diff --git a/src/example-no-consent-content-other.md b/src/example-no-consent-content-other.md new file mode 100644 index 0000000..5e5a889 --- /dev/null +++ b/src/example-no-consent-content-other.md @@ -0,0 +1,15 @@ +--- +layout: base-example.njk +title: NHS login button for NHS services that use the Design System +--- + +

You cannot continue without sharing your information

+ +

[Your service name] needs your NHS login information to verify your identity.

+ +

Dynamic content.

+ +

If you need medical help, go to 111.nhs.uk or call 111 or your GP.

+ +

Call 999 if it's a life-threatening emergency.

+ diff --git a/src/example-no-consent-content-wayfinder.md b/src/example-no-consent-content-wayfinder.md new file mode 100644 index 0000000..9e3e7a7 --- /dev/null +++ b/src/example-no-consent-content-wayfinder.md @@ -0,0 +1,13 @@ +--- +layout: base-example.njk +title: NHS login button for NHS services that use the Design System +--- + +

You cannot continue without sharing your information

+ +

The service provider needs your NHS login information to verify your identity.

+ +

If you need medical help, go to 111.nhs.uk or call 111 or your GP.

+ +

Call 999 if it's a life-threatening emergency.

+ diff --git a/src/images/Guidance-example-other.png b/src/images/Guidance-example-other.png new file mode 100644 index 0000000..771a381 Binary files /dev/null and b/src/images/Guidance-example-other.png differ diff --git a/src/images/Guidance-example-wayfinder.png b/src/images/Guidance-example-wayfinder.png new file mode 100644 index 0000000..1eabb68 Binary files /dev/null and b/src/images/Guidance-example-wayfinder.png differ diff --git a/src/images/Guidance-userjourney-consent.png b/src/images/Guidance-userjourney-consent.png new file mode 100644 index 0000000..aceae42 Binary files /dev/null and b/src/images/Guidance-userjourney-consent.png differ diff --git a/src/no-consent-guidance.md b/src/no-consent-guidance.md new file mode 100644 index 0000000..9829b31 --- /dev/null +++ b/src/no-consent-guidance.md @@ -0,0 +1,336 @@ +--- +layout: base.njk +title: Sharing a user's NHS login information with your service +--- + +

For users to access your service they need to agree to share their NHS login information with you. In order for user information to be received by your service, and ID token or autorisation code, containing the user information, must be passed from NHS login to your service. This can only be done with ther user's consent.

+

If a user does not agree to share their NHS login information, your service should display a clear message telling them what they can do to continue their journey, or that they will be unable to use your service.

+ +--- + +

User journey asking users to share their NHS login information

+ + Open this user journey flow in new window + +
+ Diagram showing the flow that a user goes down from selecting the NHS button to being authorised by NHS login and back to the partner service. +
+
+

We ask users to agree to share their NHS login information with your service when they use your service to:

+ + +

Consent flow

+ +

When a user agrees to share their NHS login information, they can continue to your website or app and use the service they need.

+

Their consent allows the ID token with their information to be securely passed from NHS login to your service.

+ +

No-consent flow

+ +

If a user does not agree to share their NHS login information, they can go back from the confirmation screen to amend their decision. They can then continue to your service.

+

If the user still does not agree to share their NHS login information, they will be redirected to your service without passing an ID token or authorisation code.

+

Their information is not passed to your service and you need to display a no-consent error screen.

+

How the user is able to continue to your website or app depends on how you handle them. For example, you may have a guest process or alternative authentication journey.

+ + +

The suggested content on the no-consent error screen differs,depending on the type of service you are.

+ + +
+ Information: +

Though the no-consent error screen is the responsibility of your service, the solution does not require a technically complex implementation and only requires tailored content to adjust user expectations.

+
+ +--- + +

Guidance for no-consent error screen content

+ +

There are three different types of implementation of the no-consent error screen. The guidance most suitable for you will depend on what type of service you are.

+ + + +
+
+
+
+

+ Services that use Wayfinder +

+

Use this version of the no-consent error screen content guidance if your website or app uses Wayfinder, such as Health Call.

+
+
+
+ Example of NHS login button alongside other log in or register options +
+
+
+ + + View the no-consent error screen content guidance for services that use Wayfinder + + +
+
+
    +
  • This version of the no-consent error screen refers to your service as "The service provider". We suggest that this remains unchanged and that the name of your service is not used as it may not make sense to the user in their journey.
    • +
  • To align with all other services that use Wayfinder, only use the content provided and do not tailor it.
    • +
  • To ensure that clinical risk is minimised, ensure that the anchor tags to the emergency services are operational and implemented as suggested.
    • +
  • You may use your service font and styling on this page, within the bounds of the styling suggestions we provide.
    • +
+
+

How to display content for the no-consent error screen

+

Here is an example of the Wayfinder no-consent error page. You can copy the content and code by selecting the HTML tab below this diagram.

+

You will need to apply your own CSS to the code. You should not add any other content to this screen.

+
+ + Open this image in new window + +
+ +
+
+ +
+ +
+
+
+ Copy code + 
<h1>You cannot continue without sharing your information </h1>
+<p>The service provider needs your NHS login information to verify your identity.</p>
+<p>If you need medical help, go to <a href="https://www.nhs.uk/contact-us/get-medical-help/">111.nhs.uk</a> or call<a href="tel:111">111</a> or your GP.</p>
+<p>Call <a href="tel:999">999</a> if it's a life-threatening emergency.</p> 
+
+
+ + Close + +
+
+
+
+ +Styling suggestions +
    +
  • The heading font size should be no smaller than 20px.
    • +
  • The body copy should be no smaller than 16px.
    • +
  • Ensure that the emergency contact numbers and links are not static text, but hyperlinks as advised.
    • +
+ +The functionality of the back navigation in the NHS App +

The user will be able to return to a previous point in their journey in the NHS App, using the native back-button. Depending where they have come from, the user can select the NHS App back-button and return to an earlier point in their journey for them to continue. The two places from which the user may have entered into the journey are:

+
    +
  • The message hub
    • +
  • The appointment aggregator screen
    • +
+

The reason that the user will return to a point this early in the journey, rather than the consent screen directly, is due to the fact that the user information (in the form of an ID token or autorisation code) is not passed to your service in the no-consent flow.

+ +
+
+
+
+ + + + + + + + + + +
+
+
+
+

+ Services that have alternative user verification processes +

+

Use this version of the no-consent error screen content guidance if your website or app can send obtain the user information for verification in an alternative manner, such as 111 online.

+
+
+
+
+ + + View the no-consent error screen content guidance for services that have alternative user verification processes + + +
+
+

What is an alternative user verification process?

+

This is when users can log in as a guest using their own details without the need for passing an ID token.

+

If this is possible in your service, you do not need to display the no-consent error screen.

+

Instead, the user will move directly to the guest process.

+
+
+
+
+ + + + + + + + + + + +
+
+
+
+

+ All other services +

+

Use this version of the no-consent error screen content guidance if the previous options did not describe your service.

+
+
+
+ Example of NHS login button alongside other log in or register options +
+
+
+ + + View the no-consent error screen content guidance for all other services + + +
+
+
    +
  • This version of the no-consent error screen recommend that you inser the name of your service in the [Your service name] placeholder.
    • +
  • The italics placeholder text indicates variable text where you may insert your own copy.
    • +
  • To ensure that clinical risk is minimised, ensure that the anchor tags to the emergency services are operational and implemented as suggested.
    • +
  • You may use your service font and styling on this page, within the bounds of the styling suggestions we provide.
    • +
+
+

How to display content for the no-consent error screen

+

Here is an example of the no-consent error page. You can copy the content and code by selecting the HTML tab below this diagram.

+

You will need to apply your own CSS to the code.

+
+ + Open this image in new window + +
+ +
+
+ +
+ +
+
+
+ Copy code + 
<h1>You cannot continue without sharing your information </h1>
+<p>[Your service name] needs your NHS login information to verify your identity.</p>
+<p>Dynamic content.</p>
+<p>If you need medical help, go to <a href="https://111.nhs.uk/">111.nhs.uk</a> or call<a href="tel:111">111</a> or your GP.</p>
+<p>Call <a href="tel:999">999</a> if it's a life-threatening emergency.</p> 
+
+
+ + Close + +
+
+
+
+ +Styling suggestions +
    +
  • The heading font size should be no smaller than 20px.
    • +
  • The body copy should be no smaller than 16px.
    • +
  • Ensure that the emergency contact numbers and links are not static text, but hyperlinks as advised.
    • +
+ +Dynamic content suggestions +

We suggest that you only add your own content when you have additional information that may be of value to the user to either navigate away from the no-consent error page, or to troubleshoot, i.e. a contact email or number.

+ +
+
+
+
+ +

Contact us if you are unsure which version of the no-consent content guidance is right for your service.