Getting patients started with NHS login

This guide supports health and care staff as they help patients access health and social care services with NHS login. Watch our instructional video or read our step by step guidance.

NHS login and Microtest

NHS login works differently in services that connect to the GP medical record, for patients at practices that use the Microtest clinical system. View specific guidance for Microtest practices.

1. Choose a website or app

Patients can create an NHS login from any health and care website or app that shows the NHS login button.

2. Set up an NHS login

When they click the button, the patient will be asked to:

give their email address
choose a password
accept the NHS login terms and conditions

They will then receive an email containing a link. They must click this link to confirm their email address. They will then see a page telling them they now have an NHS login.

The patient will need to return to the website or app they want to access and enter their NHS login email address and password. They will now be asked to give their mobile phone number. A six-digit security code will be sent by text message to their mobile phone. They will be prompted to enter this code and press continue.

The patient now has verified ownership of an email address and mobile phone number. This means they have an NHS login with the lowest level of identity verification. This will allow the patient to do simple tasks like book a COVID-19 test.

3. Prove who they are

The patient must then verify their identity to a medium level or a high level. The level of verification will depend on the website or app the patient wants to use and the type of information they want to access.

Medium level verification

The patient will be asked to enter their NHS number, date of birth and the postcode of their home address as registered with their GP practice. If they do not know their NHS number, they can enter their name instead. This information is then checked to correspond to an NHS record on the Personal Demographics Service (PDS).

Medium level verification will allow patients to do things like contact their GP or receive notifications. It does not provide access to health records or personal information.

High level verification

The patient must prove who they are in order to gain access to health records or personal information. To do this, the patient has 4 options.

The patient will be asked to submit a photo of their I.D. and then take an automated scan of their face. Instructions will be given on how to do this using the camera on their device. The scan will then be used to match the patient’s face with their photo I.D.

The accepted types of photo I.D. are:

passport
UK driving licence, either full or provisional
a full European driving licence
European national identity card

During the scan the screen will flash and change colour. If flashing lights or colours make the patient feel unwell, they can record a video instead.

The patient will be asked to submit a photo of their I.D. and record a short video of their face.

The accepted types of photo I.D. are:

passport
UK driving licence, either full or provisional
a full European driving licence
European national identity card

Before they record their video, the patient will be shown 4 randomly generated numbers. They will be asked to tell us what the 4 numbers are.

To do this the patient can:

say the numbers
sign the numbers using British Sign Language
write the numbers down and show them

Once submitted, the patient’s identity will be carefully checked by our I.D. checking team and should be verified within two hours. The patient will be emailed to let them know if the I.D. check has been successful.

When a patient signs up to use their GP practice’s online services, they will be given three registration details.

The registration details are:

a Linkage Key (which could be called a Passphrase)
an ODS Code (which could be called an Organisation Code or Practice I.D.)
an Account I.D.

If the patient uses this information to prove who they are, it is automatically checked with the GP practice’s system, along with the patient’s name and date of birth. During this process, the patient’s NHS number and health information is matched to their NHS login.

To use this option, the patient should select ‘How to prove who you are without sending a photo of your I.D.’ at the bottom of the page that tells the patient how to prove who they are.

The patient can choose to transfer a previous I.D. check for GP online services to NHS login if they use the mobile number on their NHS record. This means they do not need to have their I.D. re-checked and the process is much quicker.

If the patient has not already been verified to medium level, they will also be asked to enter their date of birth and NHS number. If they do not know their NHS number, they can enter their name and the postcode of their home address as registered with their GP practice.

4. Log in and use the website or app

Once they have completed these steps, the patient will be able to use their NHS login to access their chosen websites and apps, wherever they see the NHS login button.

The patient can continue using their email address, password and the security code sent to their mobile phone for authentication. They can also choose to be 'remembered' on their device, the first time they log into a website or app after setting up their NHS login. This means they can log in using their username and password, without the need to enter a security code.

Some websites and apps will allow users to authenticate with biometric data, using fingerprint or facial recognition.

GP practice information

If you work at a GP practice, patients may need your help with NHS login. See GP practice NHS login guidance for step-by-step guidance on how to provide GP Online registration details to patients, in your clinical system.

Last edited: 11 May 2021 9:03 am