Sharing a user's NHS login information with your service

This page explains how users consent to share their NHS login information with your service and what to do if they do not.

How it works

We ask users to agree to share their NHS login information with your service when:

  • they register a new level of verification
  • they sign into your service using their NHS login for the first time
  • your service has an update to the user information required

Before users access your service, they will see the following screens asking if they agree to share their information.

Open this simplified consent and no-consent flow in a new window
NHS login consent screen with a tick route to the partner service and a cross route through the no-consent confirmation screen to the partner service without an authorisation code

If they agree, NHS login redirects them to your service with an authorisation code. Your service exchanges this for an ID token.

If they do not agree, NHS login redirects them to your service without an authorisation code. NHS login does not issue an ID token.

What to do when users do not share their NHS login information

Users who do not agree may be redirected to your service without their NHS login information.

Choose the option below that applies to your service.

Information:

The user has authenticated with NHS login, but their NHS login information has not been passed to your service.

If your service is accessed through the NHS App or Wayfinder

If your service is opened in NHS App or Wayfinder, you need to display an error message. Which one depends on whether your service is accessed through a browser or the mobile application.

For any queries about how NHS App works with your service, email app.integration@nhs.net.

Using a browser

You must use the content and emergency contact links shown below. Say “the service provider”, not the name of your service. Do not add other content to the screen.

Example screen

Open this example in a new window

Required back-button behaviour

Users should close your service tab to return to NHS App. Do not add your own back button.

If a user selects the browser Back button, reload the no-consent error screen where possible. If you cannot reload it, NHS login prevents the user from re-entering your service and shows its own error page. You do not need to take any further action.

Styling requirements

  • Heading font size should be no smaller than 20px.
  • Body copy should be no smaller than 16px.
  • Make all emergency contact links operational.

HTML

Copy code 
<h1>You cannot continue without sharing your information</h1>
<p>The service provider needs your NHS login information to match you to your record.</p>
<p>If you need medical help, go to <a href="https://111.nhs.uk/">111.nhs.uk</a> or call <a href="tel:111">111</a>.</p>
<p>Call <a href="tel:999">999</a> if it is a life-threatening emergency.</p>
<p>Close this tab to go back to NHS App.</p>
Using the NHS App mobile application

You must use the content and emergency contact links shown below. Say “the service provider”, not the name of your service. Do not add other content to the screen.

Example screen

Open this example in a new window

Native back-navigation behaviour

A user can return to the previous point in their journey in NHS App using the native back link.

Styling requirements

  • Heading font size should be no smaller than 20px.
  • Body copy should be no smaller than 16px.
  • Make all emergency contact links operational.

HTML

Copy code 
<h1>You cannot continue without sharing your information</h1>
<p>The service provider needs your NHS login information to match you to your record.</p>
<p>If you need medical help, go to <a href="https://111.nhs.uk/">111.nhs.uk</a> or call <a href="tel:111">111</a> or your GP.</p>
<p>Call <a href="tel:999">999</a> if it is a life-threatening emergency.</p>

If you offer a guest process

A guest process allows users to access your service without sharing any NHS login information.

If you offer a guest process, you do not need to show an error screen. Instead, make sure the user can see a guest option on your landing screen once they arrive from NHS login.

Example of a guest option

Open this example in a new window

If you provide an alternative authentication method

If your service offers another authentication method, users need a way to either use that method or go back to NHS login and agree to share their information.

Guidance for an alternative authentication screen

The screen must:

  • allow the user to go back to NHS login and opt to share their information
  • provide a link or button to your alternative authentication method

Example screen

Open this example in a new window

Styling requirements

You can use your service font, headers, footers and styling on this screen.

HTML

Copy code 
<h1>Choose how you want to continue</h1>
<p>You chose not to share your NHS login information with [Service name].</p>
<p>To continue, you can go back and agree to share your information or sign in to [Service name].</p>
<p><a href="[NHS login return URL]">Go back and agree to share your information</a></p>
<p><a href="[Service authentication URL]">Sign in to [Service name]</a></p>

Use the standard no-consent error screen if your service is not covered by the NHS App or Wayfinder guidance and has neither a guest process nor an alternative authentication method.

Guidance for a standard no-consent error screen

The example below uses MyHealth App to show how the screen can look. In the HTML, replace [Service name] with the name of your service. Only add content in [dynamic content] if it helps the user move on or correct an error.

Example screen

Open this example in a new window

Styling requirements

You can use your service font, headers, footers and styling on this screen, but it must follow our styling guidelines.

To minimise clinical risk, make sure all anchor tags to emergency services are operational and implemented as suggested.

HTML

Copy code 
<h1>You cannot continue without sharing your information</h1>
<p>[Service name] needs your NHS login information to match you to your record.</p>
<p>[dynamic content]</p>
<p>If you need medical help, go to <a href="https://111.nhs.uk/">111.nhs.uk</a> or call <a href="tel:111">111</a>.</p>
<p>Call <a href="tel:999">999</a> if it is a life-threatening emergency.</p>

If you are unsure which version applies to your service, get support with your NHS login integration.

Edit this page on GitHub