NHS England has detailed a passkey change for its self-claimed Care ID service in the latest Care Identity Management release. Version 9.1 is scheduled to use AAL2 passkeys to strengthen the service, which sits within the identity and access infrastructure used by health and care workers.
The NHS release page lists September 24 as the planned date, subject to final approval. It also includes improved logging for organization searches in the Find your Registration Authority application and code-quality fixes intended to improve security and reliability. NHS England says users should see no interface change or downtime during the update.
AAL2 stands for Authentication Assurance Level 2, a measure of confidence in the way a person signs in. It is separate from the assurance attached to the underlying identity record. NHS England’s Registration Authority policy allows a self-claimed Care ID in specific circumstances, but restricts access through an AAL2 mechanism until the person’s identity has been verified to government GPG45 standards.
That distinction matters in a healthcare environment, where an account used to reach sensitive clinical systems must be linked to an appropriately verified person. A stronger sign-in method does not, by itself, turn a self-claimed identity into a fully verified one. The planned change therefore concerns authentication within a limited-access journey, not a blanket expansion of what an unverified account can view.
NHS Care Identity Service already supports passkeys in other AAL2 settings. Its authenticator guidance says staff can use mobile-device options, including passkeys, to sign in to applications enabled for that assurance level. On shared computers and ward terminals, staff may authenticate across devices using a phone, with a biometric unlock or another method on the device.
The 9.1 release is a targeted update to the self-claimed Care ID service rather than the first deployment of passkeys across the NHS. It continues a series of incremental Care Identity Management releases addressing authentication, reporting and service stability. The organization-search logging change in this version is aimed at the tool that helps workers find their Registration Authority, the local team responsible for managing access and identity records.
Sources: NHS England release note, NHS authenticator guidance, NHS Registration Authority policy
–
By the ID Tech Editorial Team
