Migrating from CIS1 to CIS2
Learn what’s involved in migrating your organisation’s applications and users from CIS1 to CIS2 authentication.
Overview
Care Identity Service (CIS) has two major versions of its authentication component:
- CIS1 Authentication is limited to smartcards and only works on the Health and Social Care Network (HSCN)
- CIS2 Authentication supports a range of authenticators and also works over the internet
CIS1 Authentication is deprecated and scheduled for retirement by the end of February 2027.
This page explains what’s involved for end user organisations to migrate from CIS1 to CIS2 authentication.
1. Migrate applications
All NHS applications and digital services are already migrated to CIS2 Authentication.
We are working with third-party software suppliers to migrate their applications from CIS1 to CIS2 authentication.
All third-party applications will be migrated before CIS1 Authentication is retired, and your supplier should be in touch with details when they are ready to migrate.
See the migration status of third-party applications that use CIS.
Read guidance for developers on migrating applications to CIS2 Authentication.
Prescribing applications
Applications that allow healthcare workers to prescribe medications via the Electronic Prescription Service (EPS) use CIS to digitally sign prescriptions.
These applications need to complete an additional migration to our Digital Signature Service, which is aligned with CIS2 Authentication.
Again, your supplier should be in touch with details when they are ready to migrate.
No action required
You will not need to make any changes at this point. Users can continue to use their existing smartcards, smartcard readers and client software.
2. Adopt other authenticators
Once your applications have been migrated to CIS2 Authentication, you can consider moving your users to non-smartcard authenticators. Benefits include:
- easier registration for users
- no more smartcard renewals or replacements
- supports a wider range of devices, such as iPads
- removes the need to install and manage software on Windows devices
You could choose to issue alternative authenticators to:
- all users (recommended)
- new users only (less work)
You do not have to wait
As soon as an application has migrated to CIS2 Authentication, you can start using alternative authenticators. You do not have to wait for all a user's applications to be migrated. They will still need their smartcard for applications that still use CIS1 Authentication.
3. Migrate to Smartcard Connect
If some of your users still use smartcards, you should consider migrating your client software from Identity Agent to Smartcard Connect.
Smartcard Connect has the following benefits:
- can be used over the internet, not just over HSCN
- works with modern browsers such as Edge and Chrome without needing IE compatibility mode
- users do not need to keep their smartcard inserted all the time
Migrate all applications to CIS2 first
Smartcard Connect only works with CIS2 Authentication, not CIS1 Authentication. You can only move users to Smartcard Connect once all your applications have migrated to CIS2.
Smartcard Connect does work with CIS1 for signing prescriptions. Prescribing applications do not need to be migrated to Digital Signature Service before you move your users to Smartcard Connect.
Series 10 smartcards
Series 10 smartcards are only compatible with Smartcard Connect, not the Identity Agent. You'll need to migrate to Smartcard Connect before you can use these new cards.
4. Consider whether you still need HSCN
Once all your applications are migrated to CIS2 Authentication and you have either migrated away from smartcards or are using NHS Smartcard Connect, you no longer need HSCN to use CIS.
This might mean you no longer need to maintain an HSCN connection. However, you might still need it for other uses, so be sure to check before decommissioning it.
Last edited: 20 April 2026 10:03 am