How to recover your NHS App or NHS login account

Open the app or go to the NHS website and try to log in. If you never reach a logged-in screen — the password is rejected, the code does not arrive, or the email address is not recognised — you have a credential fault and everything you need is in the NHS login help centre. Nothing your GP surgery can do will help, because the surgery has no visibility of your login details at all.

If you do reach a logged-in screen but the app is largely empty — no repeat prescriptions, no appointments, no record, no messages — you have a linkage fault. Your NHS login is working; what has failed is the connection between it and your GP surgery's clinical system. NHS login publishes two specific error references for this, CID7023 and CID7029, both of which mean it could not connect you to your surgery's system.

If you can log in and see some things but are blocked from your record, test results or anything containing personal health information, you have a verification fault. NHS login runs three levels of proof: a low level, which is a verified email address and phone number; a medium level, which adds your NHS number, date of birth and the postcode registered with your GP; and a high level, which requires photo ID with a face scan or video, or registration details from your GP surgery's online services.

A fourth possibility is worth ruling out before you start: the app is fine and the device is not. NHS login publishes error references for reset links that were mistyped or already used, and the NHS App can be used through a web browser on any computer, tablet or phone without installing anything. If the browser version works and the installed app does not, the fault is the app or the operating system, not the account.

Write down any error reference you are shown before you close the screen. The CID codes are how NHS login triages the contact form, and quoting one is the difference between a specific answer and a generic reply. CID2011 means there is a problem with the NHS number on the account, which NHS login checks every time you log in; CID2012 means the login has been disabled because the information on it has errors or is being used by someone else; CID2014 means NHS login has itself identified a fault and is working on it.

Finally, be clear about what you are trying to recover. If you only need a prescription today, ring the surgery and ask them to send it to your pharmacy — the app is a convenience, not the only route. Recovery of the account and getting your medicine are two separate problems, and running them in parallel is almost always faster than fixing the account first.

Start the reset from the login screen of whichever service you are using — the NHS App, the NHS website, or any other app that offers "Continue with NHS login". They all reach the same account, so it does not matter which one you use to trigger the reset. NHS login then emails you a reset link, and that link has a time limit of one hour. This is the most common failure in the whole process, because reset emails routinely land in a junk or promotions folder and are found the following morning. If the link no longer works you will see the reference CID2021, which means it has expired — there is no penalty for requesting another, so go back to the service and start again.

Two other reset failures have their own references. CID2022 means the link has already been used and the password has already been changed — try logging in with the new password before requesting anything else. CID2023 means the link is broken, usually because it was typed out by hand or truncated when it was copied. Check that the full web address has been carried across, then try again or request a fresh link.

If the reset email does not arrive at all, the likeliest explanation is that the account is on a different email address from the one you are checking. People frequently set up an NHS login years ago on an old work address or a rarely used account, and the address that receives the reset is the one the account was built on, not the one you use now. If you cannot establish which address it was, treat it as a lost-email problem and read the section below rather than requesting reset after reset.

NHS login sends a six-digit security code to the mobile number registered on the account. If the code simply has not arrived, request it again before doing anything else — re-entering your email address and password generates a fresh code, and a delayed first message is common.

If the phone number itself is gone — the handset was lost or stolen, the number was on a contract you have left, or you have moved abroad — there is a specific route and it is easy to miss. At the security code screen, select "I cannot log in using my mobile phone", then "Change the mobile phone number I use to log in". You can then enter the mobile number you previously used, or, if you no longer remember it, ask NHS login to send a security code to your email address instead and use that.

That email fallback is the important detail. It means you do not need the old handset, the old SIM or the old number in your possession — you need access to the registered email address. In effect, the email address is the master credential on an NHS login account and the phone number is recoverable from it, which is the reverse of what most people assume.

A landline can be registered as well, and it is a genuinely useful safety net for anyone whose mobile signal is poor or whose number changes often. You can add one from Login and security settings under Two-step verification, and if you later cannot use it, the login screen offers "I cannot log in using my landline" with the same options — change the number, or have a security code emailed to you. Removing a landline sends codes back to the mobile number on the account.

If a device you have not signed out of still lets you in — a tablet at home very often does, because a remembered device stops being sent security codes and is only dropped after six months of non-use — change the number there and then rather than later. Go to Login and security settings, then Two-step verification, then Change for mobile phone number. That window closes without warning, and it is far easier than any of the routes above.

This is the hardest lockout, and NHS login's answer to it surprises people: it tells you to create a new account. There is no route that transfers an NHS login from an email address you cannot open to one you can, because the email address is what proves the account is yours.

The published steps are specific. Go to the service you need to use, select "Continue with NHS login", then select "Create an account", and enter a new email address you will not lose access to. Work through the details as though you were setting up for the first time. At the point where NHS login recognises you, it shows the message "You already have an NHS account" — and this is the step that matters, because it looks like a dead end. Select "Continue with my new account" and accept the conditions.

What you are doing is re-establishing your identity against the same NHS record from a new set of credentials. You will normally have to prove who you are again, by photo ID and video or by your GP surgery's online services registration details, which is covered in a later section. That is not a bug in the process; it is the entire point of the process, because the alternative would be a route by which somebody else could claim your health record simply by asserting that they had lost their email.

Do not attempt to work around this by creating a second account on an email address you still use and hoping it will find your record on its own. NHS login is clear that you can only have one NHS account linked to one email address, and only one NHS login can be connected to your GP surgery's system. Two half-built accounts is how people end up with the "You already have an NHS account" error appearing as an obstacle rather than as the merge prompt it is meant to be.

While you are rebuilding, separate two things the app treats as different: your NHS login email address and phone number, which are stored on the account and used to get in, and your NHS contact details, which are what your GP surgery and other NHS services use to contact you. Changing one does not change the other. If your old email address is dead, update both — otherwise appointment reminders and results notifications will keep going to an inbox nobody reads.

There is a delay to expect on the NHS record side. NHS login warns that some services, including your GP surgery, may continue to use your previous contact details while the update propagates. If something time-critical is booked, tell the surgery directly rather than relying on the record catching up.

If the app opens and the health sections are missing or greyed out, your NHS login is fine and the connection to your GP surgery's system is not. NHS login publishes this as CID7023 — it cannot connect to your GP surgery's system, and suggests checking your Login and security settings or contacting support — and CID7029, where it cannot connect NHS login to your GP surgery at all and asks you to make contact so it can find out what is causing the problem.

The most common trigger is a change of practice. The NHS App requires you to be registered with a GP surgery in England, and the app's link is to a specific practice's system. When you move and register somewhere new, the old link stops working and a new one has to be established at the new surgery — and because record transfers between practices are not instantaneous, there is often a window where the app is technically registered nowhere useful.

The second common trigger is duplication. Only one NHS login can be connected to your GP surgery's system, so if a second account has ever been created on a different email address — by you, or by a family member setting things up on your behalf — the surgery's system may be holding the link against the wrong one. That is exactly the situation NHS login describes with the message "You already have an NHS account".

The third is that the practice has not switched the service on, or has withdrawn it from your record. Practices control which online services are available and to whom, and a record can be unlinked at the practice end after a data-quality review, a name change, a safeguarding flag or a merger of the practice itself. None of this is visible from the app, which shows you an empty screen rather than an explanation.

Deal with it at the surgery first. Ask reception, or better the practice manager or the practice's designated online services or digital lead, to check whether your record is linked to online services and at what level of access. Ask specifically whether you are enabled for prescriptions, appointments and detailed coded record access, because these are separate switches and it is normal for one to be on and another off.

If the surgery confirms you are linked at their end and the app still shows nothing, that is when to use the NHS login contact form and quote the CID reference you were shown. NHS login says it will update you by email and that this usually takes two working days, so send the message early rather than waiting to see whether the problem clears overnight.

Recovery frequently ends at an identity check, because rebuilding credentials does not by itself prove you are the person on the record. NHS login offers two routes to the high level of access needed to see health information, and the faster of the two is photo ID with a video.

The documents NHS login lists as acceptable are a passport, a UK driving licence, full or provisional, a UK application registration card, a CitizenCard, a full European driving licence, and a European national identity card. You then record your face so that NHS login can compare it to the photo ID, and you may be asked for extra details such as your date of birth or postcode to locate your NHS record.

It is checked by NHS login and the result comes to you by email. If you do not pass, NHS login sends advice with the email telling you whether to try again and what to do differently — so a failed check is not the end of the route. In practice the recoverable failures are the mechanical ones: poor lighting, a covered face, a glare on the document, a document too worn to read, or a name on the ID that does not match the name on the record.

The second route needs no ID at all. If your GP is in England, you can use three registration details from your surgery's online services: the Linkage Key, which some systems call a Passphrase; the ODS Code, which may appear as the Organisation Code or Practice ID; and the Account ID. Tell the surgery you want to register for their online services and they will ask you to fill in a form. If you were issued them before and no longer have them, you can ask your GP for them again.

There is a catch worth knowing before you rely on this route: the three registration details can be used only once to set up an NHS login. They are also not the same as the email address and password you use to log into your surgery's own online services, which is a distinction that trips people constantly at the reception desk. If you are recovering a second time, expect to have to request a fresh set.

Both routes need your NHS record to be findable, which usually means knowing your NHS number. It is free to get: the NHS runs an online service that asks for your full name, date of birth and the postcode of your GP surgery address, and sends the ten-digit number to you by text, email or letter. You can also read it off any NHS letter — a prescription or an appointment letter — or ask your surgery. Nobody should ever pay a website for it.

There are only three doors, and it is worth knowing what is behind each before you knock. NHS login's own support is reached through the contact form in its help centre, where you can quote the error reference you were given. It replies by email, and says this usually takes two working days. It is the right door for password, security code, email address, verification and CID-coded faults.

Your GP surgery is the right door for anything to do with what the app shows once you are in: linkage, level of online services access, the registration details for the non-ID verification route, and any mismatch between your record and your identity documents. It is also the fastest route to the thing you probably actually need — a prescription issued, an appointment booked — while the account problem is still unresolved.

NHS England's customer contact centre is the third door, on 0300 311 22 33, open 9am to 5pm Monday to Friday except Wednesdays when it opens at 9.30am. It handles enquiries from patients about primary care services — GPs, dentists, opticians and pharmacies — and about services NHS England commissions. It is the escalation to use when a surgery will not engage with an access problem at all, not a technical helpdesk for the app.

If your name, address or other personal details have changed, the change has to be made at the surgery, not in the app. The NHS App lets you update the email address and phone number the NHS uses to contact you, and nothing more; for a name or address change you contact the practice. A mismatch between an updated document and an out-of-date record is a very common reason for a photo ID check to fail.

As a last resort you can delete the NHS login and start again. It is done from Login and security settings, or in the app under More, then Account and settings, then Manage NHS account, and it asks for your password to confirm. Once deleted you cannot use it to access any websites or apps, though you can create a new one afterwards, and any service you used it with can keep information about you in line with its own terms and privacy notice. Only do this if support has told you to, because you will be starting the verification process from the beginning.

Two practical points while you are locked out. First, the NHS App is usable through a web browser without installing anything, so a laptop or a borrowed tablet is a genuine workaround for a device-specific fault. Second, if the lockout began because your phone was lost or stolen, the account is only one of several you will need to secure — treat it as part of a wider clean-up rather than an isolated problem.

None of the above applies uniformly across the United Kingdom, and this is where a great deal of published advice goes wrong. The NHS App is for people aged 13 or over who are registered with a GP surgery in England. If your GP is in Cardiff, Glasgow or Belfast, the app is not the service you are locked out of and NHS login support is not necessarily the body that can help.

Wales runs the NHS Wales App, which at the time of writing is in public beta — live and available to the public but still being developed and tested. It is for people aged 16 or over who are registered with a Welsh GP practice, and it does use NHS login for authentication, so the password and security code routes described above apply. The identity step differs: for the higher level of access you either prove who you are with valid photo ID and a face scan or video, or use the Welsh Identity Verification Service.

Scotland is a genuinely separate system. MyCare.scot is Scotland's health and care service, rolled out nationally from April 2026 with the mobile app reaching the app stores in June 2026, and it currently shows medications and allergies, vaccinations from 2021 onwards, your Community Health Index number and your NHS details, plus a service finder. Access depends on a ScotAccount — the Scottish Government's identity system, verified with photo identification or security questions — so a Scottish lockout is a ScotAccount problem, not an NHS login one.

Northern Ireland splits the problem in two. GP online services there cover booking or changing an appointment and ordering a repeat prescription, and the account is set up from a registration letter you have to ask your practice for in person or by telephone — you cannot request it online. If you lose access, the same route applies: go back to the practice for a new registration letter.

Hospital and community records in Northern Ireland sit in a different service again, My Care, which is accessed with an active nidirect account and covers secondary care only — your GP record is not in it. The My Care helpdesk is on 028 9536 8180 or [email protected]. If the problem is the nidirect account itself, the identity assurance service NIDA verifies you from an uploaded photo ID, supporting evidence and a selfie, with a manual route that must be completed within 30 days if the automated check fails; the account support line is 0300 200 7868, Monday to Friday, 9am to 5pm.

One consequence people miss when they move between the four nations: your app access does not travel with you. Registering with a GP in a different nation means starting again on that nation's service, and there is no mechanism for carrying a verified identity across. Expect a gap, and get any repeat prescription in hand before you move rather than after.

Once you are back in, spend ten minutes on the things that will make a future lockout a five-minute problem rather than a five-week one. Start with the email address, because it is the credential everything else is recovered from. Move the account onto an address you control personally and expect to keep — not a work address, not one tied to an internet provider you might leave.

Add a second way to receive security codes. A landline can be registered alongside the mobile number and is the obvious backstop for anyone whose mobile number changes with their job or their travel. If you later cannot use either, the login screen offers the "I cannot log in" routes for both, with a security code by email as the fallback.

Set up a passkey on more than one device. A passkey is created and stored on the device and unlocked with your fingerprint, face, passcode, PIN or pattern instead of a password; setting one up needs a screen lock on the device and Bluetooth switched on, and you can add one to a second device by scanning a QR code from the first. NHS login is explicit that losing a device does not lock you out — you can use a passkey held on another device or fall back to your password — and that nobody else can use the passkey on the lost device, because it will not work without your biometrics or device unlock. Remove that passkey from the account afterwards.

Be deliberate about remembered devices. Choosing to have a device remembered stops security codes being sent to it, which is convenient on a personal phone and a bad idea on anything shared or borrowed. NHS login drops a device automatically after six months without use, and you can remove one yourself from your login settings — worth doing when you sell or hand on a handset.

Check that your NHS record contact details are right as well as your login details. They are separate: the login email and phone get you in, the record contact details are what the surgery and other NHS services use to reach you. NHS login says it may text or email you if it finds details on your NHS record that are missing or in the wrong format, which is a signal worth acting on rather than ignoring as spam.

Finally, write down your NHS number and keep it somewhere that is not your phone. Almost every recovery route asks for it, the free NHS service that finds it needs the postcode registered with your GP, and if you have just moved and the record has not caught up, that is precisely the detail you will not be able to supply. A ten-digit number on a piece of paper is the cheapest insurance in this entire guide.