Verify (and Facebook) tested for NHS online identity service

The new director of the government’s online identity scheme has raised the possibility of rolling out the service in the NHS, despite concerns about its security.

In a post on 22 August, the interim director of GOV.UK Verify, Jess McEvoy, said the Government Digital Service was “looking at the viability of offering GOV.UK Verify at scale to other public bodies” including the NHS.

“The government is committed to maximum possible re-use of GOV.UK Verify across the public sector and beyond,” she added.

GOV.UK Verify went live in May this year, as a new way for people to verify their identity while using online government service, such as updating their driver’s licence or applying for a tax refund.

Verify uses certified companies, such as Royal Mail and Experian, rather than the government, to verify an individual online identity. This verification is then relayed to the relevant government service, which provides the verified user with access.

The project’s deployment was repeatedly delayed and was criticised in one research paper last year as suffering from “severe privacy and security problems”.

Verify has not yet been rolled out in the NHS, amid concerns about its possible security implications, but NHS Liverpool Clinical Commissioning Group is currently testing whether it could work in practice for providing access to online health services.

In a joint presentation with NHS England early this year, titled “Is a standard NHS online account feasible?”, the CCG said it was testing both the government’s Verify service and a locally-based equivalent.

It was also exploring how this information could be linked to patient’s NHS Number and whether it would give more control to patient.

An NHS Digital spokeswoman would not comment on any progress made testing Verify or security concerns previously raised by the organisations. She said there would be nothing further to report publicly till at least November.

“A range of different options are being explored in detail and it is too early in the process to discuss them.”

However, NHS Digital has previously confirmed it has been experimenting with Verify and other ways of securely confirming patients’ identity digitally.

A secure online identity system forms an important foundation for the National Information Board’s ‘Personalised Health and Care 2020’ strategy, which includes giving patients a single online access point to their health and social care records and services through a new web interface, NHS.UK.

In a blog earlier this year, Chris Marshall, a user research manager at the then Health and Social Care Information Centre (now NHS Digital), said HSCIC had been testing everything from Verify to Facebook and Google to log-in into a new NHS Account with user groups.

The research had shown that for an online verified health identity to work, users needed to find it easy, have a clear sense of the benefits, and be confident their data was secure.