The current user authentication process for mPHR depends on data which is in the public domain and Trust/provider process to verify user identity. The gold standard for future would be to integrate with the NHS app and include NHS number as an identifier.
A suitable alternative would be to use 2-factor authentication.
Thanks for the request Alice - we have this under consideration for a future version