We have detected that you are using Internet Explorer to visit this website. Internet Explorer is now being phased out by Microsoft. As a result, NHS Digital no longer supports any version of Internet Explorer for our web-based products, as it involves considerable extra effort and expense, which cannot be justified from public funds. Some features on this site will not work. You should use a modern browser such as Edge, Chrome, Firefox, or Safari. If you have difficulty installing or accessing a different browser, contact your IT support team.
About the process
This process applies, until further notice via revised guidance, to all registrants, where a face to face meeting is not possible.
During the coronavirus (COVID-19) pandemic, it replaces the standard registration process and involves a method of establishing the registrant’s identity through the remote provision of:
- identity document
- an image file suitable for use as a passport-compliant photograph
- confirmation that the image is a true likeness of the registrant
This process is to be used by Service Provider Registration Authority (RA) Agents acting on behalf of Registering Organisations whenever they need to register a new member of staff.
It allows for user access to be rescinded and/or users de-registered in a managed way when normal conditions return.
Registration Authority (RA) Service Providers will:
- distribute this guidance to the relevant staff in all organisations for which they have registration responsibilities
- agree with their Registering Organisations the appropriate video conference channel(s) for video calls (VCs) taking into account availability, security and cost - possible channels include Microsoft Teams, Slack, Zoom, Webex, Jabber and FaceTime
- agree with their Registering Organisations appropriate locations that they will allow when registering for their organisations - locations need to be sufficiently private, for example registrants' homes
- ensure that their Registration Authority staff are aware of these procedures and the specific arrangements with the organisations for which they have registration responsibilities
Remote registration process - stage 1 (before the video call)
The Registration Authority (RA) Agent for the Registration Authority (RA) Service Provider receives a request for smartcard registration via existing channels and processes. It is essential that the registrant provides their email address, preferably an NHS or other secure email address if available. Otherwise judgement is to be exercised by the Registration Authority (RA).
In response to the registration request, the Registration Authority (RA) Agent asks the registrant to provide the following items by email, again, by NHSmail or other secure email if available:
- organisation for first registration (if not already specified in the request)
- full name
- date of birth
- national insurance number
- scan of one photographic identity document(s) - needs to be a valid passport or driving licence
- image file suitable for use as a passport-compliant photograph
- mobile phone number (required later to text the smartcard passcode)
In the email, the Registration Authority (RA) Agent gives the registrant their mobile number to confirm the receipt of the smartcard and receive its passcode once posted.
In the unlikely event that the registrant does not have any photographic identity documents the Registration Authority (RA) Agent will decide which document(s) from the NHS Employers options (for users with no photographic ID) should be asked for.
Once the required documents have been received, the Registration Authority Agent contacts the Registrant to arrange the video meeting and explain the process.
Remote registration process - stage 2 (the video call)
The Registration Authority (RA) Agent:
- text messages a set of randomly generated numbers each time to the registrant who is asked to read it out - this binds the telephone number to the individual on the video call and establishes the number to text the smartcard passcode to (see below)
- asks the registrant to show their scanned photographic identity document for the Registration Authority (RA) Agent to check against the live image of the registrant
Assuming that the video call image of the registrant matches the image on the scanned identity document, the video call process is complete, and the Registration Authority (RA) Agent can terminate the video call and continue the registration process.
Remote registration process - stage 3 (after the video call)
The Registration Authority (RA) Agent creates/completes the registrant’s identity in the Care Identity Service (CIS).
In order to flag the entry as a COVID-19 record the Registration Authority (RA) Agent enters the following data:
- choose UK passport as the photographic evidence – enter 000000000 in the passport number field and the date 1 April 2025 in the expiry date field
- go to non-photo ID and select ‘TAC1’ and ‘TAC2’ (Temporary Access Card) as the two sources of non-photo ID (used for creation of temporary access cards in other situations) and enter 1 March 2020 as date of issue
The Registration Authority Agent:
- prints the smartcard for the registrant, unlocked with a randomly generated 6-digit passcode obtained from a service such as https://www.random.org/integer-sets/, and records the passcode securely.
- arranges for delivery of the smartcard to the registrant.
- texts the smartcard’s 6-digit passcode to the registrant (using the registrant’s previously recorded mobile number), when they call to say that the smartcard has been received.
- assigns access to the registrant using the normal process.
What to do if an existing user locks their card or the certificates expires
Without face to face contact the only option is to print a new unlocked card as per process above and send to the user – and cancel the locked or expired card.
What happens when you need to rapidly move pharmacy staff to other pharmacies
It has been agreed that wider use of the Role Based Access Control (RBAC) 'National Locum Pharmacy Agency' code and position (FFFFF) can be used, but it is important that RAs keep a log of users given this access for exceptional reasons so that it can be revoked as appropriate at some point in the future.