Important information about Internet Explorer and the NHS e-Referral Service (e-RS)

Earlier guidance provided on this page had included the use of Microsoft Edge in IE Mode as an alternative, but not recommended, option for organisations moving away from the use of Internet Explorer.

We now understand that due to essential e-RS security updates in October 2022, users cannot access e-RS in Edge IE Mode.

As a result, we no longer include the use of Microsoft Edge in IE Mode as an alternative option for accessing e-RS.

As a result of Internet Explorer no longer being supported, users of the NHS e-Referral Service (e-RS) cannot access the service using Internet Explorer or Microsoft Edge in IE Mode. 

Patients using the Manage your Referral Service, to book or manage their appointments will not be impacted by this issue. 

The NHS Credential Management application (CMA) is a stand-alone, desktop application that works alongside all versions of the NHS Identity Agent for smartcard authentications and enables users to move to a modern web browser and remove the reliance on Java applets. 

Java applets are an out-of-date technology with potential security flaws which limit NHS Spine applications to using the Internet Explorer browser. 

Full details of how to access the Credential Management Application can be found in the Additional Information section below. 

If your organisation uses Internet Explorer to access e-RS, you will need to move users to Microsoft Edge or Google Chrome.  The use of Microsoft Edge or Google Chrome will also require you to take some further steps to ensure successful authentication.  The options to enable this are described below. 

Option 1

For Referring organisations and Providing organisations (Recommended) 

1. Ensure the Credential Management Application (CMA) is deployed across the user base.  
2. Ensure that all users’ computers have access to Microsoft Edge or Google Chrome.  
3. Advise your users to start using e-RS via Microsoft Edge or Google Chrome. No change is required to the e-RS URL via HSCN. 

Option 2

For Providers and non-GP Practice Referring organisations within the NHS Secure Boundary only 

Organisations wishing to route their e-RS traffic over the Internet can move away from IE11 by deploying CMA (this will still need an HSCN connection for the smartcard authentication and assumes the organisation is behind the NHS Secure Boundary) and providing users with a new URL to access the service (https://ers.nhs.uk).  Please see the notes below on Session Management before progressing this option. 

1. Ensure CMA is deployed across the user base.  
2. Ensure that all users’ computers have access to Microsoft Edge or Chrome.  
3. You can advise your users to start using e-RS via Edge or Chrome using the new URL https://ers.nhs.uk

NHS Credential Management Application (CMA) is a stand-alone, desktop application that works alongside all versions of the NHS Identity Agent for smartcard authentications. 

Download the latest version of the NHS Credential Management installation file (N3/HSCN connection required to access this link). 

Supporting guides for installation and configuration are also available from this link. 

As detailed in the installation guides, this can be deployed as a silent install over a large estate, making deployment quick and simple. 

In order to test that your installation and configuration of the NHS Credential Management application is correct, we recommend you use the NHS CIS2 Smartcard Checker Tool . 

Further information on the Credential Management Application can be found on the  NHS Digital Identity and Access Management webpages. 

The e-RS team have made changes to session timeouts to bring them in line with the latest security standards.

IT teams should be aware that using the internet-facing URL (https://ers.nhs.uk) will introduce a session idle timeout period of 15 minutes. 

The current HSCN URL applies a 30-minute session idle timeout period.. 

If you are interested in using e-RS over the internet (not HSCN) then please contact your GP system supplier for more information. It is particularly important that you discuss the implications of Seamless login before progressing.

If the recommended actions provided above are not suitable for your users or organisation, an additional method of authentication is available.

You can use Google Chrome or Microsoft Edge with plug-ins now, however we must advise that we believe that this is a more time-consuming approach for IT teams to set up and is not supported on a case-by-case basis by NHS Digital.

Further information can be found at https://nww.digital.nhs.uk/dir/downloads/chrome-extension.

If you’re having issues with either of the authentication options mentioned, please review the guidance on 'Troubleshoot incorrect configurations'. 

Your local IT Support team should be your first point of contact for support, however if you do need further help from the NHS Digital e-RS team, please email: [email protected]