and sales initiatives by EHNAC. Applicant will provide a quote to EHNAC that may be used in a press release. 8

Connecticut Ave NW, Washington, DC Fees Note – Federal, state non-profit organizations are included in the Small Size above. A Site Visit Fee is charged for each site visited by an EHNAC site reviewer. Sites that must be visited include [for more information visit the Site Visit page on the website]:Site Visit page 1. The corporate site (in all cases) 2. All other sites, including outsourcers, that provide production services (includes data centers, customer support sites, etc.) * 3. Any sites where Protected Health Information (PHI) is created, received, maintained, or transmitted, where Personally Identifiable Information (PII) is handled, and where cryptographic keys are handled. The site visit fee is based on a per day fee. The Multiple Program fee is applicable if you are seeking accreditation for multiple EHNAC accreditation programs. 9 SizeRevenue AmountAnnual Fee Multiple Program Fee DTAAP, PMS & EPCS SV Fee/Site/Day Very SmallUnder $3M$2,750$1,375$5,500 Small & Outsourced Program Greater Than $3 Less Than $8M$3,500$1,750$5,500 Medium Greater Than $8 Less Than $20M$7,000$3.500$8,500 Med/Large Greater Than $20 Less Than $50M$11,000$5,500$8,500 Large Greater Than $50M Less Than $75M$16,500$8,250$8,500 Very LargeGreater Than $75M$22,000$11,000$8,500

Connecticut Ave NW, Washington, DC Questions David C. Kibbe MD MBA President and CEO DirectTrust.org Debra Hopkinson EHNAC Vice President, Operations