You have a legal right of access to your own medical records under data protection law, you do not need to give a reason, it is normally free, and the response should usually come within one month. You ask whoever holds the records, which is not always one place.
SUBJECT ACCESS REQUEST - The formal name for asking for your own personal data, including health records. You do not have to use the phrase, and a plain written request has exactly the same effect.
Who holds my records?
Different parts of your care are held by different organisations, and this catches people out.
You GP practice holds your general practice record, including referrals and results sent back to them
Each hospital trust holds its own records, so treatment at two hospitals means two requests
Dental and optical practices hold their own separately
Private providers hold theirs, and a private consultation does not appear in your NHS record unless it was shared
How do I make the request?
Work out who to ask: list every practice, hospital and clinic involved in the period you are asking about.
Put it in writing: email or letter. Give your full name, date of birth, address, NHS number if you know it, and the period or treatment you want.
Be specific if you can, broad if you cannot: asking for everything is valid, but naming a date range or a department usually gets a faster and more useful response.
Ask for the format you want: including imaging, monitoring traces and test results if they are relevant, since these are not always sent with the written notes.
Keep a copy and note the date: the response clock starts when they receive the request.
How long should it take, and will I pay?
The response should normally arrive within one month. That can be extended where a request is particularly complex or extensive, but you should be told if that happens and why.
There is usually no charge, a fee can only be applied in narrow circumstances, such as a request that is manifestly excessive or a repeat request for the same material.
Can access be refused?
Only in limited circumstances, information can be withheld where releasing it would be likely to cause serious harm to your physical or mental health, and material identifying another person may be redacted unless they agree.
A refusal should be explained, if you think it is wring you can raise it with the organisation’s data protection officer and, failing that, with the Information Commissioner’s Office.
What about the records of someone who has died?
Access works differently, under separate legislation rather than data protection law. A personal representative of the estate can apply, as can someone who may have a claim arising from the death. A relative who is neither of those has no automatic right of access.
What do I do once I have them?
Read them, and expect them to be hard going, they will contain abbreviations, handwriting and clinical shorthand, and they may contain things you did not know or do not agree with.
What records cannot tell you is whether the care met the expected standard. That takes an independent clinician reading them against what should have happened, which is what an assessment does.
Got your records and none the wiser?
We can read them and tell you what they show, free and without obligation.
Frequently asked questions
There are more on our FAQ page.