Ask your GP practice for a copy under a subject access request. You can ask in writing, by email, through the practice's online form or in person. Include your name, date of birth, NHS number and address, and say what you want.
The NHS App and hospital portals show part of your record. When you need the rest, such as older GP entries, hospital notes or scans, you can ask for a copy. In the UK this is called a subject access request, and it gives you a legal right to a copy of the information an organisation holds about you, including your health records.
This guide explains who to ask, what to say, how long it takes and what it costs, and ends with a letter you can adapt. For an overview of where NHS records are kept, see our guide to NHS medical records.
Your right to a copy
UK data protection law gives you the right to a copy of your personal information. Your health records are personal information, so your GP practice, every hospital trust that has treated you and any private provider must give you a copy when you ask, subject to a few limited exceptions.
The same right applies in England, Scotland, Wales and Northern Ireland. What differs is who you send the request to. You do not need to give a reason for asking, and the organisation should not ask you to justify it. It can, however, ask you to be specific if your request is very broad, and it can ask you to prove your identity before it releases anything.
Who holds which records
There is no central NHS office that holds everything. Send a request to each organisation whose records you need.
| Records | Who to ask |
|---|---|
| GP record | Your GP practice |
| Hospital notes, letters and results | The hospital trust (or health board), usually its medical records or subject access team |
| Scans and X-rays | The hospital trust; some trusts pass these to their imaging department |
| Community or mental health services | The trust that provides the service |
| Dental, optical or private care | The practice or provider that treated you |
If you are not sure which trust treated you, a hospital letter usually has the trust’s name at the top.
How to ask
Copies often arrive by post, so give your current address.
You can make a request in writing, by email, through an online form or verbally. You do not have to use a particular form or particular words, although many GP practices and trusts have their own form, which can make things quicker. A written request is easier to prove later.
Include enough for the organisation to find your records and confirm who you are:
- your full name, and any previous names
- your date of birth
- your NHS number, if you know it (it is on NHS letters and in the NHS App)
- your current address, and previous addresses if relevant
- what you want: the full record, or specific dates, departments or documents
- the format you would like, for example electronic copies by secure email
The organisation can ask you to prove your identity. If it does, the time limit starts once it has what it needs.
How long it takes and what it costs
Time limits
The organisation should respond within one calendar month of receiving your request. It can extend this by up to two further months if the request is complex or you have sent several, but it must tell you within the first month and explain why.
Changes made by the Data (Use and Access) Act 2025 say that organisations must carry out reasonable and proportionate searches. If your request is unclear, the clock can pause while they ask you to clarify it. Being specific about what you need usually makes things faster.
Cost
The first copy is normally free. An organisation can charge a reasonable fee for further copies of the same information, or charge for or refuse a request that is manifestly unfounded or excessive. It cannot charge simply because the request is for health records, and it should not charge for posting or emailing your copy.
Asking for scans and imaging
Scan images, such as X-rays, CT, MRI and ultrasound, are part of your health record, and you can ask for them. Hospital patient portals usually show the written report but not the images, and a general request for “my records” may only return written notes. Be specific:
- Name the exam and the date. For example, “MRI of my left knee, March 2025, at [hospital name]”.
- Quote any reference numbers. The accession number on the report, your hospital number and your NHS number all help the trust find the right study.
- Ask for the full image files. Scans are stored in a format called DICOM. Ask for the complete study, not screenshots or photos, by secure download link or on a disc with a viewer.
- Ask for the report too, and any earlier scans of the same area if you want a comparison.
Many trusts now send images as a secure download link instead of a disc. These links often expire after two weeks to two months, so download the files as soon as the link arrives.
Two different things
The report and the images
Ask for both by name. A request for your records may return only the written report.
The report The images
What it is The radiologist's written description of what the scan showed. The X-ray, CT, MRI or ultrasound pictures themselves, stored as DICOM files.
Where you see it Often in a hospital portal or a letter to your GP once released. Rarely online. Portals usually show the report only.
How to ask Part of a subject access request to the trust. Name the exam and date in the same request, with any accession number.
How it arrives A PDF or printed page, like any other document. A secure download link or a disc with a viewer. Links often expire.
A subject access request is not a GP medical report
If an insurer, employer or the DVLA asks for a “medical report”, that is a different thing. A report is a new document a GP writes for a specific purpose, and it is usually a separate, paid service. A subject access request gets you a copy of the records already held about you, normally for free.
When a report is written for an employer or an insurance company, the Access to Medical Reports Act 1988 gives you the right to be asked for your consent first, and to see the report before it is sent if you say you want to. If someone only needs your history rather than a doctor’s opinion, ask whether a copy of your records would do instead. It is often quicker and costs nothing.
If something is withheld, late or wrong
What can be withheld
An organisation can withhold or redact some information. The ICO’s guidance on access to health information explains the rules in detail. The two main reasons are:
- Information about other people, such as a relative mentioned in your notes, unless they have agreed or it is reasonable to release it.
- Serious harm. Information can be withheld if a health professional thinks releasing it is likely to cause serious harm to your physical or mental health, or someone else’s.
If something is withheld, the organisation should normally tell you, unless telling you would itself cause the harm the exemption is there to prevent.
If the reply is late
Contact the organisation first. Give the date of your request and say what is missing or late. Most problems are sorted out at this stage, often because a request reached the wrong team. If you are still unhappy, you can complain to the Information Commissioner’s Office (ICO), which regulates data protection in the UK. The ICO expects you to have raised the problem with the organisation before you complain.
If something in your record is wrong
You can ask for factual mistakes to be corrected, such as a wrong date of birth or a medicine you never took. A clinician’s opinion is different: it is not usually changed, but you can ask for a note of your view to be added to the record.
Someone else asking for you
You can authorise someone else to ask for your records, for example a relative, a solicitor or a service helping you collect your records. Give them signed written consent that says who they are, what they can receive and why. The organisation may check your identity and their authority before releasing anything, and it may contact you to confirm.
Parents can usually ask for a young child’s records. Once a child is old enough to understand the request, the organisation may ask for the child’s agreement, or speak to the child directly.
For records of someone who has died, a different law applies (the Access to Health Records Act 1990). Only the person’s personal representative, such as the executor, or someone with a claim arising from the death can ask.
Sample letter
You can adapt this letter for your GP practice or a hospital trust. Delete the options that do not apply, and keep the request as specific as you can: a named department and date range is easier to search than “everything”. If the practice or trust has its own form, you can still attach this letter or use its wording in the form. The ICO also publishes guidance and a template on getting copies of your information, which works for any organisation.
Sample letter
A subject access request you can adapt
Replace the highlighted parts and delete the options that do not apply.
Subject: Subject access request
Dear Data Protection Officer / Medical Records Team,
I am making a subject access request under the UK General Data Protection Regulation for a copy of my health records.
My details are:
Full name: your name, and any previous names
Date of birth: date
NHS number: number
Address: current address, and previous addresses if relevant
Hospital number (if known): number
Please provide a copy of: my complete record / records from (date) to (date) / my records from the (department) / the images and report for my (exam) on (date), accession number (number).
If my request includes imaging, please provide the complete studies in their original DICOM format, by secure download link or on a disc with a viewer, together with the radiology reports.
I would prefer to receive the information electronically, by secure email / download link.
I have enclosed proof of identity. Please let me know if you need anything else to locate my records.
I look forward to your response within one calendar month.
Yours sincerely,
your name
date
This is a starting point, not legal advice. The ICO's own template works for any organisation.
Keep a copy of what you sent and the date you sent it.
Keep what you receive
Images arrive as files you can keep, not a picture of a screen.
Copies arrive as PDFs, printed pages or download links, often at different times from different organisations. Put them somewhere you can find them again, and note which organisation sent each one and when, so you can tell what is still outstanding.
KeepMD is a personal health record app for keeping those copies together:
- Save documents. Pick the PDF you received, or photograph printed pages with your phone’s camera.
- Review before saving. KeepMD Vision reads the values on the page after you give consent, and you check every value before it is saved.
- Keep family records apart. Use a separate profile for each person you look after.
Your records stay encrypted on your phone. KeepMD does not connect to the NHS; you choose what to add. See medical document scanning for how it works.
If you are collecting records before leaving the country, our guide to moving abroad from the UK has a timeline. For what the NHS App can already show you, see the guide to the NHS App GP record.
