Skip to content

Linked Profiles and Proxy Access

NHS App proxy access lets a person manage selected health services for someone else through their own NHS App account. Current NHS guidance calls this family and carer access; linked profiles and proxy access describe the same arrangement.

Linked profiles are especially relevant for Defence Primary Healthcare (DPHC) because armed-forces patient groups may include dependants, children, DPHC Overseas [DPHC(O)] families, and patients whose registration status changes with postings.

Use Registration State Model to separate own access, parent / guardian proxy, adult proxy, linked profile, same-practice, and split-practice states before applying Guidance Decision Model.

Implications for first-stage delivery

The 21 September 2026 review confirms that ordinary NHS proxy guidance does not establish a route around the current Defence Medical Services (DMS) access exclusion. The project-owner registration baseline remains the proposed patient scope; NHS England agreement and service tests are still needed before access can be offered.

For the initial patient groups, distinguish three outcomes:

  • Own access: test adult access separately from access for 13-to-15-year-olds, who need GP practice setup. Children under 13 cannot use their own NHS App account under the public eligibility rules. NHS App eligibility.
  • Family and carer access: test each permitted service through a formally approved profile. Current guidance does not allow carers to manage hospital appointments or specialist referrals, or to send or view messages in the cared-for profile. Family relationships and shared NHS England registration do not establish the required same-practice setup. NHS practice guidance.
  • Support: agree who resolves practice configuration, identity/sign-in and App feature problems. Staff can raise NHS support requests for patients with their consent. Keep a usable alternative when a patient cannot obtain access. NHS support responsibilities.

Overseas testing should include sign-in after a change of phone number and receipt of security codes abroad. These are practical support checks, not evidence of overseas eligibility. NHS login troubleshooting.

Record outcomes in the existing Evidence Validation Queue. This review does not select an initial cohort or establish MOD proxy availability.

Dimensional Proxy Classifier

Use this classifier before making any linked-profile or proxy claim for a DPHC cohort.

Dimension What to classify Proxy / linked-profile effect
Registration context Ordinary NHS GP, DPHC Firmbase, DPHC(O) / Defence Global Practice, or unknown for both the proxy user and the cared-for person. Determines whether both parties sit inside the same GP-practice setup route or a split ordinary NHS GP / DPHC route.
Transition state Whether either party is joining DPHC, leaving DPHC, overseas, returning from DPHC(O), or steady state. Proxy links may need review after registration changes, postings, or restoration to ordinary NHS GP registration.
Age band Under 13, 13 to 15, 16+, or adult for the cared-for person. Controls own-access exclusion, child proxy review, 13+ own-access setup, and 16+ adult/proxy transition.
Access mode Parent / guardian proxy, adult proxy, linked profile, self access, or invalid informal sharing. Determines which services may be visible and whether the action is auditable and revocable.
Family / proxy relationship Same GP practice, split ordinary NHS GP / DPHC practice, dependant ordinary NHS GP registration, dependant DPHC registration, carer/proxy relationship, or unknown. Tests the same-practice rule, dependant's own eligibility, and whether the linked profile can be configured.

Record separate outcomes for the proxy user and the cared-for person. A dependant's ordinary NHS GP registration can support that dependant's own access without proving a proxy route for a DPHC-registered parent, carer, or service person.

Practice Setup and Feature Limits

NHS England Digital guidance for GP practice staff describes proxy access as a GP-practice-managed route. The practice assesses the request, obtains consent where appropriate, links profiles in the GP IT system, and chooses which services the proxy can access. Some practices are trialling applications through the NHS App; practice approval and permission setting are still required.

The proxy route is not a full duplicate of the cared-for person's own NHS App experience. The reviewed NHS England Digital guidance says a GP practice can grant proxy access for services such as appointment booking, repeat prescriptions, and GP information, but not all NHS App services are available through proxy access. It identifies hospital services such as outpatient appointments and specialist referrals, nominated-pharmacy changes, and messages from the cared-for person's profile as unavailable through this proxy route.

NHS England guidance also distinguishes formal proxy access from informal account sharing. Formal proxy access uses the proxy user's own credentials, can be tailored, leaves an audit trail, and can be withdrawn separately. Informal sharing of login details is a security and confidentiality risk and should not be treated as an acceptable linked-profile model.

Minors

The public NHS minor-access model is age-banded:

  • Before age 11, parents and guardians usually control access to the child's record and online GP services.
  • From age 11 to 16, parent or guardian proxy access may continue if the GP surgery agrees, with capacity, consent, and safeguarding checks where relevant.
  • Many GP surgeries use an automatic proxy-access cutoff between ages 11 and 14 to protect confidentiality, so access may need review before age milestones.
  • From age 13, the young person can have their own NHS App or other online access to GP services if the GP surgery sets this up and checks understanding.
  • At age 16, parent or guardian access usually ends; adult proxy access can be set up separately where the patient chooses it or capacity rules apply.

The 2024 Armed Forces Covenant annual report records an NHS App appointment-booking issue for children under 13 registered with Defence Medical Services for primary healthcare. That issue should be tracked as a DMS / DPHC minor-access case. It does not resolve the broader linked-profile rules for older children, adults, dependants, or DPHC(O) cohorts.

Dependants

The current official NHS App sources do not treat "dependant" as a separate eligibility rule. For this wiki, dependant analysis should start with the dependant's own registration and age, then test whether a proxy relationship is possible.

The same-GP-practice requirement is the most immediate proxy-access constraint to validate for armed-forces families. NHS England Digital states that the family member or carer and the person they care for must both be registered at the same GP practice for this NHS App proxy route. That creates a concrete question for families split between ordinary NHS GP registration and DPHC Firmbase or DPHC(O) registration.

CORTISONE-Enabled Route Implications

A CORTISONE-enabled route would not bypass NHS App proxy, linked-profile, age, or same-practice controls. Treat CORTISONE as a possible source, record, identity, or integration layer until an NHS-facing route and access-mode behaviour are proven.

For any CORTISONE / InterSystems route, classify these items before making a proxy or linked-profile claim:

CORTISONE route question Why it matters for proxy / linked profile Evidence needed
Does the route expose the cared-for person's record or only the proxy user's own record? Prevents a service person's NHS App access from being mistaken for dependant or child access. Feature test with separate proxy-user and cared-for-person accounts.
Does the route depend on same-practice GP proxy setup? Split ordinary NHS GP / DPHC family registration may fail even if CORTISONE can match identities. GP-practice setup rule, supplier behaviour, and linked-profile configuration evidence.
Does Enterprise Master Patient Index (EMPI) matching change or replace NHS App proxy controls? EMPI can help identity resolution, but it is not evidence of NHS account, Personal Demographics Service (PDS), consent, or proxy permission semantics unless a source says so. Architecture or assurance evidence describing EMPI-to-PDS, NHS account, and proxy-permission relationships.
Does a minor's data appear through own access or parent / guardian proxy? Under-13 own access remains outside the ordinary public baseline, and 13-to-15 access depends on GP setup and capacity / consent checks. Age-banded feature tests, proxy review rules, and clinical / safeguarding controls.
Does the route expose appointment management or read-only visibility? Proxy permission for viewing an appointment is not the same as permission to book, cancel, reschedule, or change it. Action-specific permission, write-back, audit, conflict, and fallback evidence.
Does the route expose documents, results, or messages? Proxy availability varies by service; ordinary NHS proxy evidence says not all NHS App services are available through proxy access. Service-specific permission list and NHS App / linked-profile display test.

For dependants, test the dependant's own registration and age first. For minors, do not treat CORTISONE source data as a route around own-access limits. For linked profiles, require proof that a CORTISONE-enabled route can carry formal permissions without credential sharing and without assuming same-practice equivalence across split registration states.

DPHC Questions

Scenario Question
Child under 13 registered with DMS / DPHC primary healthcare Is the appointment-booking issue recorded in the 2024 annual report resolved, and was the root cause age, registration, GP-system setup, proxy setup, or another NHS App configuration?
Young person aged 13 to 15 registered with DPHC Can the young person obtain own NHS App / GP online access after GP surgery setup and understanding checks, and does DPHC registration change that route?
Parent or guardian managing a child record Does the GP practice configuration support proxy access, age milestone review, and consent / safeguarding checks for DPHC-registered children?
Dependant registered with an ordinary NHS GP but service person registered with DPHC Does the same-GP-practice proxy rule prevent linked-profile access across split registration models?
Dependant registered with DPHC but parent / carer registered with an ordinary NHS GP Does NHS App proxy access require both parties to be registered with the DPHC practice or the same ordinary NHS GP practice?
DPHC(O) posting Does Defence Global Practice or DPHC(O) registration support NHS App profile linking, age milestone review, and proxy setup?

Do not assume linked profiles or family access resolves DPHC edge cases. The public NHS sources define the ordinary proxy model; they do not prove MOD cohort behaviour.