You're usually not looking for your medical records out of idle curiosity. You need them because something has gone wrong, or because you're trying to stop the next thing from going wrong.
It might be a specialist appointment where you know the referral history matters. It might be a benefits form, an insurance issue, or a second opinion after months of being told your tests were “normal”. Often it's the point where you realise your care has been split across a GP surgery, one or more hospital trusts, community services, and perhaps mental health support, and nobody seems to hold the full picture in one place.
That fragmentation is what catches people out. The legal right to ask for your records is straightforward. The practical job is identifying every organisation that holds part of the story, then requesting it in a way that gives you something usable rather than a thin, partial bundle.
Table of Contents
- Your Right to Access Your Health Information
- Preparing Your Subject Access Request
- Navigating the Request Process and Timelines
- Understanding Common Redactions and Exceptions
- Troubleshooting Delays and Unlawful Refusals
- Special Cases for Requesting Medical Records
Your Right to Access Your Health Information
When patients feel dismissed, records often become the first solid thing they can hold onto. A consultation may have felt rushed. A referral may never have been sent. Symptoms may have been labelled as anxiety without proper follow-up. Once that happens, seeing the notes matters. You need to know what was recorded, what was omitted, and whether one provider told another something different.
In the UK, the normal route is a Subject Access Request, often shortened to SAR. This is not a hostile move. It's the standard legal mechanism for asking for your own personal data from the organisation that holds it. For health records, that usually means your GP practice, an NHS trust, or another provider directly involved in your care.
Why this right matters in real life
If you've got a long history, the issue usually isn't whether records exist. It's whether you can get them in a form that helps you understand your care journey.
That's especially true if you're trying to do any of the following:
- Prepare for a second opinion so the next clinician sees prior investigations, referrals and medication history.
- Build a complaint file where dates, wording and chronology matter.
- Support ongoing care when one part of the NHS doesn't seem to know what another part has done.
- Check accuracy if you suspect something important was recorded wrongly.
Practical rule: Asking for your records is not an accusation. It's basic housekeeping when your care has become complicated.
What organisations can and can't do
Organisations should usually provide the information free of charge, unless the request is manifestly unfounded or excessive, and they may ask for ID only where they have reasonable doubts about identity. The one-month clock does not usually start until they have enough information to confirm who you are and locate the records, which is why vague or incomplete requests often get stuck, as noted in UK information access guidance.
That last point holds greater significance than is commonly realised. Patients often think they've made a request, then hear nothing, when in fact the provider is waiting for proof of identity or enough detail to find the right records. If you want a clean paper trail, send a clear request, identify the provider correctly, and include what they reasonably need at the start.
Preparing Your Subject Access Request
The most common mistake is sending one broad email to a GP surgery and assuming that covers everything. It doesn't. If you want to know how to request medical records in a way that works, start with the assumption that your NHS history is split across separate controllers.
Start by mapping where your records actually are
A GP record may include referrals, letters received, medication history and consultation notes. It usually won't be the same as the full hospital record. Hospital trusts hold their own notes, clinic letters, discharge summaries, imaging reports and internal correspondence. Community teams and mental health services may hold separate files again.
That's why the practical problem is often not “how do I ask?” but “who do I ask first?”. UK guidance recognises that patients can make a Subject Access Request to any organisation holding their data, but NHS care is fragmented across GP systems, hospitals, community teams and shared-care pathways. Many patients need to chase multiple providers separately to avoid partial disclosure, as discussed in this guidance on fragmented medical record requests.
A simple mapping list helps. Before you write anything, note:
- GP practice with dates you were registered if relevant.
- Hospital trusts where you attended A&E, outpatient clinics, surgery, imaging or inpatient care.
- Community services such as physiotherapy, district nursing, pain clinics or specialist teams.
- Mental health providers if they were separate from your GP or acute trust.
- Any private provider if part of your pathway happened outside the NHS.
Write a request that asks for a usable record
Many people ask for “my records”. That's legally understandable, but it often produces a messy or incomplete response. If your goal is continuity of care or a complaint file, ask for a complete chronological copy of the records held by that organisation.
Use plain wording. For example:
Please treat this as a Subject Access Request for a copy of my personal data and medical records held by your organisation. I am requesting a complete chronological copy of records relating to my care, including consultation notes, referral letters, clinic letters, test results, imaging reports, discharge summaries, correspondence, and any other records held in electronic or paper form.
Then narrow it if needed. If you only need cardiology, rheumatology, neurology, gynaecology, or a specific period, say so. Specific requests are easier to process, but if you're building a full chronology, don't make the date range so narrow that key context disappears.
If you want a starting point, this example letter for an NHS records request is useful as a structure. Adapt it to each organisation rather than sending the same generic note everywhere.
What to include so your request doesn't stall
Think like the records team. Their first job is to identify you and locate the file.
Include:
- Your full name, including any previous names relevant to the records.
- Date of birth.
- Current address and any former address linked to the provider if useful.
- NHS number if you know it. If you don't, don't panic. It helps, but it isn't the only way to identify a record.
- Hospital or clinic identifiers if you have them, such as a patient number from letters.
- A clear description of what you want.
- How you'd like the records sent, if the provider offers options.
- Proof of identity, where reasonably requested.
This video gives a good general overview of the request process and what patients should prepare before sending it.
A practical trade-off matters here. If your request is too broad and vague, the provider may come back asking questions. If it's too narrow, you may receive a bundle that misses the very entries you later need. For people with long-term conditions, I usually favour broader wording with a defined provider and a sensible date range, because that's more likely to produce a record you can use.
Navigating the Request Process and Timelines
Once you've sent the request, the next problem is uncertainty. Patients are often told to “allow some time” without anyone explaining what that means in legal or practical terms.
When the clock starts
In England and Wales, a person can usually request their own medical records by making a Subject Access Request under UK GDPR, and the controller must respond without undue delay and in any event within 1 month of receiving the request. If the request is complex, the deadline can be extended by up to 2 further months. The request doesn't have to use a special form, though the organisation may ask for enough information to confirm identity and locate the records, as set out in this summary of UK medical record request timing rules.
In practice, that means you should keep a copy of exactly what you sent and the date you sent it. If the provider asks for ID or clarification, reply promptly and keep that exchange too. A complete paper trail matters if you later need to challenge delay.
What a proper response looks like
Responses arrive in different forms. Some providers send a secure digital file. Some use an encrypted email portal. Some still post printed records or printouts from a clinical system. None of those formats automatically tells you whether the disclosure is complete.
A proper response usually includes one of two things:
| Outcome | What you should expect |
|---|---|
| Records disclosed | A copy of the information held, often with covering correspondence |
| Delay or extension | A clear explanation, not a vague holding reply |
If the provider says the request is complex and needs more time, they should explain that within the first month. If they go silent, that's different.
For general patient questions about NHS rights and delays, the Finally Seen FAQ page is a sensible reference point.
How to check whether the bundle is complete
Don't start by reading every page in depth. First, sense-check the shape of what you've received.
Use this quick audit:
- Check the date span. Does it cover the period you asked for?
- Check the record types. If you asked for consultation notes, letters and test results, are all three there?
- Check known events. Can you find the A&E visit, key referral, surgery, or appointment you already know happened?
- Check whether the provider only sent portal extracts. That may be useful, but it may not be the full underlying record.
- Check for missing departments within the same organisation.
If a bundle contains only a handful of documents from a long care history, assume it may be partial until proved otherwise.
This stage is where many people discover the underlying problem wasn't delay. It was that they asked the wrong organisation, or asked the right organisation in wording that led to a narrow disclosure.
Understanding Common Redactions and Exceptions
Few things unsettle patients faster than seeing black boxes across a page. Sometimes that's a warning sign. Sometimes it's completely lawful.
When blacked-out sections may be legitimate
Two common reasons explain many redactions in medical records.
One is information that identifies a third party who hasn't consented to disclosure. That could be a relative, another patient, or someone who provided information in confidence. The provider may decide that part shouldn't be released to you in full if doing so would unfairly reveal someone else's personal data.
The other is where disclosure would be likely to cause serious harm to the physical or mental health of you or another person. This tends to concern sensitive clinical material, not routine notes.
A few practical examples help:
- A clinician's note mentions something told to them by a family member. The family member's identifying details may be removed.
- A record references another patient by name. That name may be redacted.
- A mental health entry may be reviewed carefully if the provider believes immediate disclosure could cause serious harm.
That doesn't mean every missing line is justified. It means some redactions are part of normal lawful disclosure.
What to ask if the response feels incomplete
Start with questions, not accusations. Ask the provider to confirm whether the response is intended to be the full disclosure for your request, and whether any information has been withheld or redacted. If so, ask for the basis in plain terms.
A short message often works best:
I'm reviewing the records provided and would be grateful if you could confirm whether this is the complete response to my Subject Access Request. If any material has been withheld or redacted, please confirm the general basis for doing so.
Keep your focus on completeness and category. Avoid speculative language about concealment unless you have a solid reason. Records teams are more likely to engage constructively when the question is precise.
Some redactions are lawful. A response that omits whole categories of records without explanation deserves closer scrutiny.
Troubleshooting Delays and Unlawful Refusals
When providers miss deadlines, patients often make the same understandable mistake. They keep sending fresh requests. That resets the conversation and muddies the paper trail. A better approach is to treat the original request as live, then escalate methodically.
What to send when the deadline has passed
In the UK, a patient's first practical step is to submit a subject access request to the controller that holds the records, and UK GDPR sets a one-month response deadline from receipt. Controllers can extend by up to two further months only for complex or numerous requests, but they must tell the requester within the first month and explain why the extension is needed, as outlined in this step-by-step guide to the medical records request process.
If that period has passed and you've had no lawful extension, send a short follow-up tied to the original request. For example:
I'm following up my Subject Access Request dated [date], sent to [team or address]. I haven't received the records requested or notification of any lawful extension. Please confirm the status of my request and provide the outstanding response.
That wording does two jobs. It reminds them of the deadline, and it avoids starting over.
When to complain to the provider
If a follow-up doesn't work, complain to the organisation itself. For GP practices, that may be the practice manager. For trusts, it may be the complaints team, records department, data protection officer, or PALS depending on the issue.
Use a firm structure:
- State the original request date and where it was sent.
- State what has gone wrong, such as delay, no response, unjustified extension, or partial disclosure.
- State what you want now, usually the complete response and an explanation.
- Attach evidence including the original request and follow-up emails.
If the records matter because you're preparing a broader NHS complaint, this guide on making a formal complaint about NHS care can help you keep the records issue aligned with the bigger paper trail.
When to escalate outside the provider
Patients often mix up the roles of the external bodies. Keep them separate.
| Problem | Better route |
|---|---|
| Your data access rights weren't handled properly | Information Commissioner's Office |
| The NHS service itself failed and local complaint handling has run its course | Parliamentary and Health Service Ombudsman |
Go to the ICO when the issue is access to data, delay, refusal, unreasonable identity demands, or a disclosure that appears improperly handled. Go to the PHSO when you're challenging the quality of NHS service and complaint handling more broadly.
That distinction matters because one issue often sits inside the other. You may need the records first so you can properly present the care complaint later.
Build the paper trail in layers. Original request, follow-up, formal complaint, then external escalation if needed.
What doesn't usually work is an angry burst of emails to multiple inboxes with slightly different wording. What does work is one documented path, each step attached to the last.
Special Cases for Requesting Medical Records
Not every request is an adult asking for their own file. The rules become more fact-specific when you're acting for someone else.
Requesting records for a child
Parents often assume they can automatically access a child's record. Sometimes that's straightforward. Sometimes it isn't. The provider may consider parental responsibility, the child's own ability to understand and consent, and whether disclosure would be in the child's interests.
In practice, the strongest requests are the clearest ones. Identify your relationship to the child, explain your authority, and specify exactly which provider holds the records. If the child is older and the provider raises consent issues, ask for the basis of that decision in writing.
Requesting records for another adult
If you're acting for another adult, providers usually need evidence that you have authority to do so. That may involve a signed authority from the patient or formal legal authority such as a relevant power of attorney, depending on the circumstances and the provider's requirements.
This is one of the few areas where over-preparing helps. Send the authority document, proof of identity, and a precise explanation of your role at the outset. If you leave the provider guessing, the request often stalls in administrative limbo.
Requesting records after someone has died
A key part of the UK framework is the Access to Health Records Act 1990, which created a statutory route for access to records of deceased patients and still matters in NHS record request practice today, as explained in this overview of medical records access routes.
This is also where record fragmentation still matters. Even after someone has died, you may still need to identify the correct record holder first because records may sit with a GP, hospital, or another provider. Depending on local arrangements, requests may be made in writing, online, by email or through a patient portal. The same general practical lesson applies throughout: identify the right holder, ask clearly, and keep copies of everything. Most subject access requests for personal data are free, with only limited exceptions.
If you're requesting records in any special-case situation, don't assume the obstacle is legal refusal. Quite often it's a poor request to the wrong organisation with too little supporting paperwork. Fix that first.
If you need help creating a proper paper trail with your GP, Finally Seen Ltd drafts formal, personalised letters that cite the exact NICE guidance your GP is expected to follow. It's built for patients who are being dismissed, delayed, or left to chase referrals and treatment without clear written answers, and it includes a complaints pack for escalation if the response never comes.