NHS Subject Access Request

Once you know who holds it, you need the route that organisation asks you to use. Almost all of them publish one, and it is usually on a page called subject access request, access to health records or your information rights. Searching the organisation’s own website for those words is faster than searching for it in general, because the request pages rank poorly and the switchboard number does not.

• England — hospital and other trusts. NHS England’s NHS provider directory lists every NHS trust and foundation trust with its contact details, and it records mergers and renamings — useful if the hospital that treated you is now part of something with a different name.
• England — GP practices, dentists, pharmacies and opticians. Use find services near you on the NHS website, which has separate searches for GP surgeries and hospitals.
• Scotland. NHS Scotland lists its boards: 14 regional boards, plus seven special boards and a public health body. NHS 24 and the Scottish Ambulance Service are among the special boards, so they are separate controllers rather than part of your local board. Our NHS Scotland page gives each board with the area it covers and where it publishes its own request route.
• Wales. The Welsh Government lists the seven local health boards and three NHS trusts. The trusts are Velindre, the Welsh Ambulance Service and Public Health Wales.
• Northern Ireland. nidirect lists the Health and Social Care trusts — five area trusts and the Northern Ireland Ambulance Service.

You do not have to find a named person. NHS England is explicit that a request can be made to any part of the organisation and does not have to be directed to anyone in particular, and that it can be made verbally, by email, by post or in writing. Finding the right team speeds it up; not finding them is not a reason to wait.

If you have worked through the directories above and still cannot find who to write to, you can start a request naming the hospital or practice and we will identify the right route and address before anything is sent.

There is no single NHS form, and you do not have to use a form at all. This is worth knowing before you spend an afternoon looking for one. A request is valid however you make it, including in an email or a letter in your own words.

What exists is a template form NHS England publishes for anyone to use. Its own advice is the sensible order: if the organisation you are writing to has a form of its own, filling that one in usually helps them find what you are asking for; if it does not, you can use the template and check with them who to send it to and whether it can go by email, by post or in person.

If you would rather start from something already worded, our free SAR letter template does the same job and costs nothing. If you have not made one before, what a subject access request is covers what counts as your personal data and what a good request asks for — which matters more here than the format does, because a vague request to a large trust is the usual reason one comes back with less than the person expected.

Your GP practice holds your primary care record and is the controller for it. Requests go to the practice — in person at reception, by phone, by post or by email, or on the practice’s own form if it has one.

Look in the app first. If you are registered with a practice in England and aged 13 or over, a good deal of the recent record is already in your NHS account, free and immediately. It will not be the whole record — there is more on what the app does and does not hold on our medical records page.

If you are not currently registered with a practice in England, the practice no longer has your record. It goes into national storage and Primary Care Support England answers the request instead, on NHS England’s behalf. PCSE says plainly that if you are registered it cannot disclose anything and will send you back to your practice, so check which of the two you are before applying. It has an online application and a paper one, and it replies by secure email.

In Wales, the same job is done by the NHS Wales Shared Services Partnership, for GP records of people who are unregistered or have died — and only for patients previously registered in Wales. NWSSP says hospital records still have to be requested from the health board or trust.

A GP record follows you between practices, so your current practice usually holds entries made by previous ones. Paper notes from a long time ago may sit in storage and take longer to retrieve than the digital record.

These are separate controllers from any hospital or practice, and sending a request to the wrong one costs a month.

• NHS Business Services Authority. Prescription and pharmacy data, NHS dental services, prescription prepayment and exemption certificates, penalty charge notices for prescription and dental charges, the Low Income Scheme, help with health costs, overseas healthcare and the European and Global Health Insurance Cards, NHS Pensions, the Injury Benefits Scheme, Healthy Start and the Vaccine Damage Payment Scheme. It says it is the data controller for these and publishes a privacy notice for each service, with an online request service and a separate one for requesting on someone else’s behalf. It responds within one month. If you have had a penalty charge notice and want to see what it is based on, this is the right door.
• NHS England. Mostly not the place to write. It is the controller for a GP record only where the person is not currently registered, or has died and the practice they were last registered with has closed — and even then PCSE handles it. For information NHS England itself holds it takes requests in writing, by email or by speaking to it, and asks for two identity documents and one proof of address. That is what NHS England asks for, not what the law requires: identity checks have to be reasonable and proportionate, and an organisation should ask for the minimum it needs.
• Integrated care boards, in England. An ICB holds commissioning and funding decisions rather than clinical notes — NHS continuing healthcare assessments, individual funding requests, decisions about who pays for care. There are now 36 ICBs, down from 42, after the order that took effect on 1 April 2026 abolished twelve and created six. If the body that made your decision was a clinical commissioning group, or an ICB that no longer exists, ask the ICB that now covers your area: NHS England’s own implementation guidance says the information held by an abolished ICB transfers to the new one, that the new one becomes the data controller for it, and that the duty to answer subject access requests transfers with it.
• NHS 111 and the ambulance service. Calls, triage notes and patient report forms sit with the organisation that took the call or sent the crew, not with the hospital you ended up in. In England the ambulance trusts are in the provider directory above; in Scotland NHS 24 and the Scottish Ambulance Service are their own boards.

Reorganisations do not change the basic rule. Records stay with the organisation that holds them, and where a body is abolished its records and its duty to answer pass to whoever takes over.

The right of access is the same across the UK. What differs is which organisations exist, and what you can already see online.

• England. Trusts and foundation trusts for hospital, mental health, community and ambulance records; GP practices for primary care; PCSE if you are not registered.
• Scotland. Fourteen regional health boards rather than trusts, each covering hospital, mental health and community services for its area. Apply to the board that runs the hospital, or to your GP practice — which is what NHS inform says. Scotland now has its own app, MyCare.scot, but it does not show the record itself, so a request is still the route: what it holds, and each board’s route.
• Wales. Seven local health boards, each covering both hospital and community services for its area, plus three trusts. Unregistered and deceased patients’ GP records go to NWSSP.
• Northern Ireland. There is no NHS in Northern Ireland. Health and social care are delivered together by Health and Social Care, and the organisations are HSC trusts rather than NHS trusts. nidirect’s guide to accessing records is clear that your GP practice holds GP records separately from trust records, so a request to a trust will not produce your GP notes.

Treated in one nation and living in another? Apply to the organisation that treated you. It is where the record is.

What it costs. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies. You do not have to give a reason for wanting it.

How long they have. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it. So answering quickly is the difference between one month and two.

Be specific. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want. Name the hospital or the service, roughly when, and what you actually want — and ask for scans and X-rays explicitly if you want them, because imaging is often held by a separate department and supplied on disc.

Health records get an extra check that other records do not, and it is the usual reason a medical request comes back partial rather than complete. There is more on that, and on what can be held back, on our medical records page.