How to get your NHS medical records — free, by law

Why this matters

If you've been dismissed, the record is everything. It's where you find out whether what you said was actually written down, whether the GP's reasoning was recorded, and whether the NICE-recommended investigation was even considered. Without the record you're arguing from memory. With it, you're arguing from evidence.

Records also protect against soft labels — "health anxious", "reassured", "non-compliant" — that can shape every future appointment. You can't challenge a label you've never seen.

Your legal right

Under the UK General Data Protection Regulation and the Data Protection Act 2018 you have the right to make a Subject Access Request (SAR) for any personal data held about you, including your full medical record. Key points:

• It must be free of charge (with very narrow exceptions for repeat or excessive requests).
• They must respond within one calendar month.
• You don't have to give a reason.
• You can ask for the whole record or just specific entries, dates, or topics.
• You can ask for it in a specific format (digital is fastest).

The ICO's guidance on the right of access spells out what counts as a lawful refusal — it's a short list.

How to request your record

Send a written Subject Access Request to your GP practice (the practice manager handles these). It can be by email, post, or via the practice's online form. Include:

• Your full name, date of birth, NHS number, and current address.
• The dates of record you want, or "my full medical record" if you want everything.
• Whether you want a digital or paper copy.
• Proof of identity (a copy of your photo ID is usually enough).

Use the words "Subject Access Request under the UK GDPR" explicitly — it triggers the formal one-month clock.

SAR template (copy, paste, send)

This is short by design — short SARs are processed faster:

• To: The Practice Manager, [Practice name and address].
• Subject: Subject Access Request under the UK GDPR.
• Body: "I am writing under Article 15 of the UK GDPR to request a copy of all personal data you hold about me, including my full medical record. My details are: [name, DOB, NHS number, address]. I would prefer to receive this in digital format (PDF). Proof of identity is attached. Please confirm receipt and provide the data within one calendar month, as required by law."

The NHS App route (faster, but partial)

If you're in England and registered with a GP, the NHS App now gives most patients access to prospective GP records — meaning entries made from November 2022 onwards. Test results, letters, and consultations all appear. This is the fastest route for recent activity, but for anything pre-Nov 2022 you still need a formal SAR.

If the App doesn't show your record, your practice may not have switched it on yet — phone reception, ask for "detailed coded record access" on the NHS App, and they should be able to enable it within a few working days.

Hospital and specialist records

Your GP record and your hospital record are held separately. To get a hospital record (clinic letters, test results, imaging, operation notes), send a SAR to the hospital's Patient Advice and Liaison Service (PALS) or its information governance team. The same one-month rule applies.

Specialist services — mental health trusts, sexual health clinics, gender services — also hold separate records. Each has its own SAR address; ask the service directly.

If you're refused or fobbed off

If the practice ignores you, takes longer than a month without explanation, or refuses without a lawful reason:

• Send a chaser in writing, referencing the original SAR date and the one-month deadline.
• If still no response, complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint. The ICO regulates UK GDPR and can compel the practice to comply.
• You can also complain via the NHS complaints procedure simultaneously — see our complaints guide.

Common lawful refusals: requests that are clearly excessive (e.g. dozens of SARs in a year), requests that would identify a third party who hasn't consented, or entries a clinician judges would cause serious harm if disclosed. "We're too busy" is not lawful.

Getting an entry corrected

If your record contains a factual error — wrong date, wrong medication, wrong description of what you said — you have the right under UK GDPR Article 16 to ask for it to be rectified. Send a written request to the practice manager, quote the entry, and explain what is wrong.

For clinical opinion you disagree with (e.g. a diagnosis label you reject), the practice usually won't delete the original but will add an annotation noting your view. That annotation matters: it's what a later clinician, complaint reviewer, or solicitor will read.

Records of someone who has died

UK GDPR only covers living individuals. To access the records of someone who has died, use the Access to Health Records Act 1990. The personal representative of the estate, or anyone with a claim arising from the death, can apply. The practice or trust can charge a reasonable fee.

Glossary

Frequently asked questions