Access to your medical records

You have the right to see the information we hold about you. This explains how to ask for it, and how we handle each kind of request.

Important

Turn on your NHS App notifications so you don't miss screening invitations, test results, or prescription updates. Find out more about the NHS App.

Your right to access

NHS organisations must let you see the personal health information they hold about you. We have clear steps in place so that asking is straightforward, and so we respond in the time the law allows.

The main laws covering access to health records are:

  • UK GDPR and the Data Protection Act 2018 give you the right to see your own records.
  • The Access to Health Records Act 1990 covers requests for the records of someone who has died.
  • The Access to Medical Reports Act 1988 covers reports written for an employer or insurer.
  • The Human Rights Act 1998 and the common law duty of confidentiality protect your privacy throughout.

Seeing your records online through the NHS App or a practice portal doesn’t change any of these rights. The same rules apply to electronic access as to paper copies.

What's in a health record

A health record is any information about your physical or mental health, written by a health professional as part of your care. We may hold it electronically, on paper, or both. It can include:

  • Notes made during your appointments.
  • Letters between health professionals, such as referral and discharge letters.
  • Test results and what they mean.
  • Images such as X-rays, plus photographs and samples.
  • Reports written for a third party, such as an insurer.

What you can see with online access

If you have online access to your records, NHS England expects you to be able to see at least:

  • Your name, address, date of birth, and NHS number.
  • Allergies and any bad reactions you’ve had.
  • Your medicines, current and past.
  • Immunisations.
  • Test results, including the numbers and their normal ranges.
  • Problems and diagnoses.
  • Procedures, and the codes for symptoms and signs.
  • Measurements such as blood pressure and BMI.
  • Referrals and the letters you’ve received.
  • Other codes, including ethnicity and routine review codes.

If you have prospective detailed access, you can also see your consultation notes, and letters and documents once a GP has reviewed and filed them.

Asking for your records: a Subject Access Request

A request to see the data we hold about you is called a Subject Access Request, or SAR. You can make one yourself, or someone you authorise can make it for you. You don’t need to use a form or mention “UK GDPR” for it to count.

You can ask:

  • In writing, by letter or email.
  • Verbally. If you ask in person or by phone, we’ll write the request down and send you a confirmation to check.
  • Through our official channels, such as an approved online service.

Please send written requests to the Practice Manager at kiltearn.reception@nhs.net. We may ask you to fill in a form to make sure the request is clear, but you don’t have to.

Before we release anything, we need to be sure who you are. We may ask for proof of identity, and if someone is requesting on your behalf, evidence that they’re allowed to. If your request is about a specific phone call recording, telling us the date, time, and number used helps us find it.

How long it takes, and what it costs

We’ll respond without undue delay and within one month of getting your request. The month starts once we have enough information to identify what you’re asking for. If we need to confirm your identity or ask you to clarify, the clock starts when you’ve given us that.

If a request is complex or you’ve asked for a lot, we can extend the time by up to two further months. We’ll tell you within the first month if so, and explain why.

A SAR is normally free. We’ll only charge a reasonable fee, or turn a request down, if it’s clearly excessive or repeats one we’ve already answered. If that happens, we’ll explain our decision.

What we'll send, and when we redact

You’ll get copies of the personal data we hold about you, including your clinical records, unless an exemption applies. This can include phone call recordings or transcripts where we hold them. We can provide it securely online, on paper, or in another format you agree with us.

Sometimes we have to hold back or black out part of a record. This happens where releasing it would:

  • Identify someone else who hasn’t agreed to it.
  • Be likely to cause serious harm to your health or someone else’s.
  • Include information the law or a professional duty protects.

If we restrict anything, we’ll record why, and tell you the reason unless doing so would defeat the point of the restriction.

Records of someone who has died

The Access to Health Records Act 1990 covers requests for the records of a patient who has died. A request can be made by the personal representative of the person (for example the executor of their will), or by someone with a claim arising from the death.

We’ll need proof of your identity and your legal standing, such as a grant of probate or letters of administration. There’s no charge, though we may charge a small administrative fee for extra copies of records we’ve already supplied.

We aim to respond within 40 days, or within 21 days if the record has been added to in the 40 days before your request.

Reports for an employer or insurer

The Access to Medical Reports Act 1988 covers medical reports written for employment or insurance. We can only prepare and share one if you’ve given written consent first. You have the right to:

  • See the report before it’s sent, if you ask, within 21 days.
  • Ask for mistakes to be corrected.
  • Add your own written note if you disagree with it.
  • Withhold consent for it to be shared after you’ve seen it.

A GP may hold back part of a report if sharing it would cause serious harm to your health, or reveal information about someone else without their consent.

Information about other people

Now and then a record holds confidential information about someone else, perhaps a family member named in a note or letter. We review and, where we need to, redact that before sharing your record. This doesn’t apply to information you’d normally see anyway, like a hospital referral or discharge letter.

Here’s how we decide:

Situation What we do
Information you’d normally see, like a referral or clinic letter written by another clinician. Share it. It’s part of your care.
Someone gave information about you and agreed to it being shared. Share it, with their consent recorded.
A third party’s details that aren’t relevant to your care, such as a relative mentioned in passing. Redact the third party’s details, share the rest.
Someone gave information and asked us to keep it confidential. Redact where we can and share the rest. If we can’t, we may have to refuse.
Information that could cause serious harm if shared, such as a safeguarding note. Refuse, in part or full, with the reason documented.

When we may refuse

Access can be restricted or refused, decided together by the Practice Manager and our Caldicott Guardian (the senior person responsible for protecting patient information). This happens where, in their reasonable view, releasing the information would:

  • Cause serious harm to your physical or mental health.
  • Cause serious harm to someone else.
  • Break confidentiality by identifying another person who hasn’t consented.

We always write down the reason, offer you an appointment or written explanation, and tell you how to complain if you’re unhappy. We may also turn down a request that’s clearly unfounded (made to cause disruption, with no genuine purpose) or excessive (unreasonable in scope, or repeating an earlier one).

Proxy access: seeing records on someone's behalf

Proxy access lets someone other than the patient see their record to help with their care. How we handle it depends on age and on whether the patient can make the decision themselves.

  • Adults and young people aged 13 and over with capacity can choose to give proxy access, and decide how much. They might let a relative book appointments and order repeat prescriptions without seeing the full record.
  • Adults without capacity may have proxy access granted to someone holding lasting power of attorney for health and welfare, a Court Appointed Deputy, or where the Caldicott Guardian judges it in their best interests. Care homes may be granted access for residents.
  • Children under 11 are assumed not to have capacity, so someone with parental responsibility can apply. Online proxy access switches off automatically when a child turns 11.
  • Children aged 11 to 13 are assessed case by case, and their own wishes and confidence are respected. Access switches off again at 13 and can be reinstated under the adult process.

We won’t grant proxy access where there’s a risk to the security of the record, where we suspect someone is being coerced, where the patient previously said they didn’t want it, or where the Caldicott Guardian judges it isn’t in their best interests.

Important: If someone is pressuring you

Coercion is when someone uses pressure, threats, or control to make you act against your will, including pressuring you to share or give access to your records. Online access and services like appointment booking can create new openings for this, particularly in abusive or controlling relationships.

If we suspect or identify coercion, we’ll refuse or restrict access, record why, and our Caldicott Guardian will review it and involve safeguarding teams where needed. We’ll offer you safeguarding support. If any of this affects you, please tell a member of staff.

If you think your record is wrong

If you spot something inaccurate, or you don’t follow the medical terms used, raise it with us. Factual mistakes, like a wrong date of birth, address, or medication dose, will be corrected. Clinical opinions can’t be deleted or changed, but we can add a note recording your view alongside.

Tell reception, who’ll pass it to the Practice Manager. They’ll talk it through with you, involve the clinician who made the entry where possible, and decide whether to amend, annotate, or leave it. If we don’t make a change, we’ll explain why. You also have wider rights under UK GDPR, including rectification, restriction, data portability, and the right to object.

If you've moved abroad

If you no longer live in the UK, you have the same rights to your information and make a request the same way. We won’t hand over original records to take abroad, but we may provide a summary of the treatment you had while you were here.

Complaints

If you’re unhappy with how we’ve handled a request, please raise it with the Practice Manager first, who will look into it under our complaints policy. You can also contact the Information Commissioner’s Office (ICO) at any time, though they usually suggest raising concerns with us first.

If you’re still not satisfied, you can take it further:

For more on how we use your information, see our privacy notice.

Access to Medical Records policy, version 1.6. Last reviewed January 2026.

Scroll to Top