Choosing checks that match the request

Identity checks should be proportionate: ask only what is needed to be confident you are dealing with the right person, the right record and the right authority for the task.

Start with the task

Decide what the caller or patient wants before choosing checks. Booking an appointment, sharing confidential information, changing contact details, requesting a prescription, enquiring about another person, accessing an online record or passing on safeguarding information have different risks and require different levels of assurance.

Some requests need only basic confirmation; others should be paused until stronger checks are completed or a supervisor is involved. For example, changing a phone number can affect future safe contact, so do not treat it as a routine update if you are not confident the caller is the patient.

Common identifiers

• Name and date of birth: useful but often not enough on their own.
• Address or postcode: may be known by family members, neighbours or former partners.
• Registered phone number or email: useful for call-back but may not be safe in every situation.
• NHS number: helpful where available, but many patients will not know it.
• Local security questions or documents: use only where the practice procedure requires them.

Avoid unsafe shortcuts

Do not collect unnecessary information. Do not read a detail from the screen and lead the caller to guess it. Do not correct a wrong answer by revealing the correct detail. If the person cannot complete the check, use the approved alternative route.

Minimum necessary

The safest identity check is the one that matches the sensitivity and risk of the request.