How to Request Medical Records in the UK

Getting hold of your medical records is your legal right, and thankfully, the process is pretty straightforward in the UK. At its core, you just need to make something called a Subject Access Request (SAR) to your healthcare provider, whether that’s your local GP or a hospital trust.

Understanding Your Right to Access Health Records

Before you even start drafting an email, it’s important to get one thing straight: accessing your health information isn’t a favour your doctor grants you. It's a fundamental right. You're not asking for permission; you're exercising your control over your own personal data, and the law is firmly on your side.

This right is what allows you to be an active partner in your own healthcare. Maybe you're moving house and need to register with a new GP, or you want a second opinion on a diagnosis. Perhaps you just want a complete picture of your medical history for your own peace of mind. Whatever the reason, having your records is the first, crucial step.

The Legal Framework in the UK

In the UK, your right to access your medical records is locked in by the Data Protection Act 2018 and the General Data Protection Regulation (GDPR). These powerful pieces of legislation give everyone the right to find out what information organisations hold about them. When that information is your health data, the formal process is known as a Subject Access Request (SAR).

Once you’ve put in a SAR and proven you are who you say you are, the clock starts ticking. The provider has to give you a copy of your records without undue delay, and at the latest, within 28 days. This can only be extended in particularly complex cases. The records you receive should be comprehensive—think clinical notes, diagnoses, and treatment plans—but they shouldn't include subjective personal opinions that aren't relevant to your care.

It can be helpful to know that different healthcare service providers have their own internal processes for managing these requests, but they all must comply with the same legal framework. The British Medical Association provides detailed guidance on this, which you can read more about on their website.

Your right to access your health data is a key part of modern healthcare, promoting transparency and putting you in control. It ensures that you are not just a passive recipient of care but an informed partner in your own health management.

Who Is Entitled to Make a Request

It's not just the patient who can ask for the records. The law recognises that sometimes other people need to act on a patient's behalf.

Here’s who is legally entitled to make a SAR:

• You, for yourself: Any individual can request their own medical records. Simple as that.
• A parent, for their child: If you have parental responsibility, you can request your child's records. However, if the child is old enough to understand what's being asked, they may need to give their own consent.
• Someone else, for another adult: You can request records for another adult, but only if you have their clear, written consent. The other route is if you have legal authority, like a health and welfare lasting power of attorney.

Getting to grips with who can ask for what is a huge part of navigating the healthcare system effectively. To learn more, check out our guide on understanding patient rights and responsibilities.

Gathering Everything You Need Before You Ask

Before you dive in and make your request, spending a few minutes getting organised can make all the difference. Think of it as creating a clear, simple roadmap for the records department to follow. This prep work prevents the common back-and-forth that stalls everything.

When a healthcare provider gets a vague or incomplete request, they have to hit pause and ask for more details. That just resets the clock and leads to frustration. A well-prepared request is a fast request.

Pinpoint the Correct Data Controller

First things first, you need to work out who actually holds your records. Under GDPR, this person or organisation is known as the ‘data controller’. It might seem obvious, but your health journey can easily involve multiple different providers.

Your GP surgery holds your primary care history, for example, but a hospital trust will have the separate records for any A&E visits or specialist consultations. A private clinic you saw for a specific procedure? They're another data controller. It’s a common mistake to assume one can provide the records for another.

• For GP records: Contact your GP surgery directly. Their website should have a dedicated page or email for patient services.
• For hospital records: You'll need to get in touch with the specific NHS Trust that runs the hospital. Look for their 'Patient Services' or 'Access to Health Records' team.
• For private care: Reach out to the individual clinic or consultant's office where you had your treatment.

Finding the right contact details is usually just a quick search away. If you get stuck, a phone call to their main reception should point you in the right direction.

Pro Tip: When you call, ask for the direct email address for the 'Subject Access Request team' or 'Medical Records Department'. Sending your request to a general inbox can sometimes add days to the processing time.

Prepare Your Identification

It’s a legal requirement for any healthcare provider to verify who you are before they release sensitive medical information. This is a crucial step to protect your privacy and prevent fraud, so having your ID documents ready will speed things up a lot.

You’ll almost certainly be asked for proof of who you are and where you live.

Commonly Accepted Forms of ID:

• Proof of Identity: A clear copy of your passport photo page or your driving licence photocard.
• Proof of Address: A recent utility bill (like gas, electric, or council tax from the last three months) or a bank statement showing your current address.

Make sure your copies are clear and easy to read. A blurry phone picture of your passport might get rejected, forcing you to resubmit and start all over again. For a deeper look into what patients are typically asked for, you can explore our comprehensive patient information section.

Be Specific About What You Need

Finally, one of the best ways to keep the process smooth is to be really precise about what you’re asking for. You have the right to request your entire medical file, but this can be a huge amount of data and often takes longer for the team to compile. A lot of the time, you only need information from a specific period or about a particular condition.

Take a moment to think about why you need the records. Are you just looking for blood test results from last year? Or the consultant’s letter about a knee injury from 2022? By narrowing your focus, you help the records team find exactly what you need much faster.

Instead of saying, "I want my medical records," try something more specific like: "Please provide all records related to my cardiology consultations with Dr Smith between January 2023 and December 2023." That kind of clarity helps everyone involved.

Before you hit send on that email or letter, it's worth running through a quick checklist to make sure you've got everything covered. This simple step can be the difference between a swift response and weeks of delays.

Checklist for Submitting Your Request

Having these details ready from the start shows you're organised and makes the entire process more efficient for the administrative team handling your request. It's a small effort that pays off.

Right, you’ve got your ID sorted and you know exactly what information you need. Now it’s time to actually send the request. This is the step that officially starts the clock on the 28-day countdown for the hospital or GP surgery to get back to you.

Most large NHS trusts and private hospitals have their own online portals or specific forms for these requests, known as Subject Access Requests (SARs). Honestly, if they have one, use it. It’s almost always the fastest route because it forces you to provide all the information they need upfront and usually lets you upload your ID documents right there and then.

If you can’t find a portal, a clear email or even a formal letter will do the job just fine.

Crafting a Request That Gets a Fast Response

Whether you're using a form, an email, or a letter, clarity is everything. Your main goal is to make it dead simple for the records team to figure out who you are and what you want. I’ve seen so many requests get delayed just because they were too vague. Be precise.

A little bit of effort here will save you a ton of back-and-forth later on.

Make sure you include these key details:

• Your Full Name and Date of Birth: This is non-negotiable. It’s how they’ll find you.
• Your NHS Number: If you have it handy, include it. It helps them identify your file with 100% certainty.
• Your Address and Phone Number: They'll use this to cross-reference your identity and get in touch if they have any quick questions.
• Specifics of the Records You Need: Don't just say "my records." Be specific. For example, "all GP records from 2023," "the A&E report from my visit on 15 May 2024," or "all correspondence about my knee surgery."

This infographic gives a great visual summary of what you need to have ready.

As you can see, knowing who holds the data, having your ID ready, and being specific about your needs are the cornerstones of a successful request.

Patient access has come a long way, especially with GP records going digital. Since 2015, all GP surgeries in England have been required to offer online access to summary records like medications and allergies. Early studies showed this could cut down on face-to-face appointments by up to 12%. Initiatives like the NHS Long Term Plan are still pushing for patients to have more control, but hospital records are often a bit behind GPs when it comes to full digital access.

A Simple Template to Get You Started

To make it even easier, here’s a straightforward template you can copy and paste. Just fill in your details, and it’ll cover all the essential points professionally.

Subject: Subject Access Request – [Your Full Name] – DOB: [Your Date of Birth]

Dear Sir/Madam,

Please treat this as a formal Subject Access Request under Article 15 of the GDPR and the Data Protection Act 2018.

I am requesting a copy of the following personal information that [Name of GP Surgery/Hospital Trust] holds for me:

• [List the specific records you need here. For example: "All records related to my dermatology appointments with Dr. Smith between June 2023 and August 2023."]

My details to help you locate my records are:

• Full Name: [Your Full Name]
• Date of Birth: [DD/MM/YYYY]
• Address: [Your Full Address]
• NHS Number (if known): [Your NHS Number]

I have attached a copy of my [Passport/Driving Licence] and a recent [Utility Bill/Bank Statement] as proof of my identity.

I would prefer to receive this information digitally (as a PDF) at this email address. Please let me know if you need anything else from me.

Yours faithfully,

[Your Full Name]

If you hit a roadblock or just want some extra guidance, don't hesitate to get in touch with our team at The Vesey. And while not as common these days, if you find yourself needing to send documents via fax, it's worth knowing about HIPAA compliance for faxing healthcare documents to ensure your data stays secure.

One last tip, and it’s a crucial one: keep a copy of your request. Save the email in your 'Sent' folder or take a photo of the letter before you post it. Note the date you sent it. This little piece of proof is your best friend for tracking the 28-day timeline and chasing them up if you don’t hear back.

What to Expect After You Send Your Request

So, you’ve sent off your request. What happens now?

This is often the bit where you have to play the waiting game, which can be tough if you need the information urgently. But knowing the official process can help set your expectations and give you peace of mind. The moment the healthcare provider receives your request, the clock starts ticking.

Under the Data Protection Act 2018, they have 28 days to get a copy of your records to you. This is a legal deadline, not a friendly suggestion. It’s a good idea to jot down the date you sent your request so you know exactly when that 28-day window is up.

Understanding the Official Timeline

For most requests, you should get a response well within that 28-day period.

However, the law does allow for an extension in a few specific situations. If your request is particularly complex—say, you’ve asked for a huge volume of records going back decades—the provider can extend the deadline by up to another two months.

If they need to do this, they can't just leave you hanging. They must let you know within the first 28 days and explain exactly why the delay is necessary. Honestly, this is pretty rare and is usually only for the most complicated cases.

Remember, the clock starts from the moment the provider receives your request, not when they get around to opening it. This is why keeping a record—like a saved email or proof of postage—is your best friend for tracking the timeline.

Will You Have to Pay a Fee?

This is one of the most common questions we get, and the answer is almost always a good one: getting a copy of your medical records is completely free of charge. This is a key right under GDPR, making sure money isn't a barrier to accessing your own health information.

There are, however, a couple of rare exceptions where a "reasonable fee" might come into play:

• If your request is 'manifestly unfounded or excessive': This usually applies if you keep asking for the same information over and over again without a good reason.
• If you ask for more copies of the same information: Your first copy is free. If you lose it and need another one, the provider can charge a small administrative fee.

For a standard, first-time request, you shouldn't expect to pay a penny. If a provider tries to charge you without a valid reason, you have every right to challenge it.

How Your Medical Records Will Arrive

Your records can be delivered in a couple of ways, and you can usually say which you'd prefer when you first ask. These days, a digital copy is often the most convenient.

• Digital Format: This is the most common method. You’ll likely get a password-protected PDF sent via a secure email or a link to a private online portal. It's fast and easy to store.
• Paper Format: You might receive a physical stack of printed documents in the post. This tends to happen with older records that were never digitised.

No matter the format, the provider has a duty to keep your data secure. For a deeper dive into how your sensitive information is kept safe, you can read our article on protecting patient data and privacy.

It's also worth remembering that the wider pressures on the UK healthcare system can sometimes slow down administrative tasks like this. With the NHS facing significant backlogs, resources can be stretched thin. For instance, some analyses show that nearly 23% of adults have spotted inaccuracies in their patient records, which really highlights the importance of getting things right. These systemic challenges are why being clear and patient in your request helps everyone. You can read more about the NHS backlog data analysis on bma.org.uk.

Ultimately, once you’ve sent your request, the process is straightforward. You wait for the provider to confirm it's you and gather the documents, and you should have them within 28 days, free of charge. Knowing these steps keeps you in control and lets you know when and how to follow up if needed.

Solving Common Problems with Your Request

Even when you follow every step perfectly, sometimes things don’t go as planned. You might find yourself waiting longer than the official 28-day timeline, or perhaps you’ve received a response that feels incomplete.

Don’t worry—this is where knowing your rights and the next steps becomes crucial. Dealing with these issues can be frustrating, but there are clear, established pathways to resolve them. Whether it’s a simple delay or a more serious issue like an outright refusal, you have options. The key is to act methodically and keep a record of all your communications along the way.

Think of this part of the guide as your troubleshooting manual. We'll walk through the most common hurdles you might face and give you the practical advice needed to get things back on track.

The Provider Is Taking Too Long

The most frequent problem by far is a delayed response. It's important to remember that the 28-day deadline is a legal requirement, not just a guideline. If you haven't heard anything by day 29, it's time to act.

Your first move should be a polite but firm follow-up. Send an email to the same contact you used for your initial request, referencing the date you first sent it. A simple message reminding them of the legal deadline is often all that’s needed to prompt action from a busy administrative team.

If another week goes by with no response, it’s time to escalate. Your next step should be a formal complaint directly to the healthcare provider. Most NHS Trusts and private clinics have a dedicated complaints department or a Patient Advice and Liaison Service (PALS).

• PALS (Patient Advice and Liaison Service): PALS is an excellent resource within the NHS. They are there to help resolve issues informally and can often chase up departments on your behalf.
• Formal Complaints Department: Submitting a written complaint puts your issue on the official record and requires the provider to investigate and respond formally. You can find more details about how this works by reviewing an organisation’s official procedure, such as our own detailed complaints policy.

You've Been Refused Access

It’s very rare for a healthcare provider to flat-out refuse a request for your own records, but it can happen. Under the Data Protection Act, access can be denied, but only under very specific and limited circumstances.

For instance, a provider might withhold information if they believe releasing it could cause serious physical or mental harm to you or someone else. They can also withhold information that identifies another person (unless that person has consented).

If your request is refused, the provider must tell you why in writing. A vague refusal without a clear, legal reason is not acceptable. You absolutely have the right to challenge their decision.

You've Found an Error in Your Records

What happens if you finally get your records, only to discover something is wrong? It could be a simple factual error, like an incorrect date of birth, or something more significant, like a misrecorded diagnosis.

You have a legal right to have inaccurate information corrected. The first step is to contact the provider again, in writing. Clearly state what information you believe is incorrect and provide any evidence you have to support your claim. For instance, if a date is wrong, you could provide a copy of a document showing the correct one.

The provider doesn’t have to remove the original entry if a clinician stands by their professional opinion. However, they must add a note to your file detailing your disagreement. This ensures anyone who reads the record in the future sees your side of the story.

A Quick Troubleshooting Guide

Hitting a wall with your request can feel disheartening, but most issues have a clear resolution path. Here’s a quick-reference table to help you figure out what to do next.

This table should help you manage the initial steps. Remember to keep a log of all communications—it will be vital if you need to take things further.

When All Else Fails: The ICO

If you’ve tried these steps and are still not satisfied with the outcome, you can escalate your complaint to the Information Commissioner's Office (ICO).

The ICO is the UK's independent authority set up to uphold information rights. They can investigate your case and have the power to order the healthcare provider to comply with the law. Filing a complaint with the ICO is free and can be done through their website, but you should always try to resolve it with the provider first.

Common Questions About Accessing Medical Records

Even with a clear plan for requesting your medical records, you’re bound to hit a few specific, nagging questions. Unique situations pop up, and it’s easy to feel unsure about what to do next. Let’s tackle some of the most common queries we see, so you can handle any scenario with confidence.

Getting these final details right can be the difference between a smooth request and a frustrating one. We’ll cover everything from potential refusals and historical records to what you should (and shouldn't) expect to pay.

Can a Hospital Legally Refuse My Request?

Yes, but only in very specific and limited circumstances. A healthcare provider can’t just turn down your request because it’s inconvenient. The Data Protection Act 2018 sets out clear, valid reasons for a refusal, and they are not loopholes.

The most common grounds for refusal involve preventing harm. Access might be denied if releasing the information is likely to cause serious physical or mental harm to you or someone else. They can also withhold parts of a record that contain information about another person (a third party) if that individual hasn't consented to their data being shared with you.

If your request is denied, the provider is legally required to tell you in writing and explain the specific reason why. A generic "no" is not good enough—you have a right to a clear justification.

How Much Does It Really Cost to Get My Records?

For the vast majority of cases, the cost is £0. Under GDPR, your first copy of medical records must be provided completely free of charge. This is a crucial right that ensures money is never a barrier to accessing your own health data.

However, there are a couple of situations where a "reasonable fee" can be charged. This is purely to cover administrative costs and only applies if your request is:

• Repetitive: You’re asking for the same information you’ve already received.
• "Manifestly unfounded or excessive": This is a high bar and usually applies to requests made with no real purpose other than to cause disruption.
• For further copies: You want additional copies of records you have already been given.

For a standard, first-time request, you shouldn’t expect to pay a penny.

Is There a Limit to How Far Back I Can Request?

Legally, no. There’s no time limit on how far back you can request your medical records. You are entitled to ask for your entire file, right back to your very first appointment with that provider.

The practical reality, however, depends on what still exists. NHS guidelines recommend that adult health records are kept for a minimum of eight years after the last treatment. For children, records are typically held until their 25th or 26th birthday.

Many providers, especially with the shift to digital systems, will hold records for much longer. But if you're asking for paper files from decades ago, be prepared for the possibility that they may have been securely destroyed as part of a routine data retention policy.

Can Someone Else Request My Records for Me?

Yes, but only if they have your explicit permission or the legal authority to act on your behalf. This is a critical privacy safeguard.

For another adult to make a request, they will need your clear, written consent. The only other main exception is if someone holds a health and welfare lasting power of attorney (LPA) for you. For children, a person with parental responsibility can request records, but if the child is mature enough to understand the request, their own consent might also be needed.

At The Vesey, we believe in empowering patients with clear, accessible information to manage their health. If you're facing delays or need faster access to specialist care, our private GP services and consultant-led clinics are here to help. Explore your options at https://www.thevesey.co.uk.