Smartcard and authenticator users

An NHS smartcard is an authenticator token containing a chip with electronic certificates issued to it alongside a passcode. It looks like a 'chip and PIN' bank card.

If you have one of these cards, you have a Care Identity profile. You use it to access clinical and personal data. Your smartcard will include your name, photograph and UUID (Unique User Identification) number.

A smartcard contains a pair of digital certificates, stored for security and authentication purposes and bound to the user's identity. These certificates need to be renewed at least every 3 years.

Each NHS organisation has a team or person who is responsible for registering new users, known as a Registration Authority (RA). The Registration Authority undertakes checks, verifies the identity of smartcard users and assigns the appropriate access permissions to the healthcare worker.

If your role means you may need access to clinical and personal data, a Care Identity profile will be created for you and you'll receive a smartcard or other authenticator. You shouldn't have to do anything to prepare for this, but you will need to have your identity verified. You may need to attend a face-to-face identity check or use the Apply for Care ID service.

Find out more about identity document requirements.

How you log in and access patient information can differ by organisation. In general you will:

• place your smartcard in the reader attached to the PC or laptop that has access to the Spine portal
• enter the passcode you chose or were given when you first got your smartcard
• access the services you need

It's important that a colleague takes you through the steps you need to follow to get started with your smartcard because guidance will not apply to every unique system.

Make sure you:

• never share your passcode with anyone else
• never allow anyone else to use your smartcard
• never leave your smartcard unattended
• always remove your smartcard from the reader when you've finished using it

You may need to contact your Registration Authority if you are having issues with your smartcard.

Read about how to find your Registration Authority.

If your smartcard is locked you can use the self-service application to unlock it. You do not need to register to use the application, but you must have an email address associated with your Care Identity profile so you can receive a security code.

If you do not have an email address on your profile, you'll need to take your card to someone who can unlock it. Your Registration Authority (smartcard team) may be able to change your email address, or can help you find someone to do a face-to-face unlock.

You can use the self-service unlock application to reset or change your passcode. You must have an email address associated with your Care Identity profile to use the application.

If you know your passcode, want to change it, but do not have a valid email address associated with your profile, you'll need to contact your Registration Authority who will change it for you. You must be with them in person so that you can choose the new passcode yourself.

Smartcard certificates are valid for 3 years. If your certificates are going to expire in the next 90 days you will get a smartcard expiry alert each time you log in, until you renew them.

Read how to renew your smartcard certificates before they expire.

If your certificates have already expired, you will need to contact your Registration Authority. A Registration Authority manager or agent can renew your certificates in Care Identity Management, but you must be with them in person.

Update your contact details

You can use Care Identity Management to change your email address and phone number in the service.

Log in to Care Identity Management and select 'View your profile' from the home page. You can then use the 'Change' links on the right of the screen to change your contact details. See this process with screenshots.

Change your name

You'll need to contact your Registration Authority if you've changed your name. They will update your user profile and issue you a new smartcard in your new name. You may need to provide proof of your change of name.

Change your access permissions

Access permissions assigned to your Care Identity profile allow you to use the healthcare applications you need for your job. Your Registration Authority manages access and you'll need to talk to them if you need new or different permissions.

You must contact your local Registration Authority immediately. They will cancel your card and replace it.

Smartcards can have limitations as they require a Health and Social Care Network connection.

We are responding to this by offering alternative authentication options over the internet, while continuing to keep patient data secure. If your organisation uses these other authenticators, find out more about how to authenticate with:

• iPads
• Windows Hello for Business
• security keys, including YubiKeys
• Microsoft Authenticator

If you already have an iPad, you can also register it on your own Care Identity profile to use as an authenticator.

If you move to a different healthcare organisation, your smartcard moves with you. Your old access will be removed but your new organisation will apply new access to your existing smartcard.

If you are leaving healthcare, return your smartcard to your line manager.