branch graphic

Professional Vouching

Online services: Identity Verification Guidance for general practice

What is identity verification?

Most general practice services rely on varying levels and methods of identity verification. But access to online services demands a more consistent and robust approach to ensure patient confidentiality while providing them with secure access to personal and sensitive data.

Patients may book an initial appointment online as soon as they have completed a simple online registration process. However a more secure identity verification process is required before full access to appointment, repeat prescription ordering or record access services may be enabled for a patient.

Every practice is required to verify patient identity documentation, or individually vouch for each patient requesting access to online services. These processes need to be simple, quick, patient- friendly and not overly demanding for the practice.

An overview of the process is given below:

How do I verify a patient’s identity?

There are three ways of confirming patient identity:

When registering new patients to the practice, sign them up for online services at the same time.

  • Documentation
  • Vouching
  • Vouching with confirmation of information held in the applicant’s records.


Most patients are able to prove their identities using documentation. Just as with DBS checks, two forms of documentation must be provided as evidence of identity and one of these must contain a photo. Acceptable documents include passports, photo driving licences and bank statements, but not bills.

A full list of acceptable documents as published by the Cabinet Office.

Accelerator sites for online services for patients, and other organisations that have now started to check existing patient identities, report that it takes around five minutes to provide them with login details, plus extra time to update each patient’s record.

There will always be some patients (e.g. temporary residents, travellers or young people living with their parents) who do not have acceptable identity evidence. In these cases, vouching may be possible if individuals are well known to the practice.


Vouching for a patient’s identity requires an authorised member of staff who knows the patient well enough to verify that they are who they say they are, and that no deception is taking place.

Consideration should be given to how long each patient has been registered with the practice as well as how many times the staff member has met them. Vouching might therefore be appropriate for patients who have been registered for a short period involving frequent appointments, and also for patients registered for a long time but seen less frequently.

Practices must judge each patient on a case-by-case basis while ensuring that the agreed policy takes into account the duration of registration and frequency of patient contact.

Vouching with confirmation of information held in the applicant’s record

In a situation where the applicant is not known sufficiently well by an authorised member of staff to vouch for them on this basis, their identity may still be verified by obtaining responses to questions from information held in the medical records.

This should take place discreetly and ideally in the context of a planned appointment. It is extremely important that the questions posed do not incidentally disclose confidential information to the applicant before their identity is verified.

What do I need to do?

Practice protocol

Identity verification protocols must be made available to all staff in each practice to ensure consistent and transparent processes. Protocols must clearly establish the different stages of identity verification processes, detailing who is involved, what their contributions are and what to do in unusual situations.

Who can verify patients’ identities?

Every practice must decide which members of staff are authorised to perform verification of identities by presented documents and vouching, and record these in their practice protocol.

Before a patient is registered for online services there must always be a face-to-face meeting to ensure that the person submitting the application is the person with the verified identity.

Evidence of identity verification

Documentary evidence that checks have taken place, the nature of those checks, who did them and when, should be recorded in each patient’s record. A registration form (example available here) must be completed and signed by the patient and scanned into the patient’s record. A Read Code can also be added to aid searching for the information at a later date.

To avoid non-clinical information being stored in patient records, copies of bank statements, passports and other personal documentation must not be scanned into those records.


Identity Verification GP Online
© 2022 NHS Havering Clinical Commissioning Group.