Your NHS medical records are yours. Under UK GDPR and the Data Protection Act 2018, you have the right to access personal data held about you — including your medical history, diagnoses, test results, referral letters, and clinical notes. This right is called a Subject Access Request (SAR), and the NHS is legally required to respond within one calendar month.
What Records You Can Request
You can request records held by: your GP practice (the summary care record and the detailed GP record); NHS hospital trusts (inpatient records, outpatient correspondence, test results, imaging reports); mental health trusts; community health services; and NHS 111 call records. Each organisation holds its own records — there is no single NHS database that holds everything, so you may need to make multiple requests.
You can also request records relating to a deceased person, subject to restrictions: family members do not have an automatic right to deceased patients’ records, but executors and those with a demonstrable need (such as a potential legal claim) may request access under the Access to Health Records Act 1990.
How to Make a SAR
There is no prescribed format for a SAR. You should write to the organisation’s Data Protection Officer (DPO) or patient records team — contact details are usually on the organisation’s website or can be requested from reception. State clearly: that you are making a Subject Access Request under UK GDPR; what records you are requesting (be as specific as possible about timeframe and type); and your full name, date of birth, and NHS number if you have it.
You do not need to give a reason for your request. You can make a SAR by email, letter, or using the organisation’s online form if one exists. Keep a copy of your request and note the date you sent it — this starts the one-month response clock.
What the NHS Must Provide
The organisation must provide a copy of the personal data held about you. For medical records this typically means copies of clinical notes, correspondence, test results, and other documents in which you are identified as the patient. They can provide records in electronic or paper form. They cannot charge a fee for a standard SAR; fees can only be charged for “manifestly unfounded or excessive” requests, which the ICO interprets narrowly.
Some information can be withheld: third-party information (details that could identify another person); information that could cause serious harm to you or another person’s physical or mental health (this exemption requires a healthcare professional to consider whether disclosure would be harmful); and information that is legally privileged.
If Your Request Is Refused or Delayed
If the organisation does not respond within one month, or refuses your request without adequate justification, you have two routes. First, you can complain internally to the organisation. Second, and more effectively, you can complain to the ICO — the UK’s data protection regulator. The ICO can investigate and, where it finds a breach of UK GDPR, require the organisation to comply. ICO complaints are free to make and can be submitted online at ico.org.uk.
Common problems include: organisations requesting ID documents beyond what is proportionate (one form of ID is usually sufficient); delays beyond one month without the organisation invoking the permitted extension (an additional two months is permitted for complex requests, but the organisation must notify you within the first month); and partial disclosure without explanation of what has been withheld and why.
Your Records and Cyber Incidents
If you believe your records may have been involved in a cyber security incident, a SAR can help you understand what data the organisation holds and what security measures protect it. You can also ask the organisation directly whether your records were included in any incident — organisations are required to notify individuals whose data was involved in high-risk breaches, but in practice notification has sometimes been incomplete or delayed. A direct SAR provides an additional route to that information.