Accessing Your Patient Records

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the right to obtain a copy of the personal data held about you — including your health records. This is known as a Subject Access Request (SAR).

NHS organisations must respond to a SAR within one calendar month of receiving it. This deadline can be extended by up to two further months for complex or numerous requests, but the organisation must tell you within the first month if an extension is needed.

Accessing your records is generally free. The NHS can charge a reasonable fee only if a request is "manifestly unfounded or excessive" — for example, if you are requesting records very frequently without good reason.

The easiest way for most patients to view their GP record is through the NHS App (free on iOS and Android) or the Patient Access platform. Through these services you can typically view:

• Medications and allergies
• Test results (including blood tests and other investigations)
• Appointment history and future appointments
• Immunisations and vaccinations
• GP letters and clinical notes (where enabled by your practice)

From November 2023, GP practices in England were required to grant patients automatic access to their prospective (new) records by default, unless there is a clinical reason not to. Some practices may not yet have full historic record access enabled. Contact your practice directly if you cannot see expected information.

To make a SAR for NHS records:

1. Identify who holds the records: GP records are held by your GP practice; hospital records by the relevant NHS trust; ambulance records by the ambulance service. You may need to make separate requests to each organisation.
2. Write to the Data Protection Officer (DPO) or records department of the relevant organisation. Many NHS trusts have an online SAR form on their website.
3. Provide proof of identity and specify what records you want and for what time period to help the organisation locate them quickly.
4. The organisation must respond within one calendar month, providing copies of your records (usually by secure electronic means or post).

If you are requesting records on behalf of someone else (for example a child or a person who lacks capacity), you must demonstrate your authority to do so.

The NHS can restrict access to your records in limited circumstances, including where disclosure would:

• Be likely to cause serious harm to your physical or mental health
• Reveal information about a third party who has not consented to disclosure (unless it is reasonable to disclose without consent)
• Prejudice the prevention or detection of crime

If access is refused or restricted, the organisation must tell you (in writing) that it is withholding information and give you a reason, though it need not reveal the content of the restricted information. You can challenge this decision by complaining to the organisation, escalating to the ICO, or taking the matter to court if necessary.

Your rights over NHS health data extend beyond access to your own records. Understanding these rights is increasingly important as NHS data-sharing initiatives expand.

NHS National Data Opt-Out

The NHS processes anonymised or pseudonymised health and care data for planning, research, and commercial purposes — including sharing it with pharmaceutical companies and researchers. Under the NHS National Data Opt-Out, you have the right to opt out of your confidential patient information being used for these purposes. The opt-out applies to data shared by NHS England and most NHS organisations. Register or manage your opt-out at nhs.uk/your-nhs-data-matters or via the NHS App. The opt-out does not affect your direct clinical care in any way.

Secondary Uses — Research and Planning

Even where the NHS opt-out applies, some uses of health data are permitted regardless — for example, data used in genuine life-sciences research with NHS Research Ethics Committee approval, or statutory functions such as cancer registration. If you have concerns about a specific data-sharing arrangement, you can make enquiries to the relevant NHS organisation's Data Protection Officer or raise a concern with the Information Commissioner's Office (ICO).

ICO Complaints About NHS Data Handling

If the NHS fails to respond to your SAR within the one-month deadline, refuses access without adequate justification, or you believe your health data has been processed unlawfully, you can complain to the ICO at ico.org.uk. The ICO is the independent UK data protection regulator. It can investigate, issue formal reprimands, and require organisations to comply with the law. You can also bring a civil claim for damages under the Data Protection Act 2018 if you have suffered material or non-material damage (including distress) from an unlawful data breach or processing failure.

Data Accuracy and Consequential Harm

Inaccurate health records can cause serious harm — incorrect allergies or diagnoses can affect treatment. Under the UK GDPR, the right to rectification requires the NHS to correct inaccurate data without undue delay. If you believe an inaccuracy has led to substandard care or a clinical error, you may have grounds for both a UK GDPR rectification request and an NHS complaint. In serious cases, legal advice should be sought about whether a clinical negligence claim may also be available.