The Notify Gazette
Published by Authority · United Kingdom Edition
OFFICIAL · NHS England · NHS App · e-Referral Service
Notice No.
NTC-GB-004
Date Issued
2026-05-27
Status
In force
Category
Health

NHS App, e-Referral Service and the Electronic Prescription Service: clinical dispatch into the NHS Login estate

Over 33 million UK residents have an NHS Login. The NHS App carries the appointment book, repeat-prescription request and patient-held record across the four home-nation health services. 4notify integrates with NHS Digital's notification gateway to dispatch prescription-ready alerts, e-Referral Service booking reminders and NHS Login second-factor codes — with the patient-identifier blinding required by the Data Security and Protection Toolkit.

PushSMSEmail
Preamble

Whereas the National Health Service operates the NHS App and NHS Login across NHS England, NHS Wales (Help Me, Quit), NHS Scotland (NHS Inform) and Northern Ireland HSC, and whereas the Electronic Prescription Service requires the dispensing pharmacy to be notified of the patient's intent to collect, the present Notice records the standing dispatch specification for NHS-related notifications through 4notify Operations.

Cited Statutes
Data Security and Protection Toolkit (DSPT)

Mandatory annual assertion of compliance with the NHS Digital security standards.

NHS Confidentiality Code of Practice 2003

Patient-identifier blinding requirements on out-of-band dispatch.

Caldicott Principles (8 principles, 2020 revision)

Lawful basis, minimum necessary, justified use and accountability for patient data sharing.

UK GDPR Article 9(2)(h)

Lawful basis for processing health data: provision of medical care and management of health systems.

Implementation
01

DSPT assertion + NHS Digital onboarding

4notify holds a current DSPT assertion and an NHS Digital notification gateway connection with quarterly penetration testing.

02

Patient-identifier blinding

The dispatch envelope carries a hashed NHS number (SHA-256 with salt) — the cleartext NHS number stays in the trust's local system.

03

Three-channel cascade

Prescription-ready → push (60s), then SMS (2 minutes), then email (5 minutes); patient choice respected via NHS Login preferences.

04

NHS Login OTP

Second-factor codes for NHS Login dispatched within the standard 60-second window with email fallback.

Dispatch Envelope
json
{
  "event": "nhs.eps.prescription_ready",
  "nhs_number_hashed": "sha256:salt:7f2a9b...",
  "pharmacy_ods": "FA123",
  "pharmacy_name": "Boots Bridge Street Cambridge",
  "channels": ["push", "sms", "email"],
  "cascade_window_minutes": 5,
  "template": "eps_ready_v4",
  "patient_lang_pref": "en"
}
Sample Dispatch
PushSubject: Your NHS prescription is ready

Your NHS prescription is ready to collect at Boots Bridge Street Cambridge. Open by 6pm Fri. Open in the NHS App for nominated pharmacy options.

Enforcement Checklist
  • DSPT assertion current and unexpired
  • NHS Digital notification gateway connection active
  • Patient-identifier blinding (SHA-256 + salt) enforced at envelope
  • Caldicott Guardian sign-off documented for the dispatch templates
  • Cross-border NHS Scotland / NHS Wales / NI HSC templates aligned
What 4notify does differently

4notify is the only A2P platform with simultaneous DSPT assertions for NHS England, NHS Wales, NHS Scotland and Northern Ireland HSC and a Caldicott-signed dispatch template library across the four nations.

Questions on the Order Paper
Can 4notify see patient names?

No. The dispatch envelope carries only a hashed NHS number; the pharmacy or trust holds the patient name and resolves the hash locally before populating the SMS template.

Does the same pipeline work for NHS Scotland and Wales?

Yes. NHS Login operates across NHS England, NHS Wales, NHS Inform (Scotland) and the Northern Ireland HSC; the dispatch templates carry a home-nation parameter.

What happens if the patient has opted out of SMS in NHS Login preferences?

The cascade respects the patient's NHS Login preferences; if SMS is off, the next channel (email) takes over without operator intervention.

Signed at the Cabinet Office
4notify Operations
2026-05-27 · NTC-GB-004

Start free

14 days. No card. UK-based support through the working week.

Other Notices in this Edition