Access to Health Records
This section looks at your right to see your health records and how to do this. It explains what to do if you think the information on your health records is wrong. In this section, when we say ‘record’ or ‘records’, we mean your health record.
- When an NHS professional sees you, they will update your record with information about your illness and treatment.
- Records are kept in different places. If you have seen mental health services, your record is kept there. Your GP will not have the information.
- You can see your records. Your doctor can withhold information if it may harm your physical or mental health.
- From the 25th May 2018 you should be able to see a copy of your record within 1 month.
- Other people, such as an employer or insurer, can only see your records if you agree.
- If you feel something on your records is wrong you cannot usually delete it. You can ask your doctor to add a note to show that you disagree.
- You should be able to see your records online if you sign up for ‘Patient Online’.
- You can have a ‘summary care record’ which gives the NHS important information about your health. This helps them to deal with emergencies. You don’t have to have one if you don’t want to.
What are my records?
When you see a health professional, they will update your health record with information about your condition and treatment. These records may be on a computer or handwritten.
Your record has information about your:
- letters, and
- test results.
Health records in mental health teams may have information about your care plan and time spent in hospital.
The NHS keeps detailed records locally so the person in charge of your treatment can see it. This means your GP surgery will hold records of your GP visits. Your mental health team will keep records of your appointments with them.
From the 25th May 2018 local NHS services must have a ‘data protection officer’. This is a professional who is responsible for processing all the data they record.
Your GP records and mental health team records are not kept together.
Specialist services and your GP may share some important information about your care. This may include:
- referral letters,
- your diagnosis,
- reports, and
Summary Care Records
When you are treated outside your GP surgery, healthcare professionals cannot access your records. They may be able to see a ‘summary care record’ instead. This holds important information about your health. Your GP will automatically start a summary care record.
The record will have information about:
- your medication,
- your allergies,
- any bad reactions to medications you have tried, and
- your name, address, date of birth and NHS number.
For example, in an emergency doctors could look at the record to see if you are allergic to any medications. This can help them treat you properly.
You can put more information on your summary care record if you want. You could put information about long term health conditions or any difficulties you have. Your GP can also put more information in the record. They must usually have your agreement to do this. This is called giving your consent. If you can’t consent, your GP must justify why they think the extra information is needed.
Health professionals have to ask you before looking at your record. But if you are unconscious or can’t give consent, they can look at your record without your permission. If they do this they have to make a note on your record to explain why.
You can ask to see a list of who has looked at your summary care record. We have explained how to do this further down in this section.
If you don’t want a summary care record, contact your surgery and tell them. Or you can fill in a form and hand it into your surgery. This is called ‘opting out’. You can find a copy of the form here:
How long are my records kept?
Records of your care are made every time you go to an NHS service. These services will keep your records for different lengths of time. The length of time depends on where the record is kept.
Normally records are kept for up to 8 years after you were last seen by the
service or discharged. These are called ‘adult health records’. There are some exceptions explained below.
Your GP surgery will create a record when you register there. This will be kept and updated for as long as you are still registered there.
Your GP record will be kept for 10 years after you die or if you move to another country.
If you register as a temporary patient at a GP surgery, a record will be made of your appointment. This will be kept for a maximum of 2 years after you were treated there. In most cases this record will be sent to the GP you are registered with. Your normal GP surgery will include it in the record they keep.
Electronic patient records
Some NHS services and GP surgeries have electronic patient records. These records should also follow the rules explained above. At the end of the time period, the record should be destroyed. Or people using the
computer system should not be able to access them.
Mental Health Records
These include details of any treatment you may have been given under the Mental Health Act 1983. This includes prisoners transferred to hospital for treatment under the Mental Health Act.
Your records will be kept for 20 years after you were last seen, or discharged from the act. Or if you die the records will be kept for 8 years.
Your mental health records can be kept for over 20 years if it is an ongoing case.
If your case was simple and you were treated in the community with a full recovery, then your record may be treated as a normal adult health record and only kept for 8 years.
Prison health records
Any records of treatment you received in prison are treated as normal adult health records. This means they are kept for a maximum of 8 years after you are discharged. Usually a note summarising the care you received is sent to your GP.
Records of long term illness or an illness that could reoccur
You might have a long term or reoccurring health condition that means you need a lot of care. In these cases, the record could be kept for up to 30 years after you are discharged. If you die, then your records can only be kept for 8 years after.
Why & How
Why might I want to see my records?
There are different reasons why you might want to see your health records. For example, you might want to:
- check if there are any mistakes in your records,
- find out background information about your healthcare, or
get evidence for a complaint about your healthcare.
How can I see my records?
Ask the service
Before 25th May 2018 you have the right to see your health records under the Data Protection Act 1998. You will still have this right under the General Data Protection Regulations (GDPR) from the 25th May 2018.
Your GP, or another professional, can show you your records any time, but they don't have to. If they refuse, you could try making a ‘subject access request’. We have explained this below.
You could ask to see your records during an appointment or over the phone. If they agree, this is a quick and easy way to see your records.
They could show you the notes on paper or on a screen. But they might not give you a copy of your records this way. You may have to make a subject access request to get a copy or your local NHS trust can tell you how to apply.
Some GP surgeries are letting patients sign up to ‘Patient Online’. This lets you look your health records online, as well as book appointments. Not all GP surgeries have set this up yet. Ask your GP surgery if you can sign up for Patient Online.
Subject Access Requests
You can use your right to have a copy of your health records under section 7 of the Data Protection Act 1998. This will be replaced by Article 15 of the General Data Protection Regulations (GDPR) from the 25th May 2018. This is called making a ‘subject access request’.
From the 25th May 2018 you can make a subject access request in writing or by speaking to the service. The service might have a form they ask you to fill out. Your local Patient Advice and Liaison Service (PALS) might be able to help you with a subject access request. You can search for your local PALS office at: www.pals.nhs.uk/officemapsearch.aspx.
In your letter, give:
- your name,
- date of birth, and
- any other information which would help locate your file.
From the 25th May 2018, explain that you are making a subject access request under Article 15 of the General Data Protection Regulations 2018.
You do not have to tell them why you want to see your records. You may have to show them some proof of your identity.
You do not have to fill in a special form when asking to see your records. But some services might ask you to, to make the process faster. Ask the service first if you are unsure. If you can, you should send the letter by
recorded delivery. You can use also the sample form by downloading this factsheet.
Can anyone else see my records?
Your health records are confidential. The NHS should not show your health records to anyone without your consent. Unless they share information with other NHS or social care staff members who are involved in your care.
Can the NHS share information about me with other NHS or social
care staff members?
NHS services can share information about you with any NHS and social care staff who directly support or care for you. They can generally do this without your consent. They can do this under what they call ‘implied
consent’. Implied consent means circumstances in which it would be reasonable to think that you would agree to the information being shared.
But an NHS service can only share the information under implied consent if.
- You have not objected to this.
- Information is available to you saying how your information will be used.
- The NHS tell you that you have the right to object to information sharing.
- The person who receives the information understands they are receiving it in confidence and they respect this.
Tell an NHS service if you don’t want them to share information about you with staff who directly support or care for you. They then shouldn’t share the information unless.
- It is in the public interest - this means the information can be shared to protect an individual or individuals from the risk of serious harm
or serious crime, or
- You lack the mental capacity to decide about sharing the information - sharing the information is in your best interests.
What if I lack capacity to access my medical records?
Mental capacity means being able to understand and make decisions. If you don’t have capacity to ask for your records then someone else may do this for you.
You can find more information about:
What if an employer or insurer wants to know about my medical
If your employer or insurer wants health information, they may ask your doctor for a medical report. They will not ask for your full medical records.
Your doctor will need your consent to give them this information. This comes under the Access to Medical Reports Act 1988.
Do I have to pay to see my records?
Before the 25th May 2018, If NHS staff have updated your records in the last 40 days then you may be able to view them for free. If you need a copy, or they were last updated more than 40 days ago, the NHS can charge you.
The most the NHS can charge you for an electronic copy of your record is £10. If your records are handwritten and need to be photocopied, the record holder can charge you up to £50.
However, from the 25th May 2018 the General Data Protection Regulations (GDPR) changes these rules. From this date, there should be no charge for a copy of your records, unless you are asking for a very large amount of information.
When will I get my records?
Before the 25th May 2018, once you have given the NHS all the information they need to identify you, and paid the fee, they have 40 days to send it to you.
From after the 25th May 2018, the NHS has only 1 calendar month to get your information to you. This can be extended for a further 2 months if you have made multiple requests, or the information you have asked for is very complex. The NHS tries to deal with requests within 21 days.
Can the NHS keep information from me?
Under the Data Protection Act, the NHS can hold back information that would cause serious harm to your physical or mental health or anyone else’s. The record holder should explain why they decided to keep information from you.
It is expected that new data protection law in 2018 will maintain these rules around holding back information.
Your records may have information about other people. The NHS should ask their permission to share this information with you. If the person does
not agree, the NHS may not show you this information. If the NHS can't ask for permission, then it will need to decide if they should share this information with you. They will decide this on a case-by-case basis.
If you think that information is missing and the NHS has not told you why, contact the record holder to ask why.
What if the information on my record is wrong?
The information in your records should be correct and up to date.
Some of the information will be a professional’s opinion. A health professional may have written an opinion about you that you think is wrong. The NHS will usually not remove these opinions from your record.
They need to keep this information because it shows why they made decisions about your care and treatment.
It is unlikely that the NHS will delete or remove information from your records unless it is factually incorrect, like the wrong address or date of birth.
If your doctor agrees that the information is wrong, they may add a correction to your record. If your doctor doesn’t agree with you, you should be able to add a note showing this.
You should write to the record holder to tell them what you think is wrong and explain why. It’s a good idea to send this letter by recorded delivery.
Can I see my relative’s records when they die?
When someone dies, their health records are still confidential. Only certain people can see them.
The NHS was previously able to charge you for getting copies of these records, but this was changed by the Data Protection Act 2018. Now you can't be charged for these records.
Access to your relatives’ health records comes under the ‘Access to Health Records Act 1990.
Personal representatives and people with a claim
If you are a personal representative, or if you have a claim from the person’s death, you can apply to see the persons’ medical records.
Being someone’s personal representative means you deal with their affairs after they have died. This includes dealing with their property and bank accounts.
The law is unclear about what it means to have a claim from someone’s death, but this may include people who can take an inheritance. You can read more about being a representative here: www.gov.uk/willsprobate-inheritance.
You need to contact the record holder with enough information to identify the records. You should include evidence to show you are the personal representative or that you have a claim. You may need to show a death certificate, the grant of representation or a copy of the will. You may also need to show proof of your identity.
If the person left a note in their records saying they did not want you to see them, then the NHS may hold them back.
You can apply to see someone’s health records if you don't fall into the above group. The NHS should think about:
- if the person who died said if they wanted their records to be shared,
- if anyone will be distressed if the records are shared,
- the views of any surviving family,
- how long ago the person died,
- how much information you are asking for,
- why you want the information, and
- if you had a relationship with the person who died.
When someone dies unexpectedly, the coroner can see their health records. They may get a copy to prepare for the inquest into the person’s death.
You can find out more about ‘Inquests’ by clicking here.
How can I complain?
You may want to complain because:
- the NHS has not dealt with your request within 40 days,
- the NHS says you can't see your records,
- the NHS doesn’t give you all the information that you asked for, or
- you disagree with the information in your records.
You can use the NHS complaints procedure to try and resolve these
You can find more about ‘Complaints’ by clicking here.
The Information Commissioner’s Office can look into your complaint and ask the NHS to solve the problem. The Information Commissioner can only get involved if you have already tried to resolve your issue by making
an NHS complaint. Their details are in the Useful Contacts section.
Information Commissioner’s Office (ICO)
This organisation regulates the use of the Data Protection Act in organisations such as the NHS. They have a helpline you can call for information.
Telephone: 0303 123 1113 (9am to 5pm Monday to Friday)
Address: Information Commissioner’s Office, Wycliffe House, Water
Lane, Wilmslow, Cheshire, SK9 5AF
Email: Online form here: www.ico.org.uk/global/contact-us/email/