GP Connect, IM1, PDS and NHS login: how to integrate your product with NHS systems (2026)

How to integrate with NHS systems in 2026: GP Connect, IM1, PDS FHIR, NHS login and the NHS App. Onboarding steps, evidence, timelines and changes.

Short answer. To integrate a product with NHS systems in England you choose the right API for the job (GP Connect to view GP records in direct care, IM1 to pair with Optum EMIS Web or TPP SystmOne, PDS FHIR for patient demographics, NHS login for patient sign-in), then pass NHS England's assurance, mostly through the Digital Onboarding Service. Before you apply you need an ODS code, a published DSPT, DCB0129 clinical safety work with a Clinical Safety Officer, a penetration test and a Connection Agreement. NHS login typically takes 3–4 months. In 2025-26, GP Connect closed Update Record, Send Document and Appointment Management to new developers, so check the route before you design around it.

This guide is for product owners and CTOs of healthtech companies planning an NHS integration. It maps the main APIs, the assurance process, the evidence, the timelines that NHS England publishes and the changes that catch suppliers out.

Last checked: 2 November 2026.

This is a general guide for suppliers, not legal or regulatory advice. Magora is a software developer, not your regulatory advisor. NHS integration and assurance rules change often, so check the current NHS England pages linked below before you plan or submit anything.

Which NHS API do you need?

Based on the NHS England API catalogue and service pages, checked 2 November 2026.

GP Connect: what it offers and who can use it

GP Connect connects approved clinical and care systems to GP records for direct care, in settings such as care homes, community and mental health, urgent and emergency care, pharmacies, hospices and social care. It is not for planning or research, and patients cannot use it directly. GP practices and GP system suppliers must provide it; consuming systems are strongly recommended but not usually mandated to use it.

Source: NHS England GP Connect pages, last edited October 2026.

To consume GP Connect you need HSCN access, the ability to search PDS, compliance with the GP Connect information governance model for direct care, local role-based access control and a Clinical Safety Officer for DCB0129. The steps are:

1. Check the prerequisites and submit a use case. NHS England replies within 14 calendar days; you must start development within 6 months of approval.
2. Build to the specification and show evidence against the system demonstrator.
3. Test in the NHS England integration environment against each GP system you will consume.
4. Complete the SCAL; the Solutions Assurance Team issues a Technical Conformance Certificate.
5. Sign the Connection Agreement and data sharing arrangements, and deploy. A First of Type check in live use may be required.

IM1: pairing with GP systems

IM1 lets a third-party product pair with a principal GP system to read patient information, extract bulk data or write data back. The current providers are Optum (EMIS Web) and TPP (SystmOne). There are Patient, Transaction and Bulk APIs; appointment data may only be accessed through GP Connect. The process runs from a prerequisites form and a first-stage SCAL, through a Model Interface Licence with each provider, test phases with each provider, NHS England's assurance and a "Recommended to Connect", to rollout. NHS England publishes no fees for IM1, and says it has no current plans to decommission it.

Note for AI products: changes to a live IM1 integration need a Request for Change, and NHS England names the integration of AI as a case that requires one.

The assurance process, step by step

Every NHS API needs assurance before go-live. Most are now assured online through the Digital Onboarding Service; APIs not yet on it use the offline SCAL spreadsheet. NHS England lists these steps before you apply:

1. Confirm the use case.
2. Get an ODS code for your organisation.
3. Check whether the API needs HSCN.
4. Complete the DSPT. See our DSPT guide.
5. Do the clinical risk management: DCB0129 for you, DCB0160 for the deploying organisation. See our DCB0129 guide.
6. Check whether the product is a medical device.
7. Pass technical and security tests, including a penetration test.
8. Register with the National Service Desk customer portal.
9. Submit and sign the Connection Agreement.
10. Issue the end-user acceptable use policy and request production access for each end-user organisation.

Environments run from an open sandbox to development and integration environments, then production. For user-restricted APIs, staff authenticate through CIS2 and patients through NHS login.

NHS login and the NHS App

• Eligibility: the service must benefit patients registered with an English GP or receiving NHS services in England, be free at the point of delivery, and be commissioned or sponsored by an NHS organisation or local authority. Being on an NHS framework does not count as commissioning on its own.
• Evidence: an in-year DSPT at Standards Met or above, a completed and remediated penetration test, an NHS login-compliant privacy notice, architecture and data-flow diagrams, user journeys and clinical safety documents. Data transfers outside the UK and EEA will not normally be accepted.
• Timeline: typically 3 to 4 months, as little as 6 weeks; NHS England's support is free.
• NHS App: NHS login comes first. Web integration then goes through an expression of interest, product review, quarterly prioritisation, solution design, build and assurance, with limited then full release.

What changed in 2025-26

• GP Connect: no onboarding route for new developers for Update Record, Send Document and Appointment Management.
• EPS: the combined EPS FHIR API is retired; new integrations must use the separate Prescribing and Dispensing APIs.
• e-RS: the HSCN version of the FHIR API is deprecated; use the internet API.
• Authentication: CIS1 is deprecated with no service level; CIS2 works over the internet with smartcards or modern authenticators.
• Internet first: NHS England is working to make all APIs available on the internet.
• DTAC version 2.0 applies from 6 April 2026; see our DTAC guide.
• Organisation: the Health Bill would abolish NHS England and move its functions to the Department of Health and Social Care. Integration pages still say NHS England.

How to plan an NHS integration

1. Confirm the route first. Check eligibility, onboarding status and HSCN needs for every API before you design around it.
2. Start the paperwork early: ODS code, DSPT, CSO, hazard log and penetration test are on the critical path.
3. Prove the hardest integration in a spike against the sandbox before pricing the full build.
4. Design for assurance: audit logs, role-based access, UK hosting and clear data flows make the SCAL straightforward.
5. Plan the timeline around NHS steps you do not control, such as use-case approval, test environment access and conformance review.

At Magora our delivery work uses HL7 FHIR R4, HL7 v2 and GP Connect, with SNOMED CT and dm+d for coding. For the whole picture of NHS requirements, see NHS software compliance: DTAC, DCB0129 and DSPT.

What an NHS-integrated product costs to build

NHS England does not charge for its onboarding support. The cost is the engineering and assurance work. At Magora a single API integration takes 3–5 weeks and starts from £5,000; regulated, integration-heavy health platforms typically cost £80,000–£120,000 over 5–8 months. See how much healthcare software costs in the UK.

Planning an NHS integration? Send us your use case: we will check the route and prerequisites with you, prove the hardest integration in a spike, and build a free working prototype of the core journey in 5–10 working days. More about our healthcare software development.

Frequently asked questions

What is GP Connect?

A national NHS England service that lets approved clinical and care systems in England access GP records for direct care. It includes Access Record (HTML and structured data such as medications, allergies, investigations and immunisations), Send Document, Update Record and Appointment Management. It is not for planning or research, and patients cannot use it directly.

Can a new supplier integrate with GP Connect?

For Access Record, yes: you submit a use case, build to the specification, test against each GP system, complete a SCAL and receive a Technical Conformance Certificate. For Update Record, Send Document and Appointment Management, NHS England says there is no longer an onboarding route for new developers.

What is the difference between GP Connect and IM1?

GP Connect is a national, standards-based service for viewing GP records in direct care. IM1 (Interface Mechanism 1) pairs a third-party product with a specific GP system, Optum (EMIS Web) or TPP (SystmOne), to read, extract or write data, under a Model Interface Licence with each provider.

How long does NHS login integration take?

NHS England says typically 3 to 4 months, and it can be as little as 6 weeks; its support is free of charge. Your service must be commissioned or sponsored by an NHS organisation or local authority in England.

Do I need HSCN to use NHS APIs?

It depends on the API. NHS England's policy is to make all APIs available on the internet, and many already are, such as PDS FHIR. Some, including GP Connect for consumers, still need HSCN access.

What do I need before NHS API assurance?

Typically an ODS code, a published DSPT, DCB0129 clinical safety documentation with a Clinical Safety Officer, a medical device decision, a penetration test, registration on the National Service Desk portal and a signed Connection Agreement. Most APIs are now assured through the Digital Onboarding Service.

Sources

• NHS England: GP Connect
• NHS England: develop GP Connect services
• NHS England: GP Connect Access Record Structured FHIR API
• NHS England: IM1 pairing integration
• NHS England: Personal Demographics Service FHIR API
• NHS England: process for API assurance
• NHS England: Digital Onboarding Service
• NHS England: apply for NHS login
• NHS England: how to integrate with the NHS App
• NHS England: network access for APIs
• NHS England: EPS FHIR Prescribing API