NHS CIS2 Authentication

NHS CIS2 Authentication is a secure authentication service used by health and care professionals in England to access national clinical information systems.

It opens up new authentication options as alternatives to smartcards, including iPads, security keys, Windows Hello and Microsoft Authenticator.

CIS2 Authentication follows industry best practices and adheres to OIDC and NIST standards for authentication. Most applications utilising CIS2 Authentication will require the health and care professional to authenticate with one of the CIS2 Authenticators listed below.

We believe that patient data should be protected. With the transition to CIS2 Authentication, clinical information systems are required to expand their protections by upgrading their processes for logging users in and out.

For most CIS2 Authentication applications, removing your smartcard from the reader will no longer log you out. Your session will end safely when either:

• the application using CIS2 Authentication detects that you have been inactive
• you terminate the session using the logout option in your application

CIS2 Authentication provides a simple and secure authentication framework for accessing applications.

Health and care professionals benefit from:

• simple and secure login options, where you can authenticate with just your face or fingerprint
• a variety of convenient authenticator options that do not require certificate renewals and are not easily lost or misplaced
• the same login across multiple applications, with no need to remember passwords

Suppliers operating in health and care benefit from:

• the ability to provide high levels of authentication security in line with NHS England’s multi-factor authentication policy
• a standards-based framework that allows health and care organisations to make the most of industry best practice
• simplified code changes to support authentication changes across NHS England systems
• solutions that no longer rely on HSCN
• a Platinum service - supported 24 hours a day, 7 days a week

Over 40 applications and 730,000 users are benefitting from using NHS CIS2 Authentication. Find out which websites and apps currently use NHS CIS2 Authentication.

You can also see our performance data.

Most NHS organisations have a Registration Authority, among whose tasks is registering and deregistering NHS CIS2 authenticators. Find out more about how Registration Authorities manage non-smartcard authenticators in Care Identity Management.

You can get support by going to the NHS Digital Customer Portal or emailing [email protected].

To read about recent new features and what's coming up, go to our release hub.

There are lots of features we are working on and considering for the future and we'd love to hear what you think. To vote on these features, comment or suggest new ideas, email us at [email protected] with 'CIS2 New' as the subject line.