CIS2 Authentication

CIS2 Authentication is the modern identity and access service within NHS Care Identity Service 2 that enables health and care professionals in England to securely access clinical systems, patient information, and other NHS services. As a core component of NHS Care Identity Service 2, CIS2 Authentication supports the NHS’s broader digital transformation strategy by expanding identity and authentication services beyond traditional smartcard-based access to include internet-based authentication options that support security, usability, and interoperability. CIS2 Authentication provides a modern authentication service for NHS and commercial healthcare applications. As an alternative to smartcard-only access, CIS2 Authentication uses the OpenID Connect (OIDC) standard, enabling software providers to connect healthcare applications and national APIs to a secure, standards-based authentication service.

As NHS organizations continue their digital transformation, CIS2 Authentication helps ensure that secure identity verification evolves alongside modern clinical workflows and digital care delivery. Clinicians increasingly expect secure, frictionless access to clinical records, whether they are working at a desktop workstation, a shared device, a mobile device, or via dedicated apps. CIS2 Authentication supports this shift by offering authentication options that can reduce reliance on passwords and traditional smartcard workflows, including biometric authentication through Windows Hello, passkeys, security keys, and other approved authenticators. Depending on the sensitivity of the application, systems can require either an AAL2 assurance level for high-confidence authentication or an AAL3 assurance level for very high-confidence authentication. This flexibility allows healthcare organizations to balance strong security with efficient clinical workflows while expanding cross-platform compatibility across a diverse healthcare technology ecosystem.

CIS2 Authentication works alongside role-based access controls (RBAC) managed through NHS Registration Authorities while supporting multifactor authentication (MFA) to strengthen authorization and governance. Applications that access user-restricted national APIs can leverage nationally managed RBAC assignments to ensure that clinicians only access information appropriate to their assigned roles, supporting auditability and regulatory compliance. Because CIS2 Authentication uses modern identity standards, including OIDC, developers can connect it to new and existing healthcare applications while supporting modern authentication and session-management approaches. These capabilities can help organizations introduce new digital technologies without requiring wholesale replacement of existing clinical infrastructure, making modernization more practical across NHS trusts and integrated care systems.

Imprivata has a long history of supporting NHS organizations with healthcare identity and access management solutions. As CIS2 Authentication and related NHS identity standards continue to evolve, Imprivata remains committed to secure, reliable, and user-friendly approaches to authentication. Imprivata healthcare solutions help organizations reduce login friction, strengthen access security, and provide clinicians with efficient access to the systems they need.