The preferred route for patients to access GP online service is to sign-up via an app which uses NHS Login. Click here for a list of current options which work with your clinical system. This means you will not need to verify the identity of the patient in the practice.

Not all patients will, however, have the necessary ID to use this option. For these patients you can remotely verify the identity of a patient without needing to bring ID documents into your practice, this guidance explains how.

This guidance is designed to help GP practices to:

  • minimise footfall into practice
  • encourage uptake of online services
  • enable patients without ID to register for online services
  • empower staff to agree a standard approach

When can we use remote vouching to verify a patient’s identity?

During the COVID-19 outbreak practices may use this option to cover:

  • prescriptions
  • summary record access
  • test results
  • changing a nominated pharmacy
  • appointments (until total triage is adopted and appointments switched off)
  • telephone and video consultations


Remote vouching should not be used for giving a patient access to their detailed coded or full record.

Asking the right questions

When verifying a patient's identity it is essential that you do not inadvertently disclose information in the record, for example;

  • Do not ask ‘Please can you confirm when you were referred to the Improving Access to Psychological Therapies service?’
  • Instead, ask ‘Please can you confirm when you last attended the practice and for what reason?’

For example:

  • When did you last see a doctor/nurse at this practice?
  • Do you take any prescribed medicines? Can you tell me what they are?
  • Have you had an operation in hospital? Can you remember when and what it was for?



  • encourage patients to sign-up for online services using an app which uses NHS Login
  • agree who can verify identities using remote vouching
  • undertake questioning of patients discreetly
  • ask questions based on fact from the record
  • include a range of questions not just on demographic information
  • confirm the patient’s email address before sending log-in information (inc the linkage key/passphrase)
  • be aware of the risk of enabling fraudulent access through impersonation
  • record the process and decisions taken in the record
  • update your practice website to remove reference to patients having to bring ID to the practice to gain access to online services


  • do not accidently disclose confidential information to the patient before their identity is verified

External Resources

Date Published Article Format Author(s)
Revised Summer 2018 RCGP Patient online toolkit - Royal College of General Practice Guidance portal - open access RCGP and NHS England
Revised March 2020 NHS Digital Identity Verification and Authentication Standard for Digital Health and Care Services Guidance NHS Digital
Sept 2018 NHS England Identity Checking for GP online services Guidance NHS England
March 2020 NHS Getting an NHS log in Website NHS Digital/NHS England
2018 RCGP Getting an NHS log in Guidance RCGP/NHS England
NHSX Remote vouching guidance PDF guidance NHSX
NHSX Remote vouching PowerPoint slides Chelsea Felstead & Tristan Stanton

Page last reviewed: 3 April 2020
Next review due: 3 July 2020
Provide Feedback