How to Write a Letter Requesting Your Medical Records UK: A Complete Guide
Your medical records belong to you. Every test result, every GP note, every hospital letter, every prescription history, every consultant report written about you is information you have a legal right to access. You do not need to explain why you want it, you do not need a solicitor to request it, and in almost all cases you do not need to pay for it.
This guide explains the legal basis for accessing your records, the different routes available, when a formal letter is the right approach, what to include in that letter, how long the provider has to respond, and what to do if they refuse or delay.
Your Legal Right to Access Your Medical Records
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have a legal right to request a copy of any personal data held about you by any organisation, including NHS trusts, GP practices, private hospitals, dentists, opticians and mental health services. This right is exercised through what is formally called a Subject Access Request (SAR). As the ICO’s guidance on getting copies of your information confirms, you can make a SAR verbally or in writing, to any part of the organisation, and you do not have to use any specific form of words. The request just needs to make clear that you are asking for your personal data.
Your right of access covers all personal data held about you, which in a medical context includes clinical notes, letters between healthcare professionals about your care, test results, X-rays, scans, prescriptions, referral letters, discharge summaries, assessment reports and any other record that identifies you and relates to your health.
There is no charge for a Subject Access Request in most circumstances. The provider can only charge a fee if the request is manifestly unfounded or excessive, or if you are requesting additional copies of information already provided.
You do not need to give a reason for requesting your records. The right is unconditional. A provider cannot refuse because they do not know why you want the records, because the records relate to sensitive information, or because the records include information about your mental health.
The Different Routes to Your Records
The NHS App
If you are registered with a GP in England, the fastest route to your GP record is often the NHS App. From November 2022, all GP practices in England were required to give patients online access to new entries in their health record, including GP notes, test results, letters and prescriptions. The NHS App gives you access to this information without needing to make a formal request. This is the quickest route for recent GP records and should be your first port of call if you need current information quickly.
Note: the NHS App gives you access to your GP record only. Hospital records, mental health records and records from other healthcare settings are held separately and must be requested directly from the relevant organisation.
Contacting the Provider Directly
For records held by a hospital trust, a mental health trust, a private clinic or any other provider, you need to contact that organisation directly. Each organisation that provided your care is a separate data controller and holds its own records. There is no central database from which you can access all your NHS records in one go. You must contact each provider separately.
As NHS England’s guidance on getting copies of medical records confirms, for hospital records you should contact the records manager or patient services manager at the relevant trust. Most trusts have a dedicated access to records team or Subject Access Request team. Their contact details are usually on the trust’s website under ‘your records’ or ‘patient information.’
When a Formal Letter Is the Right Approach
Many providers accept SAR requests verbally, by phone, through an online form or by email. A formal letter is the right approach when:
The provider has not responded to a verbal or phone request
You want a clear dated record of when you made the request and what you asked for
The records you need are historic, complex or span multiple departments
You need the records for a legal claim, a complaint, a benefit application or another formal purpose
You have been told by the provider that they require a written request
You are requesting records on behalf of someone else and need to document your authority to do so
What to Include in Your Letter
A SAR does not need to be on a specific form and does not need to use legal language. It needs to be clear that you are asking for your personal data and to provide enough information for the organisation to locate your records and verify your identity.
Your full name as it appears on your records. Include any previous names if you were registered under a different name.
Your date of birth. This is the most reliable identifier for medical records.
Your NHS number if you know it. This is not essential but speeds up the process. You can find it on any NHS correspondence, on the NHS App or by calling NHS 111.
Your address or the address that would have been on your records at the time of treatment.
The period covered by your request. If you want all records, say so. If you want records from a specific period or relating to a specific condition or treatment, be specific. The ICO recommends being as specific as possible, as this helps the organisation locate the records and respond faster.
How you would like to receive the records. Electronically by secure email, by post, or to view in person.
A clear statement that this is a Subject Access Request under the UK GDPR. This ensures the organisation processes it under the correct procedure and within the correct timescale.
Full Worked Example: GP Records
[Your full name]
[Your address]
[Your date of birth]
[Your NHS number if known]
[Date]
The Practice Manager
[GP Surgery name and address]
Subject: Subject Access Request – Request for Copy of Medical Records
Dear Sir or Madam,
I am writing to make a formal Subject Access Request under Article 15 of the UK General Data Protection Regulation and the Data Protection Act 2018.
I am requesting a copy of all medical records held by [GP surgery name] in relation to me. [If you want to limit the scope: I am requesting records covering the period from [date] to [date] / records relating to my treatment for [condition or injury] / records including my GP notes, correspondence, test results and referral letters.]
My details are as follows:
Full name: [Your full name]
Date of birth: [Date]
NHS number: [Number if known]
Address registered with the surgery: [Address]
I understand you may need to verify my identity before releasing the records. I am happy to provide a copy of [state your ID, e.g. my passport / driving licence / utility bill] and will do so upon request.
I would like to receive the records [electronically by secure email / by post / to view in person at the surgery]. My preferred contact details are [email / address].
I understand that you are required to respond to this request within one calendar month of receipt. Please confirm receipt of this request in writing.
Yours sincerely,
[Your name]
[Signature]
Full Worked Example: Hospital Records
[Your full name]
[Your address]
[Your date of birth]
[Your NHS number if known]
[Date]
Subject Access Request Team
[Hospital trust name and address]
Subject: Subject Access Request – Request for Copy of Hospital Records
Dear Sir or Madam,
I am writing to make a formal Subject Access Request under Article 15 of the UK General Data Protection Regulation and the Data Protection Act 2018.
I am requesting a copy of all records held by [hospital trust name] in relation to my care and treatment. [If you want to limit the scope: I am specifically requesting records relating to my admission to [ward name] on [date or approximate period] / my outpatient appointments in the [department] department between [dates] / my treatment for [condition].]
My details are as follows:
Full name: [Your full name]
Date of birth: [Date]
NHS number: [Number if known]
Hospital number / patient reference number: [If known]
Address at the time of treatment: [Address]
I am happy to provide proof of identity and will supply this on request. I would like to receive the records [electronically / by post / to view in person].
Please confirm receipt of this request and advise me of the expected timescale for your response.
Yours sincerely,
[Your name]
[Signature]
Requesting Records on Behalf of Someone Else
You can make a Subject Access Request on behalf of another person if they have given you authority to do so. The organisation will need evidence of that authority before releasing records. What they require varies by organisation but typically includes a signed letter of authority from the patient, or where the patient lacks mental capacity, a registered Lasting Power of Attorney for health and welfare.
For a child under 13, parents or those with parental responsibility can generally access the child’s records. For a child aged 13 to 16 who has the capacity to consent, the child’s consent is required before a parent can access their records. For a young person aged 16 or 17, they are generally treated in the same way as an adult for data protection purposes.
For records relating to a person who has died, the UK GDPR does not apply as it only covers living individuals. Access to the records of a deceased person is governed by the Access to Health Records Act 1990. Under this Act, the personal representative of the deceased (the executor or administrator of the estate) and any person who has a claim arising from the person’s death may apply for access to relevant records. State your legal basis and relationship to the deceased clearly in your letter.
What Happens After You Send the Letter
The organisation has one calendar month from the date it receives your request to respond. If the request is complex or the organisation receives multiple requests, it can extend this by a further two months, but it must inform you within the first month that it is doing so and explain why.
The organisation may ask you to verify your identity before it starts processing the request. The one-month clock does not start until you have provided the identity information it needs. Provide this promptly.
When the records arrive, read them carefully. If you find inaccuracies, you have the right under UK GDPR to request that they be rectified. Write to the organisation identifying the specific inaccuracy and what the correct information should be. The organisation must respond to a rectification request within one month.
If the Provider Refuses or Delays
There are limited circumstances in which a provider can withhold medical records or parts of them. These include where disclosure would be likely to cause serious harm to the physical or mental health of the patient or another person, or where the records contain information about a third party who has not consented to disclosure. If records are withheld, the organisation must tell you what has been withheld and why.
If your request is refused without adequate reason, if the provider does not respond within the required timescale, or if you believe records have been withheld inappropriately, you can make a complaint to the Information Commissioner’s Office (ICO). The ICO is the independent supervisory authority for data protection in the UK and can investigate failures to comply with SAR requests. You can complain online at ico.org.uk or by calling 0303 123 1113.
Before complaining to the ICO, raise the matter with the organisation’s Data Protection Officer. Every NHS trust and GP practice must have one, and their details should be on the organisation’s privacy notice. A complaint to the DPO gives the organisation a final opportunity to resolve the matter before the ICO gets involved.
Getting Help
Free advice on your data protection rights, including how to make a Subject Access Request for medical records, is available from the ICO at ico.org.uk. Citizens Advice can also help you understand your rights and draft a complaint if a request has been ignored or refused. If you want help drafting a clear, correctly structured request letter for your medical records, the team at LetterLab can help you get the wording right before you send it.
Quick Checklist: Before You Send Your Request
Have you included your full name, date of birth and NHS number?
Have you specified the period covered by your request or the treatment it relates to?
Have you stated clearly that this is a Subject Access Request under the UK GDPR?
Have you stated how you would like to receive the records?
Are you sending the letter by email or recorded post so you have dated proof of delivery?
Have you kept a copy?
If requesting records on behalf of someone else, have you enclosed evidence of your authority to do so?
The Key Takeaway: It Is Your Information and You Are Entitled to It
Your medical records are a detailed account of your health history and they belong to you. The right to access them is not a courtesy that providers can choose to extend or withhold. It is a legal right under UK GDPR, it is free to exercise in almost all cases, and it carries a legal deadline for the provider to respond.
Write formally, be specific about what you want, state the legal basis and give the provider your identity information upfront. If they do not respond within the month, the ICO is there to enforce compliance. Your records, your right.
Comments