The practice is committed to ensuring patients can access their medical records in line with current legislation, while protecting confidentiality and patient safety. There are different routes for accessing records, depending on the purpose of the request.
1. Access to Your Own Medical Records (Subject Access Requests)
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the right to access personal data held about you by the practice. This is known as a Subject Access Request (SAR).
- Requests can be made verbally or in writing
- You may request all or part of your medical record
- Records will be provided electronically where possible
- There is no charge for standard requests
- A reasonable fee may be charged only where requests are manifestly unfounded or excessive, in accordance with legislation
- Requests are normally completed within one calendar month
In line with legislation, some information may be withheld or redacted, for example where:
- It relates to a third party who has not consented, or
- Disclosure could cause serious harm to the physical or mental health of the patient or another person
2. Online Access to Medical Records
Patients may view parts of their medical record online via NHS‑approved online services (such as the NHS App).
This may include:
- Your Summary Care Record, and/or
- Access to parts of your GP medical record
To request online access you must:
- Complete an application form
- Provide photo identification (passport or driving licence)
- Provide proof of address (such as a utility bill or bank statement)
Before access is enabled, a GP will review your record. In accordance with the UK GDPR and Data Protection Act 2018, the GP may restrict or remove access to certain information to:
- Protect third‑party confidentiality
- Prevent serious harm to the patient or another individual
Online access is provided to support patient involvement and safety and may not include all historical information.
3. Disclosure of Medical Information to Third Parties
Medical information may sometimes be requested by third parties, such as:
- Insurance companies
- Solicitors
- Police
- Employers
These requests are governed by the UK GDPR, Data Protection Act 2018, and where applicable, the Access to Medical Reports Act 1988.
- Medical information will only be released with the patient’s written consent, unless there is a legal obligation to disclose
- Only information that is relevant and proportionate to the request will be shared
- An administration fee may apply for completion of reports or provision of information, in line with NHS guidance
Requests for access to records relating to deceased patients are managed under the Access to Health Records Act 1990.
If you need help understanding which type of request applies to you, or require support to access your records, please contact the practice and a member of staff will be happy to assist.