rvlsoft - Fotolia
Gov.uk Verify not secure enough for NHS, says HSCIC
The government’s Verify identity verification platform isn’t secure enough for the NHS, so Liverpool Clinical Commissioning Group and HSCIC are working to add extra levels of security
Liverpool Clinical Commissioning Group (CCG) is working to make the government's identify authentication platform secure enough for the NHS to use.
Verify, developed by the Government Digital Service (GDS), is intended to be the default mechanism for citizens logging into online public services to prove they are who they say they are.
Liverpool CCG is working with the Health and Social Care Information Centre (HSCIC), NHS England and GDS to create a version of Verify suitable for the NHS. Rob Shaw, director of operations at HSCIC, told Computer Weekly in March 2016 that because of the sensitivity surrounding health data, “we absolutely have to make sure it’s secure enough”.
He added: “There are certain transactions where Verify is not quite there in terms of the level of security we’ll need in terms of the health services. We’re pretty sure that we need something more.
“We’ll end up with a hybrid of different things, so while Verify is good enough for a lot of things, we’re likely to take it to the next level in terms of security.”
According to the Cabinet Office, there is no work underway to create a new version of Gov.uk Verify for the NHS, and a Cabinet Office spokesperson maintained that no decision has yet been made on making Verify available for use in the NHS.
GDS is simply working with the NHS to better understand their needs, the Cabinet Office said.
“We take our users’ privacy and the security of their data very seriously and the new system is safer and more secure than previous ways of proving who you are online. We’re in the process of rolling out the service across central government and are working with health services to understand how it could meet their needs," the spokesperson added.
The system works by having users register with one of a number of approved third parties, such as Experian and the Post Office, which perform the identity checks required to verify that individual user. Once verified, the company confirms electronically to the GDS that the individual is allowed access.
Read more about Gov.uk Verify
- Royal Mail is the latest provider to be accredited to support the government’s Gov.uk Verify identity assurance service.
- Gov.uk Verify is set to move from beta to live in April 2016, three years after its original target date.
In Liverpool, the CCG has created a platform that can integrate Verify and third-party services and connect them with patient record systems in hospitals or at GPs.
Dave Horsfield, programme manager for the city’s More Independent Liverpool programme and the lead for the Verify project at the CCG, said the programme is about giving patients access to their records for whatever purpose they want, securely and easily.
“We are trying to figure out how people are going to verify themselves in a way that we feel comfortable, and how can we safely do that,” he said.
The aim is to create an identity authentication scheme which “links social identities to an NHS identity so the right information can be confidently shared”.
Work is taking place to link Verify with the HSCIC’s personal demographic service, which holds the master patient index of NHS numbers as well as other details.
Security issue
However, the NHS is worried that Verify won’t be, or won’t come across as, secure enough for people’s health records.
“A lot of brilliant work has been done on Verify, but we’ve got an extra layer in health where people are very worried about security,” said Horsfield. “We know that GDS has worked on Verify for some time, so for us it’s about finding out what needs to be done differently. It’s different using Verify for tax returns than it is health information.”
False verification
Horsfield explained that one of the worries is that if people have access to someone’s personal information which is used to verify their identity, such as a wife having access to her husband’s passport, national insurance number and driving licence, that would mean she could pretend to be him and view his medical records.
“We have some concerns about issues around if someone could get access to the information and use it to falsely verify their identity,” he said.
The CCG is looking at different ways of making it secure enough, adding extra elements such as dual authentication, the possibility of video recognition and biometrics.
Later in 2016, the CCG will begin a trial with patients on using a version of Verify. The trial will start with a handful of people, and if that works it will be extended to up to 200. Further down the line, Horsfield said, it will be trialled with people with learning disabilities and vulnerable adults to ensure they get on board.
“We don’t really know what we’ll end up with. A hybrid version of Verify is quite likely,” he added.
The article has been updated to reflect the comments made by the Cabinet Office.
