Health records in Scotland
Subject Access Request to NHS Scotland
There is no NHS Scotland to write to. Fourteen territorial health boards deliver the health service, each one is a separate legal organisation, and your request has to reach the board that treated you or the GP practice you are registered with. This page is about working out which, and about the handful of things that work differently in Scotland.
GetMySAR is an independent service. We are not NHS Scotland, not the Scottish Government, and not affiliated with or endorsed by any health board. Every route on this page is one you can use yourself, and asking for your own records is free.
Which organisation holds your medical records in Scotland?
The one that holds the records. NHS inform’s own answer is that you apply to the organisation responsible for them — your GP practice manager, your dental practice manager, or the records manager at the hospital. There is no central Scottish records office and no board can look up another board’s records.
1. Anything from your GP — your practice
Consultations, prescriptions, referrals, test results and the letters hospitals send back. The practice is its own data controller and the request goes to the practice, not to the board. NHS Tayside states the split in terms on its own access page: requests for GP records should be made directly to the practice.
2. Anything from a hospital or community service — that health board
Unlike England there are no separate hospital, mental health and community trusts: in Scotland one board covers all of them for its area. That makes this simpler than it looks — treated at two hospitals in the same board area, it is normally one request. Treated in two board areas, it is two.
3. An ambulance, or a call to 111 — a national board, not yours
The Scottish Ambulance Service and NHS 24 are special boards covering the whole of Scotland and separate controllers from the board whose hospital you were taken to. Patient report forms and 111 call records sit with them. Both publish their own route.
Alongside the 14 territorial boards there are seven special boards and one public health body, which also includes NHS Education for Scotland, the Golden Jubilee, Healthcare Improvement Scotland, the State Hospital, National Services Scotland and Public Health Scotland.
The 14 health boards and where each publishes its route
Board names are administrative rather than obvious, so the area is given alongside. Each link goes to that board’s own page about accessing your personal information, which is where its current address, inbox or form lives — deliberately not copied here, because a board’s page is kept up to date and a copy of it is not.
North, South and East Ayrshire, and Arran
The Scottish Borders
Dumfries and Galloway
Fife
Falkirk, Stirling and Clackmannanshire
Aberdeen, Aberdeenshire and Moray
Glasgow, Renfrewshire, Inverclyde, East and West Dunbartonshire
The Highlands and Argyll and Bute
North and South Lanarkshire
Edinburgh, Midlothian, East and West Lothian
Orkney
Shetland
Dundee, Angus and Perth and Kinross
The Outer Hebrides
You do not have to use anyone’s form. Most boards publish one and filling it in usually helps them find what you are asking for, but NHS Shetland says the position plainly on its own page: you do not need to use a form to make a subject access request, and you may make one verbally, by email or in a letter.
Two boards have changed web address recently, and the old ones still rank. NHS Dumfries & Galloway has moved offnhsdg.scot.nhs.uk, which no longer loads at all, and NHS Shetland offshb.scot.nhs.uk. The links above are the current ones. If a search result for any board gives you a page that will not load, try the board’s entry in the NHS Scotland organisations directory rather than assuming the board has no published route.
Viewing your medical records online in Scotland, and what MyCare.scot misses
This is the part worth knowing before you spend a month waiting. Scotland now has MyCare.scot, which went live in NHS Lanarkshire in December 2025, nationally in April 2026 and on the app stores in June. It is not the equivalent of the record view in the NHS App in England, and it will not answer most of the reasons people ask for their records.
What the Scottish Government says you can currently see in it: your Community Health Index (CHI) number, personal details held by NHS Scotland such as your home address, your medication and allergy information, your Covid and flu vaccination records from 2021 onwards, and local services. Not consultations, not test results, not letters, not hospital notes, not anything from before 2021.
So unlike England, where a good deal of the recent GP record is already in the app and a request is often unnecessary, in Scotland a subject access request is still the route for the record itself. Check the app for a vaccination date or a medication name; ask the board or the practice for anything else. MyCare.scot is also for people aged 18 and over, and needs a verified ScotAccount.
If you are not registered with a GP practice
Scotland handles this differently from the rest of the UK and the difference costs people time. In England the request goes to Primary Care Support England instead of the practice; in Wales it goes to the NHS Wales Shared Services Partnership. In Scotland it still goes to a practice.
NHS National Services Scotland holds records for people who are not currently registered, but its published guidance to practices is that a patient needs to make the request to the current or last practice where they were registered, and that if the practice does not hold the record it requests it back from NSS. The clinical review that has to happen before release is why it works that way. Writing to NSS directly is the common wrong turn.
Four things the law does differently in Scotland
The right of access itself is UK-wide and identical. These are the points where Scottish law, rather than NHS practice, gives a different answer — and each of them is a place where guidance written for England is wrong if you apply it here.
- A child of 12 is presumed able to ask. Section 208 of the Data Protection Act 2018 applies in Scotland only. Where a question arises about whether a person under 16 can exercise a data protection right, they can if they have a general understanding of what it means to do so, and a person aged 12 or over is presumed to have that understanding unless the contrary is shown. Note the shape of it: 12 is a rebuttable presumption working in the young person’s favour, not a minimum age, and a child under 12 who has that understanding still has the right. Some NHS pages describe it as a threshold. England and Wales have no equivalent provision at all.
- For an adult who cannot make the request themselves, the Scottish statute is the Adults with Incapacity (Scotland) Act 2000 — not the Mental Capacity Act 2005, which does not extend to Scotland. A welfare attorney or guardian appointed under the 2000 Act is the person entitled to act.
- Each board is a body corporate, which is why there is no single route. Boards are constituted by order under section 2 of the National Health Service (Scotland) Act 1978, and paragraph 1 of Schedule 1 provides that a health board is a body corporate with a common seal. A separate legal person is a separate data controller, and that is the whole reason this page exists rather than a single address.
- Freedom of information in Scotland is a different Act with a different regulator. Requests for information about a board rather than about you fall under the Freedom of Information (Scotland) Act 2002, and appeals go to the Scottish Information Commissioner, not the ICO. Your own health records are not obtainable that way — NHS Ayrshire & Arran says so on its own site — so asking under the Scottish FOI Act for your own records gets a refusal and a redirect, usually a month later.
Things people ask NHS Scotland for that are not a subject access request
- The records of someone who has died. Data protection rights end at death, so this is not a subject access request. It is an application under the Access to Health Records Act 1990, which applies in Scotland and names Scottish institutions in its own definitions — and which has a Scotland-only limb at section 3(1)(ee) for a patient who is incapable within the meaning of the Adults with Incapacity (Scotland) Act 2000. Only a personal representative of the estate, or someone with a claim arising from the death, can apply. Our medical records page sets out who counts, what it costs and why the Information Commissioner’s Office cannot help if you are refused. Our own form does not accept requests about people who have died.
- Complaining about your care is a separate process from asking for the record, and in Scotland the two doors are different bodies. Complain to the board first; if you are still unhappy it goes to the Scottish Public Services Ombudsman, which takes complaints about NHS Scotland, councils, prisons and universities. But if your complaint is about the request — refused, ignored, or answered incompletely — the SPSO is not the body: its own list of who to go to instead names the Information Commissioner’s Office for data protection concerns, and the ICO has a Scotland office. Sending a refused request to the ombudsman loses months.
- Social work and social care records. Held by your council, not by the health board, even where the two run services jointly through a health and social care partnership. Contact your local council and use its own records route. If you have had both health and social care, that is two requests to two organisations.
- Police records. Nothing to do with a health board. Scotland has a single force and it publishes its own route — see our Police Scotland page, or the police records hub if what you actually need is a criminal record certificate, which is a different thing again.
- Records from a hospital elsewhere in the UK. Apply to the organisation that treated you — it is where the record is, and no Scottish board can get it for you. Our NHS page covers the trusts, boards and national bodies in the other three nations and how to find them.
What to expect once you have sent it
What it costs. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies. You do not have to give a reason for wanting it.
How long they have. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.
Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it. So answering quickly is the difference between one month and two.
Be specific. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want. Name the hospital or the service, roughly when, and what you actually want — and ask for scans and X-rays explicitly if you want them, because imaging is usually held by a separate department.
Where a Scottish page tells you something different, the rules above are the ones that apply. Several boards publish a response time of 30 days, and the ambulance service publishes 28 — those are internal targets and shorter than the calendar month the law gives them, so they are not a problem. NHS inform’s health records pages have not been updated since March 2023 and still refer to an admin fee; there is normally no fee at all. If a board asks you to pay to see your own record, that is worth querying before you pay.
If you have not made a request before, what a subject access request is covers what counts as your personal data and what a good request asks for, and our free letter template is wording you can send yourself at no cost.
Where this comes from
Every fact here was checked against the publishing organisation’s own page on 5 August 2026, and those pages are linked from the text above so you can read them yourself rather than take our word for it: the fourteen health boards’ own data protection and health records pages, the NHS Scotland organisations directory, NHS inform, NHS National Services Scotland, the Scottish Ambulance Service, NHS 24, the Scottish Government on MyCare.scot, the Scottish Public Services Ombudsman, the Scottish Information Commissioner, the ICO, and the National Health Service (Scotland) Act 1978, Data Protection Act 2018 and Access to Health Records Act 1990 on legislation.gov.uk. Boards rename, merge and move their websites — tell us if something here is out of date.
Last checked 5 August 2026
If a subject access request is the right route
You can make one yourself, free, using the board and practice routes above — and if what you need is a vaccination date or a medication name, MyCare.scot is faster. If you would rather not handle the wording, the submission and the chasing, GetMySAR prepares, sends and follows up your request for a fixed £20 fee. We cannot help with a request about someone who has died — that is not a subject access request and our form does not accept one.