How to request your medical records: GP, hospital and dentist records in the UK

You may want your records to understand your care, to make a complaint or to find out whether you have a claim. In England, the NHS App already shows some documents from your GP surgery and hospitals, and in Northern Ireland the My Care portal gives online access to parts of your records. This guide explains how to ask for a full copy, how the time limit is worked out, what can be held back, how to get the records of someone who has died and how records are used in a claim.

It is general information, not legal advice. If you are thinking about a claim, see our guide to medical negligence claims.

Where your records are held

Your records are held by each place that treated you: your GP surgery, and the hospitals and other health services where you had appointments or treatment. You ask each organisation for the records it holds. In Northern Ireland, hospital and community records have been brought together into one electronic patient record, while GP records are held separately.

In England, if you are 13 or over and registered with a GP, you can use the NHS App to view documents from your GP surgery and from hospitals and specialists, such as referral letters, discharge documents and scan reports. If you need more than the app shows, ask the organisation for a copy.

How to ask for your records

There are no formal requirements. You can ask verbally or in writing, including by email or social media, and you can ask any part of the organisation. You do not have to use the words subject access request, although a heading that says so helps. Anyone can make a request without a solicitor. The Information Commissioner's Office (ICO) suggests including:

• your name and any previous names, your contact details and your NHS number;
• which records you want, with dates or other details that will help the organisation find them;
• how you would like to receive them, for example electronically or by post.

Keep a copy of your request and any proof of postage. Because health information is sensitive, the organisation may ask for ID, and the one-month time limit only starts once it has what it needs from you. Someone else, such as a relative or a solicitor, can ask for you if they can show they have your permission.

How long the organisation has to reply

The organisation must reply without undue delay and at the latest within one month of receiving your request, or of receiving any ID, proof of authority or fee it asked for. The ICO explains how to count the month:

• start from the date the request was received, even if that was not a working day, and count to the same date in the following month;
• if that date does not exist, because the next month is shorter, use the last day of that month;
• if the date falls on a weekend or a public holiday, the deadline moves to the end of the next working day.

The organisation can extend the time by two further months, counted as three months from the start, if the request is complex or you have made several requests, but it must tell you, with its reasons, within the first month. Needing a health professional's opinion on the records can make a request complex. If the organisation reasonably asks you to clarify what you want, the clock stops on the day it asks and restarts on the day after you reply.

Cost, format and what you receive

Copies are normally free. An organisation can charge a reasonable fee only if a request is manifestly unfounded or excessive, or if you ask for further copies, and in general it cannot charge for health information. If you asked electronically, the information should be provided electronically where possible (Article 12 of the UK GDPR). You are entitled to your own personal information rather than every original document, so you may receive new documents that contain only your information, or originals with some details removed.

In Northern Ireland, nidirect says records are provided free in most cases, although in some circumstances a fee can be charged and you will be told about it.

What can be withheld

Health information can be withheld to the extent that disclosing it would be likely to cause serious harm to the physical or mental health of anyone. Only a health professional, or an organisation that has obtained the opinion of the appropriate health professional within the last six months, can rely on this. Information about other people, such as family members, may be removed, although it is normally reasonable to disclose the names of health professionals carrying out their duties. If a parent asks for a child's records, information the child gave in the expectation that it would not be shared with the parent can be withheld.

If an organisation does not act on your request, it must tell you why and how you can complain (Article 12 of the UK GDPR), although with health information it may not always be able to explain why something was withheld.

Records of someone who has died

Data protection rights only protect living people, so a subject access request cannot be used for the records of someone who has died. Instead, in England, Wales and Scotland, the patient's personal representative, and any person who may have a claim arising out of the death, can apply to the holder of the records under section 3 of the Access to Health Records Act 1990. No fee can be charged for access. The holder must give access within 40 days, beginning with the date of the application, or within 21 days if all the records were made in the 40 days before it. If it needs more information to identify the patient or to check you are entitled to apply, and asks for it within 14 days, the time runs from the date you provide it.

Parts can be withheld if they would be likely to cause serious harm, would identify another person who has not agreed (other than a health professional involved in the care), or were given by the patient in confidence. If you apply because you may have a claim, you only get the parts relevant to it, and records made before the Act came into force on 1 November 1991 are excluded unless they are needed to make later records understandable (section 5). In Northern Ireland, the Access to Health Records (Northern Ireland) Order 1993 has the same time limits, but a fee can be charged; apply to the GP or the Health and Social Care Trust.

Using your records in a complaint or claim

A solicitor can make the request for you with your authority, and records are needed for the initial investigation of a medical negligence claim. In England and Wales, the pre-action protocol for clinical disputes, which covers NHS and private providers, says requests should use the approved standard form and copy records should be provided within 40 days of the request. If the provider has not supplied them, or explained the delay, within 40 days, an application can be made to the court for pre-action disclosure under rule 31.16 of the Civil Procedure Rules.

An insurer is in a different position: the ICO says a subject access request is not appropriate where the other party's interests are not aligned with yours, and with your consent an insurer can ask your GP for a tailored medical report under the Access to Medical Reports Act 1988.

If you get no reply after a month, follow up in writing, and if you are unhappy, complain to the organisation first. You can then complain to the ICO, which asks you to do so within three months of your last meaningful contact with the organisation. The ICO cannot award compensation, but you can go to court to enforce your rights, and it strongly advises getting independent legal advice first. See our guides to medical evidence and evidence for a claim.

Frequently asked questions

Related guides: medical negligence claims, medical evidence, evidence for a claim, fatal accident claims and claim time limits.

Official sources used for this guide: ICO: Right of access guidance; ICO: Health information; UK GDPR, Article 12; Access to Health Records Act 1990, s.3; Access to Health Records (Northern Ireland) Order 1993, art.5; Pre-Action Protocol for the Resolution of Clinical Disputes; nidirect: Accessing medical records. This guide is general information about the law in the UK, not legal advice; the law can change, so check your own position with a regulated solicitor.