News - week commencing 09 March 2026

To support progress on the new NHS e-RS Advice and Guidance service, the ERS INT environment will be used daily from Monday 9 March for an initial period of one month, with the option to extend. This may include code releases where required, which could be deployed at any time and may result in periods of unavailability. As all functionality will be deployed behind a feature flag, no user‑facing changes are expected.

This is formal communications which needs to be read, understood and responded to where necessary.  

As you are probably aware, the NHS England Medium Term Planning Framework states that trusts are to move toward the e-Referral Service (e-RS) being used for all Advice and Guidance requests from primary care, with effect from July 2026, where these requests are managed within the e-RS user interface, and from October 2026 where a third-party service is used.

We will work with regions and providers to ensure rapid but manageable roll-out supported by appropriate platforms, including improvements to the
functionality of e-RS. e-RS in this context means either the web / professional application or e-RS APIs and we understand that the timelines in the guidance only applies to GP practices, although we expect future expansion to other primary services such as dental and optometry as e-RS uptake increases and functionally continues to develop.   

To support the focus on A&G we, the Referrals and Appointments Team, will be launching a new A&G web interface and new API endpoints from April this year.  These endpoints will provide additional functionality for both referrers and providers.  More detail on these endpoints and further policy information will be made available soon. 

At this stage we are just looking to identify which of our API partners (be they trusts or 3^rd party suppliers) are likely to be impacted by the change in A&G policy so that we can work closely with you to ensure a smooth transition.  To help with this we will be setting up some webinars, later in February, to tell you more about the new functionality and to do our best to answer any questions regarding the policy and next steps.

Please can you respond saying whether you are impacted by this guidance and, if so, provide a contact name and email address for further discussions.  Please also feel free to ask any questions about the guidance you have at this stage.

As part of the national focus on cyber security through software and hardware currency, IAM is taking steps to permanently block the use of unsupported Identity Agent software and legacy smartcards.

More information is available on the following page, which includes Production dates, and details on supported Identity Agent and smartcard versions.

https://digital.nhs.uk/services/care-identity-service/releases-and-planned-maintenance/service-deprecation-and-retirement/software-and-hardware-retirement

From 15 December 2025 - unsupported Identity Agent advisories

Authentication using any unsupported version of Identity Agent will receive the following advisory:

“You are using a retired version of Identity Agent and are at risk of smartcard authentication being blocked.
Please contact your IT teams to ensure you have the latest Identity Agent.

Find out more?”

The advisory will provide a link to further information, including supported Identity Agent versions and planned dates for Production (the link above).

30 January 2026 - unsupported Identity Agents and legacy smartcards blocked

Authentication using any unsupported version of Identity Agent or legacy smartcard will be blocked, with one of the following messages:

“This smartcard version is now blocked from authenticating”

“This Identity Agent version is now blocked from authenticating”

The user will need to update their Identity Agent and / or smartcard version to regain the ability to authenticate in PTL.

We have some upcoming changes planned related to e-RS file attachments.  Whilst we acknowledge it isn’t ideal sending this communication out so close to Christmas, we felt our partners would want as much notice as possible of any planned changes. 

We’d also like to take this opportunity to thank our partners for working with us this year and hope that you all manage to get some down time and have a lovely Christmas and New Year.

Find out about upcoming changes to file attachments and its impact to the NHS e-Referral Service FHIR API:

What we're doing and why

The file attachments work includes:

• an increase of the file size limit
• a switch to direct file upload and download
• the introduction of malware scanning

Release 1 of the file attachment project was implemented earlier this year.

We introduced a new direct file download endpoint, Retrieve attachment (A042, FHIR R4), and added API responses to include the file availability status (AVAILABLE only), the user who attached the file and the organisation from which the file was attached.

In Release 2, the e-Referral Service will start to:

• process files asynchronously
• validate and scan files for malware
• send all file availability statuses

Who will be affected

All partners integrated with the Retrieve attachment (A006, FHIR STU3) API endpoint.

What this means for your solution

Asynchronous processing means that an uploaded file may not always be ready for download immediately.

Files will only be available after processing is complete, validation passes, and no threats are detected.

Release 2 will start to send all file availability statuses:

1. AVAILABLE - the file is available for download.
2. PENDING - the file is being scanned and cannot be retrieved.
3. VALIDATION_FAILED - the file has failed validation and cannot be retrieved.
4. THREATS_FOUND - the file has been quarantined after detecting a threat and cannot be retrieved.

Partner software must be able to deal with scenarios where an attachment is not available.

What you need to do

1. Review and understand file attachments
2. Support attachments that are not available for download
3. Enable the download of large file attachments

1. Review and understand file attachments

Find out why are are making changes to file attachments in e-RS, it's impact on our API and the full release plan.

2. Support attachments that are not available for download

Learn how to implement changes to your software to allow for the new asynchronous and malware scan processes.

3. Enable the download of large file attachments

Learn how to integrate your software with the new Retrieve attachment (A042, FHIR R4) download endpoint to support large file downloads.

Release schedule summary

Release plan

Release 1

Release 1 went live on 18 February 2025.

It included the introduction of:

• a new download endpoint - Retrieve attachment (A042, FHIR R4)
• a deprecation notice for the current download endpoint - Retrieve attachment (A006, FHIR STU3)
• file availability status in the existing API endpoints
• updated API documentation
• new sandbox examples

Release 1 was a non-breaking change but allowed partners to prepare for future breaking releases.

The guidance for partners is to modify their software to:

1. Support attachments that are not available for download
2. Enable the download of large file attachments

Release 2

Release 2 is a breaking change.

It introduces a change to start sending all file availability states in the API responses.

Partners must implement changes in their software to minimise impact to their software, and:

• support attachments that are not available for download
• enable the download of large file attachments

This change will be available for partner testing, in the INT environment, from 01 March 2026 (subject to final testing).

The production release is on 08 May 2026 (subject to final testing).

Release 3

Release 3 is a non-breaking change.

Partners wishing to leverage their software should enable the upload of large file attachments.

The changes in Release 3 includes the introduction of:

• a new upload endpoint - Upload file to document store (A039, FHIR R4)
• a deprecation notice for the existing upload endpoint - Upload file to document store (A020, FHIR STU3)
• updated API documentation

This change will be available for partner testing, in the INT environment, from 08 May 2026 (subject to final testing).

The production release is on 03 July 2026 (subject to final testing).

Release 4

Release 4 is a breaking change.

It will increase the maximum supported file size limit to 100MB. Legacy upload and download API endpoints will remain limited to 5MB.

Partners must implement changes in their software to enable the download of large file attachments and leverage the upload of file attachments.

This change will be available for partner testing, in the INT environment, from 10 June 2026 (subject to final testing).

The production release is on 31 July 2026 (subject to final testing).