Smartcard and authenticator users
Getting or recovering access to patient data using a smartcard or other authentication device.
If you are trying to find your Registration Authority, go here.
How to get a smartcard
An NHS smartcard is an authenticator token containing a chip with electronic certificates issued to it alongside a passcode. It looks like a 'chip and PIN' bank card.
If you have one of these cards, you have a Care Identity profile. You use it to access clinical and personal data. Your smartcard will include your name, photograph and UUID (Unique User Identification) number.
A smartcard contains a pair of digital certificates, stored for security and authentication purposes and bound to the user's identity. These certificates need to be renewed at least every 3 years.
The person or people within your organisation responsible for smartcards is called a Registration Authority or RA. They're usually part of your HR team.
If your role means you may need access to clinical and personal data, a Care Identity profile will be created for you and you'll receive a smartcard or other authenticator.
You should not have to do anything to prepare for this, but you will need to have your identity verified. You may need to attend a face-to-face identity check or use the Apply for Care ID service.
Find out more about identity document requirements.
How to use your smartcard
How you log in and access patient information can differ by organisation. In general you will:
- place your smartcard in the reader attached to the PC or laptop that has access to the Spine portal
- enter the passcode you chose or were given when you first got your smartcard
- access the services you need
It's important that a colleague takes you through the steps you need to follow to get started with your smartcard because guidance will not apply to every unique system.
Make sure you:
- never share your passcode with anyone else
- never allow anyone else to use your smartcard
- never leave your smartcard unattended
- always remove your smartcard from the reader when you've finished using it
By using a smartcard you are accepting these terms and conditions.
Problems with your smartcard
Find out how to:
For any other issues with your smartcard, contact your HR team. It will usually be your Registration Authority (the name for the person or people who manage smartcards) who'll need to help you, but the quickest way to find them is to contact HR.
Unlock your smartcard
If your smartcard is locked you can use the self-service application to unlock it. You do not need to register to use the application, but you must have an email address or mobile number associated with your Care Identity profile so you can receive a security code.
If you do not have an email address or mobile number on your profile, you'll need to take your smartcard to someone who can unlock it. Contact your HR team. Your Registration Authority will be able to add an email address or mobile number, or they can help you find someone to do a face-to-face unlock.
If you've forgotten your passcode or want to change it
If you know your passcode and your smartcard is not locked, you can change your passcode in Care Identity Management. Read instructions on how to do this.
If you've forgotten your passcode and it has become locked, use the self-service unlock application. This will allow you to choose a new passcode. You must have an email address associated with your Care Identity profile to use the application.
If you know your passcode, want to change it, but do not have a valid email address associated with your profile, you'll need to contact your Registration Authority who will change it for you. You must be with them in person so that you can choose the new passcode yourself.
Renew smartcard certificates
Smartcard certificates are valid for 3 years. If your certificates are going to expire in the next 90 days you will get a smartcard expiry alert each time you log in, until you renew them.
Read how to renew your smartcard certificates before they expire.
If your certificates have already expired, you will need to contact your Registration Authority. A Registration Authority manager or agent can renew your certificates in Care Identity Management, but you must be with them in person.
Make changes to your Care Identity profile
Update your contact details
You can use Care Identity Management to change your email address and phone number in the service.
Log in to Care Identity Management and select 'View your profile' from the home page. You can then use the 'Change' links on the right of the screen to change your contact details. See this process with screenshots.
Change your name
You'll need to contact your Registration Authority if you've changed your name. They will update your user profile and issue you a new smartcard in your new name. You may need to provide proof of your change of name.
Change your access permissions
Access permissions assigned to your Care Identity profile allow you to use the healthcare applications you need for your job. Your Registration Authority manages access and you'll need to talk to them if you need new or different permissions.
If you've lost your smartcard
You must contact your HR team immediately. They will cancel your smartcard and replace it.
Using other types of authenticator
Smartcards can have limitations as they require a Health and Social Care Network connection. We are responding to this by offering alternative authentication options over the internet, while continuing to keep patient data secure.
You can now register each of these devices on your own Care Identity profile without needing to visit your Registration Authority:
- iPads
- Windows Hello
- security keys, including YubiKeys
- Microsoft Authenticator
- NHS.net Connect (formerly NHSmail)
If you're leaving your organisation
If you move to a different healthcare organisation, your smartcard moves with you. Your old access will be removed but your new organisation will apply new access to your existing smartcard.
If you are leaving healthcare, return your smartcard to your line manager.
Last edited: 2 April 2025 2:16 pm