Patient identity verification: are your controls keeping up with access?

TL;DR: Patient identity verification works best when services ask for the least proof that fits the action, according to OneID’s analysis, using step-up checks only when patients move toward record access or prescriptions. Over-collecting documents at sign-up increases drop-off, expands biometric exposure and weakens proportionality.

Editorial analysis by NHI Mgmt Group, based on content published by OneID: “Patient identity verification: how much proof is enough”.

By the numbers:

• NHS login had over 46 million users as at 11 June 2026.

Key questions

Q: How should digital health services decide how much identity proof to ask for?

A: Start with the action, not the login screen.

Q: Why does a successful patient record match not always prove identity?

A: Because a record match only shows that the data entered corresponds to an existing patient record.

Q: When should a service use step-up verification instead of asking for full proof at sign-up?

A: Use step-up verification when the service can safely offer low-risk features first and only needs stronger proof for a later action.

Practitioner guidance

• Define proof levels by patient action Map each service action to the lowest acceptable identity proof level and reserve stronger checks for record access, prescriptions and other sensitive functions.
• Separate record match from identity proof Ensure teams do not treat a demographics or NHS-number match as proof of the person’s identity, because a lookup and an identity assertion solve different problems.
• Document step-up triggers Write down which user actions cause a higher verification step, why the step is needed and what evidence supports that boundary.

Bottom line: Patient identity verification should be sized to the specific action, not imposed as a single front-door hurdle.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →