Assurance process for APIs and services

Some APIs and services require you to confirm your product’s purpose. You’ll need to give us details of your product and what it does.

Check the documentation in the API and integration catalogue to see if this applies to you. 

The Organisation Data Service (ODS) holds details of all healthcare organisations, including developers. Each one has a unique ODS code, also known as an Application Service Provider (ASP) code.

During the assurance process, your ODS code identifies you either as a developer of a commercial product or as an end user organisation (EUO) developing a product in house.

If you don’t know your ODS code, you can:

• search for it by organisation name or location using the ODS Data Search and Export (DSE) Service
• apply for a new ODS code

Some NHS APIs can be accessed only via the Health and Social Care Network (HSCN), not the internet. Others are internet-accessible but still require HSCN for NHS smartcard access.

In these cases, you’ll need an HSCN connection for:

• integration testing

• production use (if you're also an end user organisation)

Check the API specification in our API and integration catalogue to see if HSCN is required.

To ensure data is handled securely you must complete the Data and Security Protection Toolkit.

When completing the Toolkit, select your organisation type:

• NHS business partner: if your system regularly processes patient data (for example a GP system)

• Company: if your software only has technical access (for example middleware)

As a developer of healthcare software, you must have a clinical risk management process that conforms to the DCB0129 standard.

As an end user organisation, you must have a clinical risk management process that conforms to the DCB0160 standard.

Some APIs provide a hazard log for you to review and integrate into your own risk log.

For details on how to do this for a particular API, read its API specification in our API and integration catalogue.

Find out if your product is classed as a medical device. If it is, you must meet legal requirements.

For more details see Medical devices: software applications (apps).

• Product assurance
  To ensure conformance, you may be required to demonstrate functional and non-functional testing to verify that your product aligns with the API specifications.
  In certain instances, a risk-based approach will be applied, requiring the submission of identified risks along with their mitigations and supporting test evidence
• Penetration testing
  Prior to deployment, most of our APIs mandate that the connecting system undergoes appropriate penetration testing.
  Instructions for conducting this testing are outlined in the published specifications for each API, available in our API and integration catalogue.

Sign up with the NHS service desk to get updates and raise live incidents. You’ll need to do this for each API you use.

To register for incident management:

1. Make sure you have an ODS code (see step 2).
2. Register with the National Service Desk Customer Portal.

Once all the steps are complete, we’ll email your legal signatory with a link to the National Service Desk Customer Portal to review and accept the agreement.

The connection agreement terms are available for review at any stage during the onboarding process. It is strongly recommended that these terms are reviewed early, including the standard terms applicable to all NHS England services, Appendix 1A outlining the 'end user organisation acceptable use policy', and Appendix 2A specifying 'data processing special terms' where applicable.

• Acceptable use policy
  Appendix 1A of the connection agreement is the ‘end user organisation acceptable use policy’. You must issue it to each end user organisation that will use your product. It sets out their obligations in using your product.
  If you are an end user organisation developing software for your own use, this policy applies to your own organisation.
• Production access
  You need to request production access for each end user organisation that uses your product. For details on how to do this for a particular API, read its API specification in our API and integration catalogue.