Smartcards

An NHS Smartcard is a secure access card, similar in appearance to a chip and PIN bank card. It contains electronic certificates and is used alongside a personal passcode.

Smartcards are a key part of how the NHS protects systems and patient data. Pharmacy teams use them to access NHS systems such as:

• The Electronic Prescription Service; and
• The National Care Records Service.

Smartcards help ensure that only authorised people, with a genuine role in patient care, can access patient medical information.

Each pharmacy team member who needs access should have their own Smartcard. Smartcards must never be shared.

Your local RA manages Smartcards. They assign roles to each card and set which pharmacies the card can be used in. In some cases, a Smartcard can be linked to more than one pharmacy.

Read our Smartcard model factsheet for more information on how the system works.

When a pharmacy team member needs a Smartcard, the pharmacy owner must contact the local RA.

The process includes identity checks for the person applying for a Smartcard. RAs may repeat these checks from time to time.

Identity checks require a face-to-face meeting. How this works varies by area. In some places, RA staff visit pharmacies or attend Local Pharmaceutical Committee (LPC) events. In other areas, the applicant may need to visit an RA office.

Three forms of identification are required. These must include photo ID and non-photo ID, as well as proof of address.

The applicant’s details must also be confirmed and approved by an appointed individual.

Temporary Access Cards

NHS Digital previously advised pharmacy owners to plan for situations where a Smartcard is lost or stolen. This is particularly important for pharmacies with a small number of Smartcard users.

If you are concerned about service continuity, speak to your local RA about Temporary Access Cards (TACs).

TACs are blank Smartcards with a set level of access. If a Smartcard is lost or stolen, a TAC can be activated by a Smartcard Sponsor or Local Smartcard Administrator, alongside the pharmacy team member who needs access.

If a TAC is used:

• Report the lost or stolen Smartcard to your RA as soon as possible;
• Store TACs securely when not in use;
• Keep a record of who uses the TAC; and
• Return the TAC to a blank state once a permanent replacement Smartcard has been issued.

Pharmacy owners with a single-handed pharmacist and no support staff should contact their RA to discuss further options for maintaining access and business continuity.

All Smartcard users have a passcode. This must be changed regularly. Users will receive a prompt before the passcode expires.

Users can also update the email address and phone number linked to their Smartcard. Keeping these details up to date helps the RA contact you if there is a problem with your card.

Read NHS England’s guidance on changing your Smartcard passcode.
Read NHS England’s guidance on updating your Smartcard contact details.

Smartcards expire after three years if they are not renewed.

As the expiry date approaches, you will receive reminders each time you log in. This allows you to renew your card before it expires.

Older Smartcards with numbers starting 01-06 (shown on the back of the card) cannot be renewed or unlocked. If you have one of these, contact your local RA to request a replacement.

Read NHS England guidance on renewing Smartcards.

If a passcode is entered incorrectly three times, the Smartcard will lock.

You should first try the self-service unlock option: Read NHS England’s guidance on using the self-service Smartcard unlock function.

To use this service, your Smartcard profile must include at least one of the following:

• An email address;
• A mobile number; or
• A photograph.

If your pharmacy has a Local Smartcard Administrator or Sponsor, they can unlock your card using the Care Identity Service.

If neither option is available, contact your local RA to request an unlock.

Smartcard users are given roles that reflect their job responsibilities in the pharmacy.

Read more about Smartcard roles and how they are managed.

Pharmacy staff who work at more than one pharmacy must have their Smartcard set up to work at each location.

Read more about using Smartcards at multiple pharmacies.

The Care Identity Service (CIS) is the system used to manage Smartcards.

CIS allows users and administrators to:

• Unlock and renew Smartcards;
• Change passcodes; and
• Update contact details.

Local Smartcard Administrators, Sponsors and RA staff also use CIS.

Read our factsheet on using Care Identity Service.
Read the NHS factsheet on logging into CIS and viewing your Smartcard details.

Smartcards are linked to the pharmacy ODS codes where staff regularly work.

Locum pharmacists, pharmacy technicians or dispensers may also have a role linked to a generic “locum pharmacy” ODS code. This allows access at short notice across multiple pharmacies.

If a Smartcard is no longer needed, for example when a staff member leaves, the pharmacy owner should inform the local RA as soon as possible.

Changes to pharmacy ODS codes

If a pharmacy ODS code changes, all users must have the new code added before the old one is removed.

To reduce disruption, a new ODS code should only be requested following a change of ownership where the outgoing pharmacy owner retains responsibility for items dispensed up to the sale date. See further guidance on allocation of ODS codes.

Staff moving to another pharmacy

Staff moving to another pharmacy or NHS organisation should keep their Smartcard. The new organisation must be added to their profile by the RA.

Staff leaving healthcare

If someone leaves healthcare and does not expect to need a Smartcard in the near future, the RA should revoke their Smartcard and certificates.
The RA can also be informed if a Smartcard holder has died.

Closing a pharmacy

If a pharmacy closes and staff leave healthcare, follow the guidance above.
If staff move to another pharmacy, they may keep their Smartcards, but the closed pharmacy ODS code must be removed.

Obtaining Smartcards

Q. How can I obtain a Smartcard?
Contact your local Registration Authority (RA). They will explain what you need to do and what documents to bring.

Q. My Smartcard has been stolen, lost or broken – what should I do?
Contact your local Registration Authority as soon as possible so they can cancel the card and advise on next steps.

Q. What arrangements are in place to provide temporary access to EPS Release two?
There is a Temporary Access Smartcard solution. This allows NHS Care Records Service users to keep access to compliant systems if a Smartcard is lost, forgotten, stolen or damaged. You can find more details in the ‘Obtaining and replacing Smartcards’ section above.

Q. I live in Wales but sometimes work as a locum in England. How do I obtain a Smartcard?
You can obtain a Smartcard from the Registration Authority in the area in England where you work.

Smartcard personal details
Q. What is the process if my surname changes, for example through marriage?
Changes to key personal details, such as name, date of birth or National Insurance number, need a check similar to applying for a Smartcard. This means a face-to-face check with someone who holds a Registration Authority or Sponsor role, may be needed, plus appropriate evidence, for example a marriage certificate or other legal document.
Contact your local Registration Authority for details of the process in your area.

Q. Do I need to add my details to the Care Identity Service (CIS)?
Community Pharmacy England recommends that Smartcard users add an email address and phone number in CIS, if they have not already done so. This helps support teams contact you quickly if there is a problem with your Smartcard. It is particularly important for users with the 5F multi-site code to have up-to-date contact details.

Smartcard model
Q. Can a pharmacy access nominated prescriptions that have been downloaded without a Smartcard (in EPS Release two)?
No. An IT system can automatically download nominated prescriptions from the Spine without a Smartcard, for example overnight. However, those prescriptions cannot be fully accessed on the local system until a Smartcard is used and the user is authenticated. Once this happens, the prescriptions become local patient medication records. Access to these local records without a Smartcard will depend on the security controls set within the IT system supplier’s software.

Q. What is e‑GIF Level three?
e‑GIF stands for e‑Government Interoperability Framework. It sets policies and standards so information can flow securely across the public sector. It includes four confidentiality levels, from zero to three, based on the impact if information is disclosed. Level three has the strictest security requirements and is used for the NHS Care Records Service.

Q. Which EPS functions require a valid Smartcard?
A Smartcard is required to:

• set, change or delete a patient’s nominated pharmacy;
• download electronic prescriptions from the Spine;
• return electronic prescriptions to the Spine;
• confirm that an electronic prescription has been dispensed; and
• submit an electronic prescription to NHS Prescription Services for payment.

Q. What action should be taken following the death of a Smartcard holder?
If a pharmacy team becomes aware that a member of staff has died and they held a Smartcard linked to that pharmacy, the team should contact the local Registration Authority. The Registration Authority can then remove the user’s access and cancel the Smartcard.

Smartcard model factsheet for more information on how the system works

Updating Smartcards for multi-site and Summary Care Record (SCR) usage

Smartcard Role and Activity codes and how to update them

Smartcard processes and tips

Using Care Identity Service (CIS)

Smartcard resolution and escalation route factsheet