Skip to content

Eligibility and Registration

Public NHS guidance states that users must be aged 13 or over and registered with a GP surgery in England to use an NHS account or the NHS App. NHS App help for managing services for others separately states that a person aged 13 or over can access their own services in the NHS App when registered with a GP surgery in England or the Isle of Man.

That public baseline is central to the Defence Primary Healthcare (DPHC) question. It establishes the ordinary NHS App account route, but it does not answer whether a MOD DPHC Firmbase practice, Defence Global Practice, or DPHC Overseas [DPHC(O)] registration is treated as the relevant GP surgery context for NHS App purposes.

Official NHS England Digital material now confirms that Primary Care Registration Management (PCRM), the back-end service that manages formal GP-registration changes in Personal Demographics Service (PDS), has a stated service scope that includes Defence Medical Services (DMS). This is direct registration-infrastructure evidence, but it does not identify a named DPHC practice configuration or prove NHS App access for a DPHC cohort.

Project-owner direction reports that the patient-facing registered GP practice value uses the civilianised Medical Centre name and address. Treat that as a display baseline to confirm during cohort testing, not as proof that the registration context is equivalent to an ordinary NHS GP practice or that GP-linked services are enabled.

Use Registration State Model to classify the patient and Guidance Decision Model to apply the resulting guidance status.

Dimensional Eligibility Classifier

Apply the Registration State Model as a set of dimensions. Do not decide eligibility from a single label such as DPHC patient, minor, or dependant.

Dimension Eligibility use DPHC test
Registration context Establish whether the baseline is ordinary NHS GP, DPHC Firmbase, DPHC(O) / Defence Global Practice, or unknown. Do Primary Care Registration Management (PCRM) and Personal Demographics Service (PDS) show a registered GP context that NHS App, NHS account, GP Connect PFS, Interface Mechanism 1 (IM1), and other GP-linked routes can use?
Transition state Separate steady-state registration from joining DPHC, leaving DPHC, overseas posting, or returning from DPHC(O). Does PCRM complete the intended registration change, does the GP record transfer, and does NHS App access continue, pause, change, or restore?
Age band Apply under-13, 13-to-15, 16+, and adult account / proxy rules. Can the relevant DPHC practice perform the ordinary GP-surgery setup, capacity, consent, and age-review steps?
Access mode Separate own access from parent / guardian proxy, adult proxy, linked profile, or informal account sharing. Is the user acting through an accepted NHS App route, and are the requested services enabled for that access mode?
Family / proxy relationship Test same-practice, split ordinary NHS GP / DPHC practice, dependant ordinary NHS GP registration, and dependant DPHC registration. Does the same-GP-practice rule, dependant's own registration, and proxy relationship permit the linked-profile route?

If any dimension is unknown, keep the relevant Guidance Decision Model row at Not evidenced or Conditional rather than generalising from the ordinary NHS baseline.

Access-Mode Gates Across Adoption Phases

Apply the access-mode gate to every phase, not only to CORTISONE. A source can support a patient's own access without supporting parent / guardian proxy, adult proxy, linked profile, or split-registration family access.

Phase / route Access-mode gate Why it matters
Phase 0 initial provision Own access, parent / guardian proxy, adult proxy, linked profile, and invalid account sharing must be separated before deciding eligibility. Prevents NHS App account eligibility from being mistaken for service access on behalf of someone else.
Phase 1 Secondary healthcare (SHC) appointments Provider appointment visibility must be checked for the relevant age band and proxy / linked-profile mode. Hospital appointment evidence may not carry the same proxy behaviour as GP-practice proxy routes.
Phase 2 Defence Medical Information Capability Programme (DMICP) Primary healthcare (PHC) appointment visibility Read-only appointment display must state whose appointment is displayed and under which proxy or linked-profile permission. A CORTISONE or DMICP feed would still need NHS App account, patient matching, and proxy display rules.
Phase 3 DMICP PHC appointment management Booking, cancellation, rescheduling, and change requests need action-specific permissions by age and proxy relationship. Viewing an appointment does not prove permission to alter the appointment book.
Phase 4 clinical correspondence Document display must identify whether the route is a provider document, Patient Engagement Portal (PEP) document, or GP-filed document view and whether proxy display is permitted. Ordinary proxy access is feature-limited; not every service visible to the patient is visible to a proxy.
Phase 5 test results Result display must identify GP-filed result, provider results system, or PEP results-release route and clinical release controls. Test results may have stricter timing, review, suppression, and proxy restrictions than documents.
Phase 6 CORTISONE patient data CORTISONE source, identity, integration, NHS-facing route, and permission propagation must be tested together. Product or identity matching evidence cannot replace NHS App proxy and age controls.

Minors

The public NHS sources separate child access from adult access:

  • Children under 13 are not in the public own-account baseline for NHS App access.
  • Before age 11, parents and guardians usually control access to the child's record and online GP services.
  • From age 11 to 16, parent or guardian proxy access depends on GP surgery approval, safeguarding checks, capacity, and consent where the child can understand and decide.
  • At age 13, a young person can get access to their own GP online services through the NHS App or another app if the GP surgery sets this up and checks that the young person can understand and keep the information safe.
  • At age 16, the young person is treated as an adult for proxy-access purposes; parent or guardian access usually ends unless adult proxy access is set up or capacity rules apply.

The 2024 Armed Forces Covenant annual report records an NHS App appointment-booking access issue for children under 13 registered with Defence Medical Services for primary healthcare. Treat that as a direct, narrow DMS / DPHC minor-access signal, not as proof of all minor, adult, dependant, or proxy outcomes.

Dependants

Public NHS App sources do not define "dependant" as a standalone NHS App eligibility category. The current NHS-source implication is that each dependant's access depends on that person's own GP registration, age, account state, and proxy / linked-profile configuration. Do not infer that a service person's DPHC registration automatically governs, enables, or blocks a dependant's NHS App access without direct MOD or NHS operational evidence.

The same-practice rule for proxy access is a key dependant question: NHS England Digital guidance for GP practice staff says the family member or carer and the person they care for must both be registered at the same GP practice for NHS App proxy access through this route. That may matter where a service person is registered with DPHC and a dependant is registered with an ordinary NHS GP practice, or vice versa.

Registration Questions

Question Why it matters Current evidence
Is the patient registered with an ordinary NHS GP practice, a DPHC Firmbase practice, Defence Global Practice / DPHC(O), or another arrangement? NHS App GP-linked features route through registered GP context. Public NHS eligibility sources establish the ordinary age and GP registration baseline but not DPHC equivalence.
Is the patient a child under 13, a 13-to-15-year-old with own access, a 16+ patient, or an adult? NHS sources apply different account, consent, capacity, and proxy rules by age band. Public NHS and NHS England sources define child/proxy age bands and GP surgery setup checks.
Is access being requested by the patient directly, or through a linked profile / proxy route? Proxy access is configured by the GP practice and may expose fewer services than the patient's own profile. NHS England Digital staff guidance defines GP practice setup, same-practice requirement, selectable services, and unavailable services.
Does PCRM complete the intended registration change, and does the resulting PDS record contain a GP practice and Organisation Data Service (ODS) code usable by NHS App flows? PCRM manages the formal registration change; PDS and ODS determine patient and organisation routing; GP2GP record transfer remains a separate outcome. PCRM's official scope includes DMS, but the service, PDS, and ODS pages do not define named DPHC practice configuration or NHS App behaviour.
Is the GP clinical system onboarded for GP Connect Patient Facing APIs and configured for the relevant patient or proxy user? GP record, prescription, and permission features may depend on GP Connect PFS and local GP-system configuration. GP Connect PFS source pages define APIs, not DPHC onboarding or proxy configuration.

Do not treat ordinary NHS GP registration, DPHC Firmbase registration, and DPHC(O) registration as equivalent without direct source evidence.