What the Single Patient Record is
Today a person's health information is spread across the systems of whoever happened to treat them: their GP practice, one or more hospitals, community services, pharmacy, social care. Each holds a fragment, and moving a fragment between them is slow, manual, and often falls to the patient to carry. The Single Patient Record is the plan to change that.
One record per person
Information that today sits in separate GP, hospital, pharmacy and community systems is brought together into a single view of the person, rather than a stack of disconnected episodes.
Visible to the patient
The person can see their own record through the NHS App — the same information their care team works from, not a cut-down summary they have to request.
Shared across care settings
A clinician in urgent care, a community pharmacist or a district nurse can see the relevant history at the point of care, instead of re-asking the patient or waiting on a letter.
Four questions a joined-up record has to answer
The more useful a record is, the more valuable it becomes to reach into. Every one of these questions has to be answered at the moment of care, in seconds, across organisational boundaries — and answered in a way a patient would find reasonable if they read the log.
01
Identity assurance
Is this really the patient — and really a clinician?
A single record is only as safe as the answer to "who is at the keyboard". Patients need a way to prove they are the subject of the record without handing over a folder of documents; staff need to prove they are a registered professional, not just that they hold a valid login to some system.
02
Authorisation, not just access
Which slice of the record, for how long?
An out-of-hours pharmacist checking an interaction does not need a lifetime of mental health notes. "Logged in" is a blunt instrument; what is needed is a scoped, time-bounded permission that names the purpose and expires on its own.
03
Consent and audit the patient can see
Would the person recognise what happened to their record?
Trust in a single record depends on the patient being able to see who looked, why, and under what permission — and being able to withdraw a permission they granted, with that withdrawal taking effect rather than being filed as a request.
04
Trust across organisations
Who vouches for the other side?
Care crosses trusts, GP federations, pharmacy chains, social care and private providers. Building one central table of every professional, role and consent creates a single point of failure. The alternative is proofs each organisation issues and anyone can verify.
Where verifiable credentials fit
A verifiable credential is a signed statement — issued by someone with the authority to make it, held by the person or organisation it is about, and checkable by anyone without calling the issuer. Four credential types cover the questions above, and none of them require a central database of consents.
Issued by NHS identity service
Held in the person's wallet. Proves they are the subject of the record without re-doing document checks at every service.
Issued by Regulator or employing trust
"Registered pharmacist at a named organisation" — checkable by anyone, revoked the day the role ends.
Issued by The patient (or a lawful delegate)
Names the exact slice — for example medication history only — the purpose, and a window measured in hours, not forever.
Issued by Verifier, mirrored to the patient
Every check leaves a signed trace the patient can read in plain language in the app.
Issued by Original issuer
Status is published and checked at verification time, so a withdrawn consent or a lapsed registration stops working everywhere at once.
None of this replaces the record itself. It sits in front of it: identity, authority and consent become portable proofs, so each organisation checks a signature instead of trusting a shared login or asking a central service for permission.
One request, end to end
A late-night dispensing check is the ordinary case that shows every moving part. Click through it — each step shows what the patient sees, and you can open the technical detail underneath.
Step 1 of 6 · Pharmacist
A request arrives
It is 21:40. An out-of-hours pharmacist needs to know what Priya is currently taking before dispensing. Instead of asking for the whole record, the request names exactly what it needs.
What Priya sees in her audit trail
- Request received — medication history, dispensing safety check.
Selective disclosure in practice
"Minimum necessary" is already the expectation in information governance. Credentials make it enforceable at the point of the request rather than a rule people are asked to remember.
Same clinical question — "is this safe to dispense?" — answered two different ways.
Access-based — open the record
Whoever is logged in can see far more than the question needed, and the patient finds out afterwards, if at all.
Proof-based — answer the question
Two fields, a stated purpose, an expiry, and an audit entry the patient can read.
The same pattern answers questions without releasing any record at all: "is this person over 18?", "are they exempt from prescription charges?", "are they on this care pathway?" — each provable as a single yes, without disclosing the underlying data.
When the thing asking is an AI agent
Care navigation, triage support and admin automation all point the same way: software will start making requests on a person's behalf. An agent cannot be "logged in as the patient" — that collapses the audit trail and makes consent meaningless. It needs its own identifier, a mandate showing who delegated what, and a grant that is scoped and revocable like any other.
The console already runs this end to end on open protocols: agents exchanging signed messages, credential-gated decisions, wallet-signed mandates that bind an agent to exactly what it was authorised to do, and machine-verifiable responses. Same primitives, different domain — worth seeing before designing agent access to a health record.
What this page is not
- Not an NHS product, and not affiliated with or endorsed by NHS England. For the programme itself, read the NHS England Single Patient Record page.
- Not clinical advice, and not a description of how any specific trust or supplier has implemented access control.
- No real patient data anywhere in this app. The walkthrough is a fictional scenario running entirely in your browser, and the console issues clearly-labelled demo credentials.
- Not a claim that credentials are the only answer. They address identity, authority and consent — not data quality, interoperable clinical coding, or the governance work around either.