How do I get a copy of my medical records?

You have a right of access to your own health data under the UK GDPR and the Data Protection Act 2018. For most people the quickest route is not a letter at all: the NHS App or your practice's online service shows medications and allergies, test results, immunisations, appointments and, where the practice has enabled it, letters and clinical notes. Since November 2023 GP practices in England have had to give patients automatic access to new entries by default unless there is a clinical reason not to. Historic records are a different matter, and you may have to ask the practice to switch them on.

Making a Subject Access Request

• Work out who holds what. Your GP practice holds GP records, the relevant trust holds hospital records, and the ambulance service holds its own. Each is a separate data controller, so you may need separate requests.
• Write to the Data Protection Officer or records department — many trusts have an online SAR form. Include proof of identity, and say which records and which period you want so they can find them quickly.
• One calendar month to respond. That can be extended by up to two further months for complex or numerous requests, but they must tell you inside the first month if they are extending.
• No fee, unless the request is manifestly unfounded or excessive. You can state a format preference, and should be given something commonly used and machine-readable where that is feasible.

Refusals, corrections and deceased relatives

Access can be restricted where disclosure would be likely to cause serious harm to your physical or mental health, would reveal information about a third party who has not consented, or would prejudice the prevention or detection of crime. If anything is held back you must be told so in writing, with a reason — though they need not reveal what the withheld material says.

If something in the record is wrong, the right to rectification lets you require it to be corrected: write to the practice, which must respond within a month. Incorrect allergies or diagnoses can affect your treatment, so pursue this. Where a request is ignored, refused without adequate justification or answered late, complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.

You cannot make a SAR for someone who has died, because data protection law covers living people. Instead, as their personal representative — executor or administrator — or as someone with a claim arising from the death, apply to the NHS organisation under the Access to Health Records Act 1990. Do not leave it too long: GP records are kept for 10 years after death, and adult hospital records generally for 8 years.