shkspr.mobi
## The NHS shouldn't outsource its QR codes
https://shkspr.mobi/blog/2025/06/the-nhs-shouldnt-outsource-its-qr-codes/
QR codes are brilliant. They're a simple way to allow users to easily and quickly go to the right URl - no matter how complex. No more worrying about typing in long addresses or figuring out if that's a letter O or the number O. Scan and go!
The best thing about QR codes is that they're free. It doesn't cost any money to generate one. They're an open standard with no middle-men. Users can go direct to your site!
Except… Some people want to insert themselves into your conversation. Sometimes it is for malicious reasons, sometimes it is greed for user data, and sometimes it is just incompetence.
Let's take this example - a health centre wants people to register. Scan the QR and get started. Fab!
Photo shamelessly stolen from a LinkedIn contact.
But what happens when you scan the QR code? Rather than taking you directly to an authoritative and trusted NHS.UK domain name, it sends you through `https://register-with-gp.ht1.uk/`.
## Who on earth are HT1.UK?
According to their website, they're an automation company who are "on a mission to make the NHS the most advanced healthcare system in the world."
Good for them. But what information are they collecting about users who traverse through their QR codes? If you take a look at their privacy policy you won't find anything specific. Never mind, let's email their friendly privacy team. What's their email address?
Of course, emailing that gets you back this error:
Emoji! How fun!!
So I emailed the new address to see what information they were collecting. Their response wasn't particularly informative.
> because Healthtech-1 is a processor of information and the GP practice is the data controller any requests about how your data is handled should be made to the GP practice who can inform you of the information you requested.
>
> …
>
> I can confirm that there is no information stored about users who scan the QR codes and no cookies placed.
But, of course, users have no way of verifying what this company is storing about them. There's simply no reason to use an untrusted 3rd party like this to provide either a QR code or an intermediary website.
## Why this is a problem
Trust is everything. People are _constantly_ being scammed. One of the great things that GOV.UK did was to say "This here is our trusted brand. If you don't see GOV.UK in the URl bar - don't trust it!"
The NHS should be doing the same. Every hospital, surgery, and clinic should have an NHS.UK domain name. When a user sees a link to a healthcare service which _doesn't_ go through NHS.UK, they should feel suspicious and not click on it.
There is no way as a regular user to know that HT1.UK is a trusted domain. What about HT1.biz? HT2.UK? NHS.info.ly? What happens if HT1 go bust or have their domain name hijacked?
The NHS must stop the proliferation of these 3rd party domain names. They need to reinforce users' understanding that NHS.UK is the _only_ trusted domain name for official NHS services.
I'm sure HT1.UK aren't doing anything nefarious with the data of people who visit their QR codes. I'm sure they're not inserting tracking cookies or selling my data. But I shouldn't have to be sure. All users should be pointed _directly_ to an NHS.UK domain without having to risk whether their details are going via a dodgy site.
Here endeth the rant.
#gdpr #nhs #privacy #qr
