Patient Access 2FA: how to set up an authenticator app

Patient Access is the EMIS website and app that people in the UK use to book GP appointments, order repeat prescriptions and message their practice. If you sign in with an email address (or user ID) and password, an authenticator app isn't optional anymore. Patient Access asks for a 6-digit time-based code at every sign-in, and it has retired the older Memorable Word and text-message checks (Patient Access). There's no setting to find: the setup screen appears by itself when you sign in.

In England, you can sign in with NHS login instead and skip the authenticator. With Face ID or Touch ID turned on in the app, you aren't asked for a code each time (Patient Access). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way, and Patient Access says a free one is fine.

How we checked this guide: the Patient Access steps come from Patient Access's own support portal, linked below. Its help pages now load inside a support app that our automated reader couldn't open, so on October 21, 2026 we read them as archived copies on web.archive.org, saved in April and May 2026. The pages say they were last updated on February 4, 2026. We haven't tested the steps on a Patient Access account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Set up the authenticator app at sign-in

New and existing accounts get the same steps. Existing users first enter their Memorable Word or text-message code one final time (Patient Access). New users see the step right after creating the account and verifying their email (Patient Access).

1. Sign in with your username and password.
2. When Patient Access prompts you to install an authenticator app, install Novaz if you haven't, then click Continue.
3. Patient Access shows a QR code with a text code underneath. In Novaz, tap +, then Scan QR code, and point the camera at it.
4. If Patient Access is open on the same iPhone, take a screenshot, then in Novaz tap + and Choose a photo. See scanning a QR code on the same iPhone. Or copy the text code, tap +, then Enter key manually, and paste it as the Setup key. See What is a 2FA setup key?
5. Click Next.
6. Enter the 6-digit code from Novaz and click Verify.
7. Click Done to reach your dashboard.

If you stop partway through, Patient Access makes you finish the setup the next time you sign in. The setup only counts as done once you've entered a code (Patient Access).

Add a mobile number now

Patient Access's help doesn't mention backup or recovery codes. What it does say is that resetting your authenticator only works if your account has a valid mobile number. Without one, you're told to contact Support (Patient Access). Registration lets you skip the mobile number, so check that yours is there in Account Settings. Unless you've made a Novaz backup, its keys exist only on your iPhone, so that number is your safety net.

If Patient Access rejects your code

Patient Access says there's no limit on wrong codes. Wait for a fresh code, and copy and paste it rather than typing it, ideally just before you enter it so it doesn't expire on the way. If a correct code still fails, it suggests resetting the authenticator (below) (Patient Access).

Check your iPhone's clock as well: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?

Reset the authenticator: new phone, new app, or lost phone

Patient Access uses one reset for all of these, and you start it from the sign-in screen (Patient Access):

1. Patient Access says to delete any existing Patient Access entry from your authenticator app first. In Novaz, open it and tap Remove account.
2. Sign in to Patient Access. When it asks for your verification code, click Reset your authenticator app.
3. Copy the secret key, a long text code.
4. Switch to Novaz without closing Patient Access. Tap +, then Enter key manually, and paste the key as the Setup key.
5. Switch back to Patient Access and enter the 6-digit code from Novaz before it changes.

Keep Patient Access open the whole time. If you close it and sign in again, the reset is abandoned and Patient Access still expects a code from your old setup. On a computer, minimize the browser rather than closing the tab.

If you use Novaz's iCloud backup or keep a backup file, you can restore your accounts on the new iPhone and skip this reset; without one, a new phone means running it. See How to transfer your authenticator app to a new iPhone. If your phone is gone and there's no mobile number on the account, the route is Patient Access technical support, through the form on its support portal. Its help doesn't say what proof Support asks for or how long it takes. More in Lost the phone with your authenticator app?

If you're in England, NHS login is another way into the same Patient Access account, and it doesn't ask for the authenticator code (Patient Access).

Turning it off

The help doesn't describe a way to switch the authenticator off. The documented alternatives are NHS login, which the home page also offers (Patient Access), and Face ID or Touch ID.

Official Patient Access help

• Sign-in to Patient Access (archived copy, April 2026)
• Signing in FAQs and troubleshooting (archived copy, May 2026)
• Register for Patient Access using username and password (archived copy, May 2026)
• Patient Access - GP appointments & prescriptions online