NHS England » Registering patients for online services

Online services play an important part in providing a convenient and responsive primary care service to patients and their carers and support a person-centred approach to care.

They are particularly useful in the management of long-term conditions, allowing patients to become more actively involved in their care, for example reviewing care plans, making informed decisions, and preparing for consultations either with their GP or another care provider.

GP practices are encouraged to actively promote these services to benefit from efficiency savings in administration processes and provide an efficient and effective service for their patients, thereby increasing patient satisfaction. There is more detailed guidance on promoting online services in a separate article in this series.

Online services should be offered in addition to traditional telephone and face to face contacts to allow patients to choose the route which suits them best.

Practices must ensure that the services provided online are safe, secure, and meet the reasonable needs of their patients.

Services available online

From November 2022, practices gradually began switching on full prospective record access for patients who had already signed up for online services and had not previously been coded by the practice as needing an enhanced review before being given access. Full prospective record access is in addition to transactional services (appointment booking and cancellation and repeat prescription ordering).

Access to the historic medical record can also be made by request, and there are plans for the NHS App to facilitate this in the future.

Patients in practices that are not currently part of this accelerating access programme can still request access in person as there are contractual provisions to provide access to the coded record, and prospective access to the full record. This is subject to the practice’s ability to redact third party or sensitive information, and also subject to there not being any adverse impact on its provision of essential services.

Patients can request historic access to the full medical record by submitting a request in writing to their GP practice.

Subject access requests (SARs)

Providing a patient with online access to their medical record meets the requirement of a subject access request, as agreed by the Information Commissioners’ Office (ICO) providing any redaction is limited to that required by the act. This applies to subject access requests received from the patient or their legal representative. Any information not digitised and available electronically will still need to be provided another way. There is a full article on subject access requests in this series.

Proxy access

Online services can allow proxy access to a patient record by a third party who may or may not be registered with the GP practice. Access is usually for transactional services only as authorised by the patient. This could be limited to one, or more online service. Users signed up for proxy access will not automatically be given full prospective records access, but this can be provided with the patient’s consent.

Proxies are provided with their own login credentials including a separate password.

There are dedicated articles in this guide providing more information on proxy access and online access to the records of children and young people

Identity verification

Before registering anyone for online services, you will need to be sure they are who they say they are, and that they have a legitimate right of access.

The easiest way for patients to register for online services is by using their NHS login as they will already have proved their identity to obtain this. To get an NHS login, patients will need:

a mobile phone
an email address
photographic ID, in the form of a driving licence, passport or national identity card

Patients are asked to scan a photo of their ID and either scan their face or record a short video of their face while saying four numbers, so they need to be comfortable using a camera and email.

The NHS login allows individuals to register with more than one provider of NHS services and gives access to other NHS digital services such as ordering medication through the NHS website or searching for pharmacies offering repeat prescription services.

Proving identity in person

Patients can prove their identity by providing the necessary evidence in person at their surgery. This is covered in detail in the article on ID verification in this series, which also discusses how to register patients who may not have the necessary forms of identity, for example travellers and homeless people.

Registration checks

As well as confirming the identity of the person requesting access, practices will want to make a series of checks before registering someone for online services, for example:

Patient responsibilities | Has the patient been given the information about their responsibilities and completed a registration form (if used) accordingly? Practices can use this part of the process to ask questions to make sure the patient understands their responsibilities (as set out below). If there are any concerns, someone from the practice should discuss these with the patient.
Coercion | Consider the risk of coercion and the capacity and competence of the patient making the application. If there is any suspicion a patient may be pressured into revealing information from their online record against their will, this should be discussed directly with the patient before either providing or declining access.
Sensitive and third-party information | Before historic access to the patient’s full medical record or detailed coded record is provided, the practice must fully review the record to ensure it does not contain any third-party information or information which could be considered sensitive. This topic is covered in detail in another article in this series on redaction.

Reviewing a record for sensitive or third-party information may create a delay in providing access to the patient which should be fully explained including an indication of the anticipated delay. The patient should be notified once the record becomes available. If access to the online record cannot be provided for any reason, this should also be discussed directly with the patient.

Once all the necessary checks have been completed, the patient can be registered for access to the online clinical system and given their login credentials (unique username and password). These are usually generated in printed form in the clinical system.

Login credentials can also be used to create an NHS login if patients are not able to do this in the way described above.

Access via the NHS App

General practice online services can also be accessed via the NHS App using an NHS login.

Promoting online access

To encourage uptake of online access, some practices have chosen to include information in their new patient packs or to automatically ask all newly registered patients if they would like to sign up when joining the practice. It is also a good idea to provide patient information and the registration form on practice websites.

Patients can be directed to more information about using online services on the NHS.UK website.

Safe and responsible use of online access

Wherever possible, practices should ensure patients are given, and understand, the following guidance before completing their registration:

login credentials should be protected to prevent others gaining access
passwords should be memorable and not based on something that is easily guessed
if login credentials are lost or the patient suspects someone else is aware of them, they should immediately change their password and inform their practice
computers, laptops, tablets, or phones used to access online services should be locked and accessed by a password, PIN, fingerprint, or face recognition system
when using online services they should make sure no-one else can see personal information
always logout of the online system once they have finished after use.
Keep devices used to access online services fully up to date whit security patches
unless absolutely necessary, do not download or print information from the record – if this is unavoidable, ensure the downloaded or printed information is deleted or securely destroyed as soon as possible
if using audio tools (for example, to assist visually impaired patients) take all necessary steps to avoid being overheard
if patients have any concerns about someone not respecting their privacy or misusing their online access, they should report this to the practice immediately. Access can then be removed until the matter is resolved.

NHS England publishes a series of guides for patients about accessing online services, including one that summarises the above list in an easy to read format.

Benefits

Patients registering and using online GP services can bring a wide range of benefits.

For patients and carers there are benefits in terms of convenience, ease of access, and improved safety and quality of care.

For practices, the benefits are similarly around quality and safety of care but also in terms of administrative processes and staff time.

You can find a fuller discussion of benefits in the article in this series on promoting online services.

Risks

Whilst there are many benefits to patients and to practices of online access to records and services, there are some risks the practice should be alert to and plan for, for example:

coercion to share online access and private information
access to information that may be harmful to the patient (sensitive information)
access provided to the wrong person
patients not keeping their information secure
patients contesting the information in their record
patients being unhappy because they can’t access the records of others, e.g. teenage children, or those for whom they provide care
risk of excluding those patients who do not have access to a smartphone, tablet, or laptop (see the article on digital inclusion in this series)
patients being approached multiple times to engage in online services when they have previously declined – practices will need to ensure that this information is clearly recorded in the patient record

Practices can mitigate these risks by providing a patient information leaflet clearly explaining:

online services
access to nominated staff at their practice to discuss any concerns
continuing to offer more traditional ways to access care
good communication using practice websites, social media, reception information boards, etc.
what to do if the patient sees something they disagree with or that does not relate to them

Summary

Increasing the number of patients who use online services can significantly improve access to care, patient satisfaction, provide a more efficient way to deliver healthcare to patients (and carers) as well as bringing savings to general practice.

Top tips for promoting online services

You can find a comprehensive list of ideas and suggestions to promote online services in that article in this series, based on the practical knowledge and experience of general practice staff. Tips include:

provide online or paper instruction booklets including actual screen shots to help those patients who find online registration and the system difficult to understand
consider creating an information board in the reception area for information about online services, including registration forms/packs
encourage practice staff to encourage sign up when patients contact the practice by other means, highlighting the benefits of online services to patients
publicise how easy registration to online services can be, using SMS messages, a dedicated message on paper prescriptions and telephone answer messages
appoint a patient online champion or super-user within the practice (e.g., a patient participant group member, member of staff or volunteer) to encourage and help patients to register for online services when visiting the practice, especially during busier clinics, for example flu or baby vaccination clinics
include patient information leaflets and online registration forms in new patient registration packs and invite patients to complete the registration for online services during their first visit

Steps in online registration

The table below summarises the steps in registering a patient for online services.

Other helpful resources

UK, using the NHS login
UK, using the NHS App
UK, using online services
NHS Digital, guidance for practice on getting patients started with the NHS login
NHS England, GP online services promotional toolkit

Cookies on the NHS England website