We have detected that you are using Internet Explorer to visit this website. Internet Explorer is now being phased out by Microsoft. As a result, NHS Digital no longer supports any version of Internet Explorer for our web-based products, as it involves considerable extra effort and expense, which cannot be justified from public funds. Some features on this site will not work. You should use a modern browser such as Edge, Chrome, Firefox, or Safari. If you have difficulty installing or accessing a different browser, contact your IT support team.
Blog
Citizen Identity – the evolution of username password security
How do we give the public secure access to their healthcare data and NHS services? Lead Delivery Manager Richard McStay talks about NHS login and the NHS Digital Citizen Identity team’s work to ensure people can prove their identity when signing up for online services.
- Author:
- Date:
-
9 September 2019
Fingerprints, biometrics, retinal scanning, voice recognition and facial mapping – likeness, liveness, authentication and verification. Gaining access to your personal stuff, whether it be your cash, shopping app of choice or healthcare data is a tricky business, often requiring an airport-style, digital security gate to get to what we think as 'ours' in the first place.
Unfortunately, this very necessary evil is likely to continue, and it is the responsibility of those given the task of implementing it to make it as simple and pain-free as possible, while still being completely and rock-solidly secure.
The security aspect of providing a mechanism by which people can verify their identity is a real challenge. Unauthorised access to most other aspects of your personal life such as your social media profile is highly inconvenient, sure, but relatively recoverable and retrievable. Medical information is significantly more personal to us and therefore the security needs to reflect this by being absolutely watertight. It is essential that only the right person has access.
The key for healthcare is the digital link that matches me to my healthcare record and gives applications the confidence that the connections they make to healthcare data stores and services are definitely for the user that has signed up for them. It’s a GP appointment for me, it’s my repeat medication, it’s my healthcare record, it my referral and those are my results from that scan.
Solving the puzzle
NHS Digital’s Citizen Identity team has been working on solving this particular puzzle for some time - a watertight solution to be used by healthcare apps to allow users to verify their healthcare identity and then use those details to securely log-in not only to that service, but any healthcare service that is integrated. The concept is very similar to login with Google or Facebook but requires the user to prove their identity more securely because of the often-sensitive nature of the data or service they wish to access.
The identity marketplace has this capability already, and this is something we tested and researched with the public, but the message was clear: “I trust the NHS and if I have to do this to access a healthcare app, I want an NHS solution”. So, we set out to produce an NHS branded identity solution that included the ‘must-haves’ of likeness and liveness. We also needed to incorporate the existing Patient Online capability to avoid users having to identify themselves twice if they’ve already gone through the process at their GP practice.
Proving identity with NHS login
From this clear user directive, NHS login was created and is now used for a number of different healthcare apps, including the NHS App, with a significant queue forming to use this technology across the NHS.
Users can verify themselves with their existing details they used to sign up to Patient Online or go through a short ‘prove your identity’ journey involving a photo of an identity document and a ‘video selfie’ that checks you’re a real, live, human, in addition to some basic name and address details. The video is a key component as it replicates citizens presenting themselves for identification when we require non-digital access or entry to services like passport control or GP appointments and can be used to ensure app users are not being coerced or trying to access services with fraudulent documentation. We cross-check your information and send you an email – all very straight-forward as the majority of the public has easy access to the right details and documents.
Longer term, 'sign-in with your NHS login' has the potential to become the ID verification and authentication product integrated across a wide number of health and social care platforms.
Richard McStay,
Lead Delivery Manager,
NHS Digital
Proving someone’s identity is harder than that though, especially as people don’t always want to go through the process of verifying it. In the same way nobody really wants to complete a passport application or go through airport security, they just want to get straight to the holiday, they want to swiftly access a new app that they’ve seen or that’s been recommended to them.
Despite the challenges some will experience with the above process, the benefit of NHS login is that you only have to do it (successfully) once. The variety and diversity of healthcare apps currently developed or being developed is kickstarting the process of putting the control of healthcare information into the hands of patients.
There’s still work to for us to do and while the version that’s being used now for healthcare tools like the NHS App is simple, safe and secure, the learning we’ve gained will continue to shape our solution in this space.
Using the combinations of user, partner and analytics feedback, we’re constantly evolving our product. In the short term, we need to be able to offer a solution for those unable to use digital identity methods, but still receive the benefits of digital healthcare tools, such as an offline-to-online capability and/or clinical validation. Longer term, “sign-in with your NHS login” has the potential to become the ID verification and authentication product integrated across a wide number of health and social care platforms.
Providing this secure capability for patients to safely use health and care applications supports a growing need for using technology led, innovative ways to access our health data and the services the NHS provides.
Contact us
Want to provide secure NHS login verification and authentication in your application? Go to NHS login for suppliers and developers for more information
Related subjects
-
NHS login provides patients with a simple, secure and re-usable way to access multiple digital health and care services.
Share this page
Latest blogs
Hackers and cyber attacks feature in many films and television programmes, but are these portrayals accurate? Hecham Mrabet, cyber security specialist at NHS Digital, gives us a behind-the-scenes look at how a cyber security centre runs in real life.
The NHS digital service manual team has published new forms guidance that will help digital health teams design better forms and transactional services.
Cyber security still has an out-dated image of being a masculine profession. Charlotte Roe, Cyber Security Apprentice at NHS Digital, talks about her job and why women are needed in the world of cyber.
Last edited: 20 December 2019 2:57 pm