Identity verification for digital health services in primary care (NHS login) (WHC/2025/011)
A letter signposting guidance on how to verify identity for NHS login, and the new vouching service.
This file may not be fully accessible.
In this page
Details
Status:
Information.
Category:
Information governance / information technology.
Title:
Introduction of The NHS Wales Digital Health Identity Standard for Primary Care (NHS Login).
Date of review:
September 2025.
Action by:
General practitioners.
For information:
- NHS local health boards.
- NHS trusts.
- NHS special health authorities.
- Welsh NHS Partnership Forum.
- General Practitioners Committee (Wales) General Practitioner Council, Wales.
- Royal College of GPs.
Required by:
With immediate effect.
Sender:
Alex Slade, Director,
Primary Care,
Mental Health and Early Years,
Welsh Government.
Welsh Government contacts:
Justin Davies,
Senior Data Policy Manager,
Health and Social Services Group,
Welsh Government,
Cathays Park,
Cardiff.
CF10 3NQ.
Email: justin.davies@gov.wales
Introduction of the NHS Wales digital health identity standard for primary care (NHS login)
Background
Dear colleagues,
General practitioners are advised to note the issue of this Welsh health circular and 'the NHS Wales digital health identity standard for primary care (NHS login)'.
The standard applies only to identity verification for the purpose of accessing NHS login in general practice.
The standard
The NHS Wales digital health identity standard for primary care (NHS login) sets out a consistent approach to identity management in GP practice. It describes why a person should prove their identity to access digital health services.
The standard also sets out how the identity verification process, identity authentication and authorisation should be performed in a GP practice settings.
Elements considered by this standard include:
- identity verification, including vouching
- identity authentication
- clinical authorisation
- typical example transactions
The standard applies only to identity verification for the purpose of accessing NHS login in general practice.
Background
Welsh Government, in collaboration with partners, has developed digital services that will put people in charge of their own health. These digital services contain personal information, and it is essential that only the correct person has access.
One such service is the NHS Wales app, which allows people to manage aspects of their own care. In order to access the NHS Wales app, people must first prove their identity using NHS login.
NHS login, a national citizen identity platform from NHS England, enables people to prove their identity once, and they can then use their NHS login to access the NHS Wales app.
A fundamental requirement of NHS login is an agreed approach to identity management, conformant with identify assurance principles. This standard sets out this agreed approach.
Scope
This standard only applies to GP practices in Wales.
It is applicable only to NHS providers in general medical service that deliver identity services for individuals accessing online digital healthcare services in Wales.
This document does not cover:
- the technical solutions or the user experiences required to implement this standard
- unique identifiers such as NHS number
- re-verification or re-authentication, although this may be revisited in later versions
- authenticated access solutions, although this may be added in later versions; this Welsh health circular will be updated as this position changes
- cyber security, threat detection, or other related disciplines
Yours sincerely
Alex Slade, Director
Primary Care, Mental Health and Early Years