Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

EPS: How to embed a signature within a prescription

Learn how to embed a signature when creating a prescription within the NHS Electronic Prescription Service.

Page contents

You should read the Electronic Prescription Service - FHIR API page and the Supplier Conformance Assessment List (SCAL) before you read this page.

Overview

This page explains how you can embed a signature when creating a prescription. It is intended to integrate with the EPS FHIR API and signing library.

Step one: Send complete prescription payload apart from provenance to prepare endpoint

This returns the: 

  • base64 encoded signed info block (containing the digest) 
  • timestamp embedded in the digest 
  • algorithm that should be used to generate the signature 

Step two: Sign the base64 encoded signed info block

Use either the local signing library or the remote signing service. This should give a signature value and a certificate.

Step three: Create signature block

You need to embed the: 

  • decoded signed info block with the xmlns attribute removed
  • signature value with no preceding whitespace
  • certificate with no preceding whitespace

This should be structured as follows:

<Signature xmlns="http://www.w3.org/2000/09/xmldsig#"> 
  {signed_info_block} 
  <SignatureValue>{signature_value}</SignatureValue> 
  <KeyInfo> 
    <X509Data> 
      <X509Certificate>{certificate}</X509Certificate> 
    </X509Data> 
  </KeyInfo> 
</SignedInfo>

Then base64 encode that and embed it in the FHIR Provenance resource signature.data value as defined in the OAS ‘Create a new prescription’ section.

Contact us

If you would like more information, contact [email protected] for onboarding and assurance enquiries or [email protected] for live service management.

Last edited: 2 April 2025 2:19 pm