Skip to main content


Find out what you must provide, complete and comply with before your service can go live.

What you need to do
  • Attend the Preparation and Product Demonstration Calls
  • Start integration
  • Complete and submit the Integration Environment Request form
  • Complete the Supplier Conformance Assessment List (SCAL)
  • Complete the Connection Agreement
  • Complete and submit the Organisation Discovery Form
  • Raise a Request for Change (RFC) - IM1 suppliers only

Attend the Preparation Call

The Preparation call will be held with your dedicated project manager to prepare you for the integration process and the Product Demonstration call. Your project manager will cover:

  1. Checklist information
  2. Your project milestone dates
  3. The integration process
  4. Show your user journeys either as a live demo or a video
  5. Agenda for the Product Demonstration Call

At the end of the call, your project manager and you will agree if you are ready for the Product Demonstration Call.

If you are not ready, your project manager will document the outstanding actions. You may need a second preparation call.

Attend the Product Demonstration Call

The second call (Product Demonstration) will be chaired by your project manager. We will also invite our subject matter experts.

The agenda is:

  1. Welcome and Introductions​
  2. Onboarding Process Timeline​
  3. Over to you for a description of your product, live demo/video of your working prototype and a walk through of your technical architecture and data flow diagrams
  4. Security Requirements​
  5. Environments, Scopes, Vector of Trust Values, Profiles​
  6. Additional Features Supported​
  7. Change Management​
  8. Commercial Requirements​
  9. Other Sources of Information​
  10. Next Steps

The NHS login subject matter experts (SMEs) on the call are from technical architecture, data security and information governance and legal including commercial.

To enable a successful outcome you should ensure that the equivalent roles from your integration project attend the call too. Attendees can include your product commissioner or sponsor in development.

The call is intended as a collaborative discussion and is not a pass/fail exam.

By the end of the call the expectation is that we will have agreed:

  1. Your product Vector of Trust
  2. Your product Scopes and Claims
  3. Your Connection Agreement including the need for us to draft any special terms and your signatory
  4. An estimated go live date

Microsoft Teams

To enable communication and document sharing, we use Microsoft Teams. We will set up a dedicated private channel and we will host shared documents here. We will also send you messages and answer your questions. 

Please ensure that you have the notifications function turned on so you know when a message or task has been posted in this Teams channel. 

Let us know colleagues to add to the channel.


Start integration

Following your Product Demonstration Call, you will start the integration process. This process includes:

1. Technical Integration of your Product
2. Assurance of your Product

We would like you to start the integration process by agreeing a go live date to work towards. We recognise that with agile development, dates may have to change. 

We know that partners on average take 4 months from the Product Demonstration Calls to go live - and you can use this nominal date as a guide. You can of course suggest a date earlier than this!

You must ensure you can commit to your proposed go live date, as missing any milestones will directly impact this date. You cannot go live on a Bank Holiday in England.

Technical Integration of your product

Developers can find the technical information in the NHS login developer documentation website.

When you are ready to integrate your product you will need to register an account in the integration test environment. You must provide evidence in your SCAL from this environment - not the sandpit environment.

Complete and submit an Integration Environment Request Form.

We will send you a test data pack and your access credentials.  Access to the integration test environment can only be provided after your Product Demonstration Call.

We have provided testing scenarios. You will also need to complete the tests described in your SCAL.

When you have completed testing in the integration test environment, you need to get your technical conformance report. Complete and submit the NHS login Technical Conformance Report form. We will send you the report via email. You need to add this to your SCAL.

Important notice

You should not be performing NFT (non-functional testing) or penetration testing in the integration environment.

Assurance of your product

Complete the Supplier Conformance Assessment List (SCAL)

We will ask you to complete a Supplier Conformance Assessment List (SCAL), which will confirm that you have completed the necessary integration requirements for NHS login. It will also confirm you are adhering to the required standards for information governance, security and clinical safety.

Within your SCAL you must show that you can evidence several areas.

These include:

  • an appointed clinical safety officer
  • completed and published an in-year DSPT at a minimum level of standards met.
  • completed and, where applicable, remediated a pen test
  • an NHS login compliant privacy notice


You will also be asked to provide a high-level architecture diagram showing the key components of your product. The diagram should include:

  • Where your users start 
    For example: NHS App, web portal, mobile app
  • How to sign up and how to log in
    For example: NHS login, Facebook, Google, Apple/Android
  • Access points for different cohorts
    For example: the public, healthcare staff, support and helpdesk staff, developers
  • External dependencies
    For example: any external services or APIs such as SMS, IM1, PDS FHIR, Salesforce, other payment solutions
  • Hosting status and location, including whether the service is hosted on the Cloud or on-premise data centre and the location of where it is hosted
    For example: if using the Cloud, AWS EU-West2 (London), or for the data centre, UK or elsewhere

Please note: NHS login partners that have more than one Client ID will need to provide an architecture diagram for each one.


See an example SCAL. You should not complete this, you will be sent a bespoke version for you to complete when we have agreed your technical and commercial position at the Product Demonstration Call.

Complete the connection agreement

The connection agreement is a legal contract between NHS England and suppliers. It details the terms and conditions of connecting your product or service with NHS England and what your responsibilities are. It also contains a pre-populated set of appendices which define the GDPR relationship the connecting party has with NHS England and its end users.

A connection agreement must be signed and received back at NHS England before your product can go live.

We will agree who signs the connection agreement. For example it might be you as the owner of the product or your commissioner (the organisation or person that has arranged and has paid to use your product)  if they are to own their instance of your product after it goes live with NHS login.

You must inform us if there are any changes that may affect your connection agreement - such as a company name change or takeover.

Read more in the Forms and documents library.

You will be sent a bespoke version for you to complete when we have agreed your technical and commercial position at the Product Demonstration Call.

Complete and submit the Organisation Discovery Form

NHS login is supported by the NHS England Service Bridge. You must complete and submit an Organisation Discovery Form to use this service for NHS login. If you are already registered with the Service Bridge, you will still need to complete an Organisation Discovery Form.

Find out about NHS login's service, problem and incident management processes on the partner service management page. This includes information on our service level agreement and Higher Severity Service Incident (HSSI) management.

IM1 live suppliers

If you are an IM1 live supplier you will need to raise a Request for Change (RFC) via the IM1 team to notify your connected GP IT Suppliers that you are connecting to NHS login.

To raise an RFC,  contact your delivery lead in the IM1 team at [email protected]


What happens next

When you have completed the documents, we will start a formal review cycle that will normally take 3 weeks. During this time we may ask you questions. At the end of the review cycle we will start the process to enable your product to go live.

Last edited: 2 February 2024 11:52 am