Troubleshooting smartcard management issues

You are trying to:

• issue or print a smartcard
• repair a smartcard
• cancel a smartcard
• reset a smartcard passcode
• renew a smartcard certificate

While doing one of these you see an error, or the operation does not complete. This error may be intermittent or it may happen every time.

Smartcard management problems are almost always traced back to incorrect software or device setup. The most common cause is that the workstation has incorrect smartcard reader drivers installed.

Users with a clinical role can do 2 smartcard management activities for themselves. Read our guidance on:

• unlocking your smartcard
• renewing your certificate

If your smartcard has already expired then you will need to find your Registration Authority and book a face-to-face meeting.

If you cannot access the services above and are getting error messages, you will need to get IT support. Depending on your organisation, this may be through your IT helpdesk, or via a dedicated Registration Authority team. As each organisation is set up differently, we cannot provide contact details that work for everyone. Check your intranet for links to an IT helpdesk, Registration Authority or smartcard team. 

Reissuing smartcards

Reissuing a smartcard should be the last resort, and only attempted after following the steps above, including reporting of the issue to the National Service Desk.

Using Care Identity Management (CIM)

All smartcard management should be done in Care Identity Management where possible. 

Smartcard users can: 

• unlock their own smartcard and reset passcode 

• renew their own smartcard certificates (not yet available in CIM*) 

Local smartcard administrators, sponsors and Registration Authorities can: 

• unlock smartcard and reset passcode for others 

• renew smartcard certificates for others - where certificates have not yet expired, and where the subject's RA role is not higher than the unlocker's role

Sponsors and Registration Authorities can: 

• renew expired smartcard certificates for others - where the subject's RA role is not higher than the unlocker's role

Registration Authorities can:

• issue and print smartcards

• issue smartcards without printing

• print smartcards only (not yet available in CIM*) 

• repair smartcards

• cancel smartcards

* The old Care Identity Service application is being switched off, and users are being moved to the new CIM service. We have been dual-running both services for more than a year and will be switching off features gradually until we can retire the old service completely. In the meantime, a few features are only available on the old service as they have not yet been released in CIM. 

Troubleshooting errors

Step 1

Use the setup checker tool to get a snapshot of common problems.

Step 2

Check for specific error guidance in troubleshooting common issues.

Step 3

Smartcard management problems are almost always traced back to incorrect software or device setup. Report the issue to your IT team, and send them a link to this page, which contains detailed guidance for solving these issues.

Note: If you are using series 9 smartcards, you must have the PIV middleware installed to authenticate. To perform any smartcard management activities, including renewing your own smartcard certificates, you will also need to have the latest version of NHS Credential Management installed.

Do not ignore this issue.

Even if the problem is intermittent, or happens only on some machines, it is important to understand the root cause and fix it across all your organisation's workstations as a priority.

It causes a clinical risk when healthcare staff do not have access to patient data.

The steps below will help you to understand how to optimise workstation setup to eliminate problems.

Step 1

Use the setup checker tool to get a snapshot of common problems.

Step 2

To check that the workstation is set up correctly, read how to set up a Registration Authority workstation 

Step 3

Check the workstation has the correct smartcard reader drivers installed.

Step 4 (printer issues only)

Check the latest smartcard printer setup and care guidance.

Step 5

Download the CIS Diagnostic Tool and generate a diagnostic log for the workstation.

The CIS Diagnostic Tool should be the first resort for all Care Identity Service troubleshooting on a user's machine, where the cause is unclear. The vast majority of reported problems can be diagnosed and fixed using this. You will need local machine admin access to run the tool and complete any fixes that it highlights.

Download the CIS Diagnostic Tool (needs HSCN connection) and follow the instructions for detailed troubleshooting.

Step 6

If you have been through all the above steps, and still cannot progress:

1. Raise a case to the National Service Desk on the NHS Digital Customer Portal or email [email protected]
2. To get the best service, follow these instructions when writing your support request:

Problem with smartcard management

I am a member of the IT team for my organisation,

A user is trying to [smartcard management action they are trying to do, e.g. print smartcard]

They get the following error in Care Identity Management:

[add error description here if appropriate]

• I have followed the troubleshooting steps, but now need to raise a request for help as described in https://digital.nhs.uk/services/care-identity-service/setting-up-and-troubleshooting/common-issues/troubleshooting-smartcard-management-issues
• I attach a copy of the diagnostic log for the workstation/s
• I confirm that the workstation conforms to the Warrantied Environment Specification

Troubleshooting guidance

IT teams should read our troubleshooting guidance. It is regularly updated as new issues are found and solved, and new software is made available.

Latest news

For information about the Care Identity Service, new software, communications and support, see our news page.