When you see a health professional, they will update your health records with information about your condition and treatment. These records may be on a computer or handwritten.
Your records have information about things like your:
Health records in mental health teams may have information about your care plan and time spent in hospital.
The NHS keeps detailed records locally so the person in charge of your treatment can see it. This means your GP surgery will hold records of your GP visits. Your mental health team will keep records of your contact and appointments with them.
Local NHS services must have a ‘data protection officer’. This is a professional who is responsible for processing all the data they record.
Your GP records and mental health team records aren’t kept together. But specialist services and your GP may share some important information about your care. This may include:
When you are treated outside your GP surgery, healthcare professionals can’t access your GP records. They may be able to see a ‘summary care record’ instead. This holds important information about your health. Your GP will automatically start a summary care record.
The record will have information about:
For example, in an emergency doctors could look at the record to see if you are allergic to any medications. This can help them treat you properly.
Professionals can put additional information on your summary care record, unless you tell them not to. This additional information can include:
Specific sensitive information won’t be automatically included when additional information is added. This includes things like fertility treatments, sexually transmitted infections, pregnancy terminations and gender reassignment.
Health professionals must ask you before looking at your record. But if you are unconscious or can’t give consent, they can look at your record without your permission. If they do this, they must make a note on your record to explain why.
You can ask to see a list of who has looked at your summary care record. We have explained how to do this further down this page.
If you don’t want a summary care record, you can contact your GP surgery and tell them. Or you can fill in a form and hand it into your surgery. This is called ‘opting out’. You can find a copy of the form here:
www.digital.nhs.uk/services/summary-care-records-scr/scr-patient-consent-preference-form
Records of your care are made every time you go to an NHS service. These services will keep your records for different lengths of time. The length of time depends on where the record is kept.
Normally records are kept for up to 8 years after you were last seen by the service or discharged. These are called ‘adult health records’. There are some exceptions, that are explained below.
Your GP surgery will create a record when you register there. This will be kept and updated for as long as you are still registered there.
Your GP record will usually be kept for 10 years after you die.
Some NHS services and GP surgeries have electronic patient records. These records should also follow the respective rules explained above. At the end of the time period, the record should be destroyed. Or people using the computer system shouldn’t be able to access them.
These include details of any treatment you may have been given under the Mental Health Act 1983. This includes prisoners transferred to hospital for treatment under the Mental Health Act.
Your records will be kept for 20 years after you were last seen or discharged from the Act. Or if you die the records will be kept for 8 years.
There are different reasons why you might want to see your health records. For example, you might want to:
You have the right to see your health records under the General Data Protection Regulations (GDPR).
If they refuse, you could try making a ‘subject access request’. We have explained this below.
You could ask to see your records during an appointment or over the phone. If they agree, this is a quick and easy way to see your records. They could show you the notes on paper or on a screen. But they might not give you a copy of your records this way. You may have to make a subject access request to get a copy or your local NHS trust can tell you how to apply.
Some GP surgeries are letting patients sign up to ‘Patient Online’. This lets you look at your health records online, as well as book appointments. Not all GP surgeries have set this up yet. Ask your GP surgery if you can sign up for Patient Online.
You can use your right to have a copy of your health records under Article 15 of the General Data Protection Regulations (GDPR). This is called making a ‘subject access request’.
You can make a subject access request in writing or by speaking to the service. The service might have a form they ask you to fill out.
Your local Patient Advice and Liaison Service (PALS) might be able to help you with a subject access request. You can search for your local PALS office at: www.nhs.uk/service-search/otherservices/Patient%20advice%20and%20liaison%20services%20(PALS)/LocationSearch/363
In your request, give:
Explain that you are making a subject access request under Article 15 of the General Data Protection Regulations 2018.
You don’t have to tell the service why you want to see your records. But you may have to show them some proof of your identity.
You don’t have to fill in a special form when asking to see your records. But some services might ask you to, to make the process faster. Ask the service first if you are unsure. If you can, you should send your letter or form by recorded delivery. You can also use the sample form by downloading this factsheet using the button above.
Your health records are confidential. The NHS shouldn’t show your health records to anyone without your consent. Unless they share information with other NHS or social care staff members who are involved in your care.
NHS services can share information about you with any NHS and social care staff who directly support or care for you. They can generally do this without your consent. They can do this under what they call ‘implied consent’. Implied consent means circumstances in which it would be reasonable to think that you would agree to the information being shared.
But an NHS service can only share the information under implied consent if:
Tell an NHS service if you don’t want them to share information about you with staff who directly support or care for you. They then shouldn’t share the information unless.
Mental capacity means being able to understand and make decisions. If you don’t have capacity to ask for your records, then someone else may do this for you.
You can find more information about:
If your employer or insurer wants health information, they may ask your doctor for a medical report. They won’t normally ask for your full medical records. Your doctor will need your consent to give them this information.
Under the General Data Protection Regulations (GDPR) there should be no charge for a copy of your records, unless you are asking for a very large amount of information or you ask for information you’ve already had.
The NHS has only 1 calendar month to get your information to you. This can be extended for a further 2 months if you have made multiple requests, or the information you have asked for is very complex.
The NHS tries to deal with requests within 21 days.
Under the Data Protection Act, the NHS can hold back information that would cause serious harm to your physical or mental health or anyone else’s. The record holder should explain why they decided to keep information from you.
Your records may have information about other people. The NHS should ask their permission to share this information with you. If the person doesn’t agree, the NHS might not show you this information. If the NHS can’t ask for permission, then it will need to decide if they should share this information with you. They will decide this on a case-by-case basis.
If you think that information is missing and the NHS has not told you why, contact the record holder to ask why.
When someone dies, their health records are still confidential. Only certain people can see them.
You can’t be charged for these records if you’re allowed to access them.
You might be a personal representative or have a claim from a person’s death. You can apply to see the persons’ medical records.
Being someone’s personal representative means you deal with their affairs after they have died. This includes dealing with their property and bank accounts.
The law is unclear about what it means to have a claim from someone’s death, but this may include people who are entitled to an inheritance. You can read more about being a representative here:
www.gov.uk/wills-probate-inheritance.
You need to contact the record holder with enough information to identify the records. You should include evidence to show you are the personal representative or that you have a claim. You may need to show a death certificate, the grant of representation or a copy of the will. You may also need to show proof of your identity.
If the person left a note in their records saying they didn’t want you to see them, then the NHS may hold them back.
You can apply to see someone’s health records if you don’t fall into the above groups. It will be up to the NHS to decide if they share the records with you. They should think about:
When someone dies unexpectedly, the coroner can see their health records. They may get a copy to prepare for the inquest into the person’s death.
You can find out more about ‘Inquests’ by clicking here.
The information in your records should be correct and up to date.
Some of the information will be a professional’s opinion. A health professional may have written an opinion about you that you think is wrong. The NHS won’t usually remove these opinions from your record. They need to keep this information because it shows why they made decisions about your care and treatment.
It’s unlikely that the NHS will delete or remove information from your records unless it is factually incorrect. Like the wrong address or date of birth.
If your doctor agrees that the information is wrong, they may add a correction to your record. If your doctor doesn’t agree with you, you should be able to add a note showing this.
You should write to the record holder to tell them what you think is wrong and explain why. It’s a good idea to send this letter by recorded delivery.
You may want to complain because of things like:
You can use the NHS complaints procedure to try and resolve these problems.
You can find more about ‘Complaints’ by clicking here.
The Information Commissioner’s Office can look into your complaint and ask the NHS to solve the problem. The Information Commissioner can only get involved if you have already tried to resolve your issue by making an NHS complaint. Their details are in the Useful Contacts section below.
Information Commissioner’s Office (ICO)
This organisation regulates the use of the Data Protection Act in organisations such as the NHS. They have a helpline you can call for information.