Access Medical Records

There is no single place your medical records live, and this is the thing that most often turns one request into three.

• Your GP practice holds your primary care record: consultations, prescriptions, referrals, and results and letters sent back to it from hospitals. The practice is its own data controller.
• Each hospital trust or health board holds what happened under its care — inpatient and outpatient notes, clinic letters, test results, imaging. A different hospital is a different controller and a separate request.
• Dentists, opticians, pharmacies, ambulance services and private providers each hold their own records and are each their own controller. Private treatment is covered by exactly the same right of access as NHS treatment.
• If you are not currently registered with a GP practice in England, your GP record is held by Primary Care Support England on behalf of NHS England, and you apply to PCSE rather than to a practice. If you are registered, PCSE cannot release it and will point you back to your practice.

NHS England’s own answer to “how do I get a copy of my medical records” is that you have to ask the organisation that holds them. There is no central NHS records service to write to.

Working out which hospital trust, practice, health board or national body that is can be most of the job, so it has a page of its own: which NHS organisation holds your records covers the four nations, the directories that list every trust and board, and the national bodies — the NHS Business Services Authority for prescriptions and exemptions, PCSE if you are not registered — that people most often write to the wrong one of.

Private care works the same way: the clinic, hospital or practice that treated you is the controller, and it will have a privacy notice giving the route. If you cannot find one, you can start a request naming the provider and we will trace the right contact.

Start with the app. If your practice has only switched on your summary record — medicines and allergies — you can ask them to give you access to your detailed coded record, which adds test results, appointment notes, letters and documents. That is a request to the practice, not a formal legal one, and it is often the fastest fix.

If you need more than the app holds, ask the practice for a copy of your record. NHS England is explicit that you can make the request to any part of the organisation — you do not have to find a named person — and that you can do it in person, by phone, by post, by email or in writing. You do not have to give a reason, and in almost all cases there is no fee. If the practice has a form, using it usually helps them find what you are asking for; NHS England also publishes a generic request form on that page you can use if they do not.

You may be asked to prove who you are, and the organisation should ask for the minimum it needs. If it does need more information from you before it can deal with the request, the one-month clock pauses until you provide it — so answering quickly is the difference between one month and two.

You do not need anything from us to do this. Our subject access request form gives you wording you can send to a practice or a trust today, and what to do if the organisation does not comply covers your options if a request is ignored, missed or refused. If you would rather hand the whole thing over, how GetMySAR works explains what we do at each stage before you pay anything.

Be specific about dates and topics. A request for “everything” is slower and more likely to come back partial, because an organisation only has to carry out a reasonable and proportionate search rather than an exhaustive one. If you want a particular admission, a particular year, or the imaging as well as the notes, say so.

The right of access is the same across the UK. What differs is what you can already see online and, for someone who has died, which Act applies.

• England. NHS App or the NHS website, for anyone aged 13 or over registered with a GP practice in England.
• Wales. The NHS Wales App, for anyone aged 16 or over registered with a GP practice in Wales. It shows a summary record by default; you can ask your practice to switch on the detailed coded record, and it is the practice’s decision. Digital Health and Care Wales says it is not yet possible to download the whole record through the app, so for the full record you still go to the practice.
• Scotland. Apply to the organisation that holds the records — your GP practice, or the health board for hospital records. NHS inform sets out the Scottish position. There is no Scotland-wide app equivalent to the record view in the NHS App. Which NHS Scotland health board or practice to send it to covers all 14 boards and where each publishes its route, and what MyCare.scot will and will not show you.
• Northern Ireland. Records sit with your GP surgery, with HSC trusts, and with the Northern Ireland Ambulance Service. The My Care portal shows medications, appointments and some test results, but nidirect is clear that it does not include GP records or significant historical information. Requests should be made in writing, and GP records are held separately from trust records.

It is free. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

How long they have. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why. Needing a clinician’s opinion on your record is one of the things that can make a request complex.

Health records get an extra check that other records do not. An organisation may withhold health information where releasing it would be likely to cause serious harm to your physical or mental health, or to anyone else’s. It can only make that call if the decision-maker is a health professional, or if it has an opinion from the appropriate health professional — normally the clinician most recently responsible for your care — given within the last six months. This has a consequence people are rarely told about: if it cannot get that opinion before the deadline it has to withhold the health information rather than release it unreviewed. That is why a medical request is more likely than most to come back partial.

Other people’s information is usually removed. Your notes will contain things about relatives, and sometimes about other patients. That gets redacted. Information identifying the clinicians who treated you normally does not — that is ordinarily disclosed.

Ask for imaging explicitly. Scans and X-rays are often handled by a separate radiology department and supplied on disc rather than with the written record, so a general request can come back without them.

Records do not last forever. NHS England’s position is that most health and care records are kept for eight years after your last treatment, and GP records for considerably longer. If an old record cannot be found, that is often retention rather than obstruction. GP records of someone who has died are kept for ten years.

• A medical report for an insurer or an employer. This is not a subject access request and should not be one. With your consent an insurer can apply to your GP for a tailored report under the Access to Medical Reports Act 1988, which gives them only what they need rather than your entire record — and which lets you say, when you give that consent, that you want to see the report before it is sent. The ICO says in terms that a subject access request is not appropriate where the third party’s interests are not aligned with yours.
• Being told to get your own records as a condition of something. It is a criminal offence under section 184 of the Data Protection Act 2018 for an employer, or for anyone providing goods, services or facilities, to require you to obtain your own health record through a subject access request as a condition — of a job, of continued employment, of a contract, or of being provided a service. Health records are named in Schedule 18 as a “relevant record” for exactly this purpose. Asking in a way that makes you feel obliged to comply counts. This is one place the Information Commissioner’s Office is the right body to tell — unlike a refused application about someone who has died, which is outside its remit entirely.
• Getting something in your record corrected. That is a rectification request, not an access request. In Northern Ireland and Scotland, as in England and Wales, the usual first step is to raise it with the staff providing your care. Where a clinician disagrees that an entry is wrong, your disagreement can normally be recorded alongside it rather than the entry being changed.
• Complaining about your care. A subject access request gets you the record. It does not open a complaint, and it does not put anyone on notice. Those are separate processes with separate teams.
• Social services or social care records. Those are held by a local authority, not by a health body, and are a different request to a different organisation. Making a subject access request to social services covers which council or trust holds the file, what care leavers are owed beyond the ordinary right of access, and why adoption records follow a different law — or you can go straight to the council for your area and look for its data protection or “access your records” page.

• An adult who has agreed. A solicitor, family member or friend can make the request, with evidence that the person agreed — normally a signed consent form.
• An adult who lacks capacity. A lasting power of attorney for health and welfare, registered with the Office of the Public Guardian, allows you to make the request. Without one, a request supported by evidence that you are acting in the person’s best interests will still be considered. Note that holding power of attorney does not by itself create an automatic right to someone’s medical records.
• A child or young person. This surprises parents.NHS England’s guidance is that a young person can exercise their own rights once they understand them, and that 12 is the usual age from which that is assumed. So a parent asking for the records of a child aged 12 or over will normally need that young person’s agreement. Younger children may also be treated as competent if there is evidence they understand. Where a child is not competent, a person with parental responsibility can usually make the request in the child’s best interests. Separately, a parent can be refused anything the child gave in the expectation that it would not be passed on.