NHS FHIR R4 APIs — UK Overview
This guide covers the main NHS FHIR R4 APIs available for HealthTech developers in the UK. Always check NHS Digital (now NHS England Digital) documentation for current API versions and onboarding requirements.
| API | Purpose | Access Level | Onboarding |
|---|---|---|---|
| NHS Login (OIDC) | Patient identity and authentication | P5 (basic) / P9 (high assurance) | NHS Login onboarding (Developer portal) |
| Personal Demographics Service (PDS) | Patient demographic lookup by NHS Number | HSCN + Smartcard or NHS Login | NHS Digital API catalogue |
| GP Connect - Foundations | Patient lookup + appointment management | HSCN + Spine Smartcard | NHS England GP Connect onboarding |
| GP Connect - Access Record | Read patient GP clinical record (FHIR R4) | HSCN + clinical system Smartcard | NHS England GP Connect + clinical system IG |
| GP Connect - Send Document | Send structured documents to GP systems | HSCN + Smartcard | NHS England GP Connect onboarding |
| NHS e-Referral Service (eRS) | Electronic referrals between care settings | HSCN + Smartcard | NHS England eRS onboarding |
| Electronic Prescription Service (EPS) | Electronic prescribing and dispensing | HSCN + Smartcard (prescribers) | NHS BSA EPS onboarding |
| NHS App / NHS Login API | Patient-facing national health app integration | OAuth 2.0 + NHS Login | NHS England App integration programme |
UK Core FHIR R4 — Key Resource Profiles
| FHIR Resource | UK Core Profile | Key UK-Specific Requirements |
|---|---|---|
| Patient | UKCore-Patient | NHS Number (official identifier), UK address format (UPRN/postcode), NHS Data Dictionary ethnic categories |
| Practitioner | UKCore-Practitioner | GMC/NMC/GPhC registration number, SDS user ID for NHS authentication |
| Observation (vital signs) | UKCore-Observation | SNOMED CT UK Drug Extension codes for vital sign types, UCum units |
| MedicationRequest | UKCore-MedicationRequest | dm+d (NHS Dictionary of Medicines and Devices) codes mandatory, EPS token for electronic prescribing |
| ServiceRequest (Referral) | UKCore-ServiceRequest | NHS e-RS priority codes (Routine/Urgent/Two Week Wait), SNOMED CT UK for specialty |
| DiagnosticReport | UKCore-DiagnosticReport | SNOMED CT UK for report type, LOINC codes for lab tests where applicable |
DTAC Domain 4 — Interoperability Requirements
UK Core FHIR R4 compliance: all APIs using FHIR must use UK Core profiles (not vanilla FHIR R4 profiles).
SNOMED CT UK: clinical coding must use SNOMED CT UK Edition (not SNOMED CT International alone).
NHS Number: patient identity must use NHS Number as the primary identifier.
HL7 messaging: if using HL7 v2 (legacy), must use NHS-approved message types and segments.
FHIR Capability Statement: servers must publish a /metadata endpoint with capability declaration.
OpenAPI 3.0: non-FHIR APIs must have OpenAPI 3.0 documentation.
DTAC Domain 4 assesses whether the digital health solution uses open standards for data exchange. Key evidence requirements:
UK GDPR Article 9 and FHIR R4
Lawful basis: public task (Article 9(2)(h)) for NHS commissioned services; explicit consent for non-NHS patient-facing applications.
Data minimisation: FHIR API calls should request only the FHIR resources and fields genuinely needed — not full patient records when a single observation is required.
Access audit: every FHIR API call must be logged with the clinical user identity, patient NHS Number, and timestamp.
NHS Number is special category data: treat as equivalent to health data for security purposes.
All NHS FHIR R4 data is special category health data under UK GDPR Article 9. Key architecture implications: