Accessing Your Patient Records

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the right to obtain a copy of the personal data held about you — including your health records. This is known as a Subject Access Request (SAR).

NHS organisations must respond to a SAR within one calendar month of receiving it. This deadline can be extended by up to two further months for complex or numerous requests, but the organisation must tell you within the first month if an extension is needed.

Accessing your records is generally free. The NHS can charge a reasonable fee only if a request is "manifestly unfounded or excessive" — for example, if you are requesting records very frequently without good reason.

The easiest way for most patients to view their GP record is through the NHS App (free on iOS and Android) or the Patient Access platform. Through these services you can typically view:

• Medications and allergies
• Test results (including blood tests and other investigations)
• Appointment history and future appointments
• Immunisations and vaccinations
• GP letters and clinical notes (where enabled by your practice)

From November 2023, GP practices in England were required to grant patients automatic access to their prospective (new) records by default, unless there is a clinical reason not to. Some practices may not yet have full historic record access enabled. Contact your practice directly if you cannot see expected information.

To make a SAR for NHS records:

1. Identify who holds the records: GP records are held by your GP practice; hospital records by the relevant NHS trust; ambulance records by the ambulance service. You may need to make separate requests to each organisation.
2. Write to the Data Protection Officer (DPO) or records department of the relevant organisation. Many NHS trusts have an online SAR form on their website.
3. Provide proof of identity and specify what records you want and for what time period to help the organisation locate them quickly.
4. The organisation must respond within one calendar month, providing copies of your records (usually by secure electronic means or post).

If you are requesting records on behalf of someone else (for example a child or a person who lacks capacity), you must demonstrate your authority to do so.

The NHS can restrict access to your records in limited circumstances, including where disclosure would:

• Be likely to cause serious harm to your physical or mental health
• Reveal information about a third party who has not consented to disclosure (unless it is reasonable to disclose without consent)
• Prejudice the prevention or detection of crime

If access is refused or restricted, the organisation must tell you (in writing) that it is withholding information and give you a reason, though it need not reveal the content of the restricted information. You can challenge this decision by complaining to the organisation, escalating to the ICO, or taking the matter to court if necessary.