Can my app use NHS login? The commissioning rule most founders miss

Your app can use NHS login only if an NHS organisation or a local authority has commissioned or sponsored it. It must also be free to patients and serve people in England. A place on an NHS framework doesn’t count as a commission. That rule stops more founders than any technical problem, and it sits in one line of NHS England’s application page.

So check eligibility before you design a single sign-in screen. The rest of this guide covers the test, the stages NHS England runs, what the timings really say, and how the NHS App differs. It ends with what to build if you aren’t commissioned yet.

What NHS login actually is

NHS login is NHS England’s identity service. A patient taps the NHS login button in your app and signs in with their NHS login account. They come back to you verified, with the details you asked for. Under the hood it’s OpenID Connect, the same open standard behind most “sign in with” buttons.

It offers three levels of identity verification, set out on How NHS login works:

The appeal is obvious. Identity checks are expensive and fiddly to build, and patients already trust the NHS brand. But it’s a service you apply for, not an API key you sign up for.

The eligibility test

NHS England lists the criteria on its Apply for NHS login page, last edited 3 February 2026. Your service must meet every one.

• Serves patients in England. Users are registered at a GP practice in England, or receive NHS services in England.
• Offers a health or social care benefit. NHS login doesn’t cover clinical authorisation.
• Is free at the point of use. NHS levied charges, such as prescription charges, are excluded from this test.
• Is commissioned or sponsored by an NHS organisation or a local authority. A framework agreement isn’t a commission or a sponsorship.
• Meets DAPB3051, if you run your own sign-in alongside NHS login. This is NHS England’s identity verification and authentication standard.
• Is deployed in England. NHS login is for use in England only.

If any box stays empty, you aren’t eligible yet. NHS England says to contact it before applying if you’re unsure.

The three rules founders trip on

The commissioning rule. This is the big one. A subscription model sold direct to patients fails twice: nobody commissioned it, and it isn’t free. A product sold to a private clinic fails too, unless an NHS body or council is paying for the patient’s use.

The framework rule. Founders often assume a G-Cloud listing makes them an NHS supplier. For NHS login, it doesn’t. A framework is a route for buyers to purchase from you. It isn’t evidence that anyone has.

The England rule. Patients in Scotland, Wales or Northern Ireland can’t use it. If your market is UK-wide, NHS login can only ever cover part of it.

A worked example

Say you’ve built a physiotherapy rehab app. You sell it to employers as a staff benefit and to patients at £9.99 a month. You aren’t eligible: nobody in the NHS commissioned it, and patients pay.

Now an integrated care board commissions it for post-surgery patients in its area, free to them. That cohort may now be eligible. Your paying consumer users still aren’t, so you’ll run two sign-in routes. Plan for that early.

The stages, in order

NHS England gives you a project manager, and most of the work happens over Microsoft Teams. The steps below come from the toolkit’s apply, discovery, integrate and go live pages.

1. Apply and the application review call

You create a developer account and start the Digital Onboarding Service. If you look eligible, you’re invited to an application review call. It covers where your data is hosted, your timescale, your commissioners and the verification level you need. It also covers what user data you want and any use of AI.

One line deserves a highlight: data transfer outside the UK and EU/EEA “will not normally be accepted”. Check your hosting region and every sub-processor before this call.

2. Eligibility decision and the Partner Integration Board

If your use case is valid, NHS England reports it to the Partner Integration Board. The board approves, rejects or defers it. Approval here isn’t approval to go live.

3. Discovery and the sandpit

You must build a proof of concept in the sandpit, a copy of the production environment. Then you demonstrate set journeys with test data, live or on video. These include a user who declines consent, a user who consents, and a returning user.

The login journeys can’t be customised, and the button guidelines are mandatory. You also prepare architecture and data flow diagrams, one architecture diagram per client ID. If you depend on IM1 for GP data, wait for GP IT supplier approval before booking the demonstration.

4. Preparation call and product demonstration call

The demonstration call brings in NHS England specialists from architecture, data security, information governance and legal. NHS England calls it a collaborative discussion, not a pass-or-fail exam. By the end you agree your scopes, your connection agreement terms and an estimated go-live date.

5. Integration and assurance

You get access to the integration test environment and work through its test scenarios. Your evidence must come from this environment, not the sandpit. You then complete a bespoke SCAL, the Supplier Conformance Assessment List. It must include:

• an in-year DSPT, published at “standards met” or better
• a completed penetration test, with fixes where applicable
• an NHS login compliant privacy notice
• your architecture diagram, data flow diagram and user journeys

You also provide clinical safety evidence. That means a named clinical safety officer, a safety case report and a hazard log. It also means evidence for DCB0129 and DCB0160, plus a medical device assessment.

6. Connection agreement and service desk

The connection agreement is a legal contract with NHS England, with GDPR appendices already filled in. It must be signed and returned before you go live. Either you or your commissioner can sign. You also register with the National Service Desk.

7. Review, the board again, and go-live

After you submit everything, a formal review normally takes about three weeks. NHS England then asks the Partner Integration Board to approve your go-live. Production access is actioned only after that approval. Go-live can’t fall on an English bank holiday.

8. Living with it

NHS England reviews your SCAL and connection agreement every year. You should update your safety case report and hazard log as part of that review. Changes to your use case, button placement, AI use or ownership must be reported.

How long it takes

NHS England’s own pages give three figures, and they don’t quite agree.

Read them together and the honest planning figure is three to four months once you’re eligible. The second figure starts later, so the whole run can be longer. Six weeks is the best case, not the plan.

None of that clock includes winning the commission. NHS England publishes no figure for that, and it’s usually the slowest part. Missed milestones push the date back, by NHS England’s own account.

NHS login and the NHS App are different things

The NHS App lets patients reach some third-party services from inside the app. That’s a separate integration with its own rules, set out in How to integrate with the NHS App.

NHS login comes first. You “need to carry out an NHS login integration before going live with an NHS App integration”.

The web integration criteria go further than NHS login’s:

So the framework that’s useless for NHS login becomes a requirement for the NHS App. You need both a commission and a framework. A council-commissioned service that qualifies for NHS login may not qualify here.

The NHS App stages

You submit an expression of interest form, and the team responds within 10 working days. Then come a product review call and demo. Approved products are prioritised each quarter, based on team capacity and strategy.

After that you sign an NDA and complete a product assessment and a solution design. Delivery runs through the sandpit and an assurance environment, with a SCAL, clinical safety documents and a connection agreement. Go-live starts with a limited release, then a full release.

The standards for NHS App integration set WCAG 2.2 AA as the floor, with an accessibility audit as evidence. They also require all 17 points of the NHS service standard. NHS England publishes no end-to-end timing for the NHS App route, so we won’t invent one.

Where DTAC and DSPT fit

Two other acronyms will turn up in the same conversations.

• DSPT, the Data Security and Protection Toolkit, is an annual self-assessment against the National Data Guardian’s 10 data security standards. Every organisation with access to NHS patient data and systems must use it. NHS login’s SCAL asks for an in-year DSPT at “standards met”. Version 9 covers 2026–27.
• DTAC, the Digital Technology Assessment Criteria, is how NHS commissioners and providers assure a digital health product. It covers clinical safety, data protection, technical security, interoperability, and usability and accessibility. Version 2.0 has 25% fewer questions, and the old form shouldn’t be used from 6 April 2026.

DTAC isn’t an NHS login stage. In practice, your commissioner will often ask for it before they commission you. That puts it upstream of the commissioning rule, which is why it’s worth starting early.

If you aren’t commissioned yet

Most early health apps aren’t. That isn’t a dead end. It changes what you build first.

Build your own login now, shaped for NHS login later

Ship your own sign-in with a standard identity provider that speaks OpenID Connect. Keep your user model separate from how people authenticate. Then adding NHS login later is a new sign-in route, not a rewrite.

Three design choices make that swap cheap:

• Store identities, not just accounts. One user can have several linked sign-in methods. That covers the paying user and the commissioned patient in one product.
• Know which data needs which level. Map each screen to P0, P5 or P9 now. NHS login will ask you the same question.
• Host in the UK. You’ll need to justify any transfer outside the UK and EU/EEA. Choosing a UK region on day one costs nothing.

Get assurance-ready while you sell

The paperwork NHS login asks for is the same paperwork a commissioner asks for. A clinical safety officer, a hazard log, a DSPT submission and a penetration test all take time. Starting them once a commissioner says yes is how six weeks becomes six months.

None of this is wasted if NHS login never happens. Private clinics, insurers and employers ask similar security questions.

Use the gap to prove outcomes

Commissioners buy evidence. Use your own login period to gather it: engagement, outcomes and the cohort you’d target first. That evidence wins the commission that makes you eligible.

The order of play

1. Run the eligibility checklist honestly, especially the commissioning and free-at-point-of-use rows.
2. If you fail it, build your own OpenID Connect login with linked identities and UK hosting.
3. Start the assurance work: DSPT, clinical safety and a penetration test.
4. Prepare for DTAC, because your first NHS buyer will probably ask.
5. Win the commission, then apply for NHS login.
6. Plan three to four months from eligibility to go-live, with six weeks as the best case.
7. Only then look at the NHS App, which needs a framework as well as a commission.

Where Contic comes in

What we do is build health products that are ready for these steps, before the commission lands.

Health and wellness is one of our focus sectors. We built movement tracking for Pristine Condition, used by about 150,000 warehouse staff, and it works offline. We also get clients ready for ISO 27001, SOC 2 Type II, HIPAA and GDPR audits. We don’t issue the certificates.

LaunchPad is our fixed-price route from idea to launch. It runs Discover, Design, Build, Launch, and Discovery sets the exact scope. If you aren’t confident in the plan after Discovery, you get your money back.

For a health app, Discovery is where we’d settle the login question. Who’s commissioning, which verification level each screen needs, and what assurance you’ll need first. The first chat is free, and so is an architectural review.

If you’re earlier still, the non-technical founder playbook covers what to decide before any build starts.