Ministers are preparing to test integrating NHS numbers into school management information systems as part of Labour’s plans for a single unique identifier for all children. But data privacy experts have raised concerns about the security of the numbers and the potential consequences if they are lost or exposed. The Children’s Wellbeing and Schools Act 2026 allowed the government to introduce a single unique identifier (SUI) to help professionals share information about children across services, including schools, social care and police. The number will be introduced through secondary legislation by the end of this Parliament in 2029. The Department for Education (DfE) has described the existing NHS number as a “likely option” since December 2024 and has been testing its use in pilots with Wigan and other local authorities. Now, the department is seeking school management information system (MIS) providers to help test integrating NHS numbers with school systems. An NHS number is a unique 10-digit identification number assigned at birth or when someone is first registered with a GP. It is used to identify patients and transfer medical records. The vast majority of people keep their NHS number for life, though the numbers can be replaced if someone is adopted, undergoes gender reassignment or needs a new identity, for example if they have been a victim of domestic violence. Skills minister Jacqui Smith told the House of Lords in January that the government “will mandate the SUI only when we are confident in the benefits, costs, security and governance”, ensuring it “delivers the intended outcomes”. The DfE piloted the use of the NHS number with Wigan council in April 2025. While no evaluation has been published, Smith said it was “resource intensive and took almost nine months to work through information governance activity”. More council pilots According to the government, more pilots have been introduced across councils, but it is not known where. Now the DfE wants to pilot the secure integration of the NHS number into school management information systems. Tender documents reveal the DfE is looking for two MIS platforms to partner with on the next phase of testing. This would involve the platforms integrating with a DfE-hosted “get an identifier” service, enabling authorised access to NHS numbers. Sam Smith, coordinator at medical privacy rights group medConfidential, said that, because NHS numbers are for life, schools and MIS services will “have to meet NHS cybersecurity standards for retaining NHS numbers”. According to government figures, more than seven in 10 secondary schools (73 per cent) and nearly half (49 per cent) of primary schools reported experiencing a cyber breach or attack in 2025-26. Smith said: “If a school has a problem or loses the SUI, there is little mechanism for the NHS number to be replaced. All the costs of getting this wrong land on the NHS.” Jen Persson, director of Defend Digital Me, agreed that there were many “technical and practical” risks with using the NHS number on school systems. Doing so will “expand the data held on every child … or risk revealing a new home address in cases of domestic violence or details of adoption that are highly confidential”. ‘Not a silver bullet’ Rachel de Souza, the children’s commissioner, has long called for the introduction of an SUI. She said that, while the SUI is “not a silver bullet, it is a vital first step towards better information sharing across the services children rely on”. Rachel de Souza But she added that if the government planned to use the NHS number as the SUI, “extra consideration must be given to children who may receive a new NHS number at any point in their childhood”. De Souza told a joint health and education committee in June she believed the introduction of the SUI was on the government’s “too-hard pile” and wanted them to “get a move on”. The children’s commissioner said she was beginning her own pilot on the SUI due to the government’s inefficiency. Schools Week has asked for an update on its progress. But Smith said that it “may be quicker for NHS tech suppliers to take over the school systems than it will be for the school suppliers to adapt”. A children’s rights impact assessment of the children’s wellbeing and schools bill in June said risks to privacy were “offset by the broader benefits to children” brought by the SUI. Once introduced, a code of practice will set out technical and practical matters on accessing, storing and using the identifier effectively, the report said.