Right to Work Checks Healthcare UK: The 2026 Employer Guide

Three policy changes in 12 months have left healthcare employers guessing

Between June 2025 and March 2026, the Home Office changed right to work check requirements three times. Expired Biometric Residence Permits became temporarily acceptable. A mandatory digital ID scheme was announced and then abandoned. New guidance for asylum seekers permitted to work on the Skilled Occupations List took effect.

For healthcare HR directors running right to work checks across hundreds of clinical staff, the cumulative effect is confusion. Which version of the guidance applies today? What documents are acceptable right now? And what happens at a Home Office audit if your team followed last year's process?

This guide sets out the current position as of April 2026, covering each of the recent changes and what they mean for healthcare employers specifically.

Current Home Office requirements for right to work checks healthcare UK

Every UK employer must verify that a prospective employee has the legal right to work in the United Kingdom before employment begins. The Home Office Employer Checking Service provides the statutory framework, and the penalties for non-compliance are significant: fines of up to £60,000 per illegal worker for a first offence, with criminal prosecution possible in cases of deliberate non-compliance.

Healthcare employers face additional complexity. Clinical workforces include British nationals, settled status holders, visa-sponsored international recruits, refugee doctors and nurses, and asylum seekers with permission to work. Each category has different documentary requirements and different check frequencies.

The three methods of conducting a right to work check are: a manual document check (viewing original documents in person), a check through the Home Office online service (for holders of biometric documents), or an Identity Document Validation Technology check through a certified Identity Service Provider for British and Irish passport holders.

NHS Employers publishes the Right to Work Checks Standard, which sets out the expected process for NHS organisations and is widely adopted by private healthcare providers as baseline good practice (NHS Employers, Right to Work Checks Standard, 2026).

Expired BRP guidance: what changed in June 2025

In June 2025, the Home Office updated its guidance to allow expired Biometric Residence Permits to be accepted as right to work evidence for up to 18 months beyond their expiry date. This was a practical response to the government's failure to replace BRPs with the new eVisa system on time.

For healthcare employers, this created an immediate question: should HR teams accept an expired document as valid proof? The answer, under the updated guidance, is yes, provided the BRP expired within the 18-month window and the employer records the check correctly. The statutory excuse against a civil penalty is maintained as long as the employer followed the guidance in force at the time of the check.

The risk sits in the transition. HR teams trained to reject expired documents need to know the new rules apply. And those rules may change again when the eVisa rollout completes. Compliance teams should document which version of the guidance was followed for each check, creating an audit trail that demonstrates due diligence regardless of future policy shifts.

The digital ID scheme reversal and what it means for healthcare

In September 2025, the Prime Minister announced that digital identity checks would become mandatory for all right to work verification. Within months, the mandatory element was dropped following political and public backlash. The government opened a consultation on a national digital ID scheme running until 5 May 2026 (Lewis Silkin, UK Digital ID Consultation Analysis, March 2026).

Healthcare employers are left in a policy gap. Digital identity verification is available and legal for British and Irish passport holders through certified Identity Service Providers under the Digital Verification Service. But it is not mandatory, and the broader digital ID infrastructure remains under consultation.

The practical implication for healthcare organisations is that digital identity verification is an option, not a requirement. Employers can use IDVT-based checks through a certified provider to verify British and Irish passports remotely, which reduces onboarding friction for domestic hires. For international recruits, visa holders, and anyone without a British or Irish passport, the manual or Home Office online check routes remain the only options.

How IDVT and the Digital Verification Service work

Identity Document Validation Technology allows employers to verify a British or Irish passport digitally without meeting the candidate in person. The check is conducted through a certified Identity Service Provider that meets the government's Digital Verification Service standards.

The process works as follows. The candidate scans their passport using the provider's app. The provider validates the document, confirms the identity, and issues a verification result to the employer. The employer retains the result as their right to work check record.

For healthcare organisations hiring British or Irish clinicians, this removes the requirement for an in-person document check. A nurse accepting a role at a hospital 200 miles from their current location can complete the right to work check from home, on their phone, before their first day. The check takes minutes rather than requiring a scheduled visit or posting original documents.

IDVT does not cover non-passport documents, non-British and non-Irish nationals, or any visa-based right to work. It is a partial solution that applies to one segment of the workforce. Healthcare employers still need a process for every other scenario.

New asylum seeker guidance: March 2026

In March 2026, the Home Office issued updated guidance for asylum seekers permitted to work. Asylum seekers who have waited more than 12 months for a decision on their claim can apply for permission to work, restricted to roles on the Shortage Occupation List at RQF Level 6 or above.

Several healthcare roles qualify, including doctors, nurses, radiographers, and other allied health professionals. For NHS trusts and private providers recruiting international clinicians, this guidance creates a new pathway, but one with specific compliance requirements.

The employer must verify that the individual holds a positive right to work check through the Home Office Employer Checking Service. A manual document check is not sufficient. The permission to work is time-limited and must be rechecked at the intervals specified by the Home Office.

Healthcare HR teams need to understand that this is not the same as sponsoring a worker on a Health and Care Worker visa. The right to work is conditional, temporary, and subject to the asylum claim outcome. Compliance records must reflect this distinction.

Common right to work audit failures in healthcare

Home Office right to work audits in healthcare consistently reveal the same patterns. These are not edge cases. They represent the most frequent compliance failures across the sector.

Checks completed after employment started. The right to work check must happen before the first day of paid employment. Not during the first week. Not once HR gets around to it. Before. Healthcare organisations with fast onboarding timelines or bank staff activation are most at risk of this failure.

Incorrect follow-up check scheduling. Time-limited right to work requires follow-up checks at specific intervals. If a visa expires and the follow-up check is late, the employer loses their statutory excuse from the date the previous check expired. Manual diary systems miss these deadlines reliably.

Accepting photocopies or digital images. A manual right to work check requires viewing original documents. Scanned copies, photographs, and emailed PDFs do not satisfy the requirement. Remote hiring during and after the pandemic normalised digital document sharing, but the manual check route still requires originals.

Failing to retain prescribed document copies. Employers must retain a dated copy of the documents checked, in the prescribed format. Missing dates, incomplete copies, or documents stored without the required annotations all count as failures.

Mixing up check methods. Using the manual check route for someone who should have been checked via the Home Office online service, or vice versa. Each document type and immigration status has a prescribed verification method, and using the wrong one invalidates the check.

How automated right to work tracking reduces audit risk

Credentially automates right to work checks as part of its healthcare onboarding platform. The system captures right to work documents during the clinician's self-service onboarding journey, validates the document type against the individual's immigration status, and schedules follow-up checks automatically for time-limited permissions.

The platform maintains an audit-ready record for every clinician, including the date of the check, the method used, the documents verified, and the follow-up schedule. When a follow-up check is due, the system alerts the compliance team in advance, not after the deadline has passed.

For healthcare organisations managing a mixed workforce of British nationals, settled status holders, visa-sponsored recruits, and bank or locum staff, this removes the most common source of audit failure: human error in scheduling and record-keeping. The compliance team retains oversight while the system enforces the process.

Organisations using Credentially typically reduce onboarding administration by 30 to 50%, with right to work checks contributing a measurable portion of that reduction through automated scheduling and document capture.

Building an audit-proof right to work process

Standardise the check method by document type. Create a decision matrix that maps each immigration status to the correct verification route: manual, online, or IDVT. Train every person who conducts checks to follow it.

Adopt IDVT for British and Irish passport holders. Remote digital verification is faster for the clinician and removes the logistical burden of in-person document checks for domestic hires. It is legal, certified, and produces a compliant record.

Automate follow-up check scheduling. Time-limited right to work is the highest-risk category. If your follow-up scheduling depends on someone setting a calendar reminder, it will fail at scale. Use a system that calculates and enforces the check dates.

Separate the record from the process. Your right to work records should be stored independently from email threads and shared drives. A Home Office auditor needs to see the complete check history for any employee, on demand. If assembling that record takes more than a few minutes, your process has a structural weakness.

Review asylum seeker eligibility carefully. The March 2026 guidance opens a new pathway, but the compliance requirements are more demanding than standard right to work checks. Ensure your team understands the distinction between asylum seeker permission to work and visa-based sponsorship.