A Medical Records Subject Access Request (SAR) is a formal written request made to a healthcare data controller — such as a GP surgery, NHS Trust, private hospital, specialist clinic, or mental health service — to obtain copies of all personal data held about you, including your medical records. The right to make this request is established by Article 15 of the UK General Data Protection Regulation (UK GDPR) and section 45 of the Data Protection Act 2018 (DPA 2018), which together provide one of the most powerful individual rights in English data protection law.

The legal foundation for medical record access in England and Wales is built on several overlapping statutory frameworks. The UK GDPR (retained from Regulation (EU) 2016/679 by the European Union (Withdrawal) Act 2018 and amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019) applies to all personal data processed by living individuals. Section 45 of the DPA 2018 specifically addresses subject access requests and incorporates the restrictions and exemptions that apply to health data. The Access to Health Records Act 1990 provides a complementary right of access to the health records of deceased persons. The Access to Medical Reports Act 1988 governs access to medical reports prepared for employment or insurance purposes.

Your Article 15 rights extend beyond simply receiving a copy of your records. You are also entitled to receive: confirmation that your personal data is being processed; the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients to whom your data has been disclosed; the envisaged retention period; information about your rights to rectification, erasure, restriction, and objection; and information about your right to lodge a complaint with the Information Commissioner's Office (ICO). If your data has been transferred outside the UK, you are entitled to information about the safeguards in place.

The ICO is the independent supervisory authority for data protection in the United Kingdom, established under section 114 of the DPA 2018. The ICO has powers to investigate complaints, issue enforcement notices, and impose administrative fines of up to £17.5 million or 4% of global annual turnover for the most serious infringements. The ICO's guidance on subject access requests for health data is publicly available at ico.org.uk.

Healthcare data falls within the special categories of personal data under Article 9 of UK GDPR, attracting heightened protection. Despite this, data controllers may only rely on exemptions from subject access obligations where expressly authorised to do so by schedule 3 of the DPA 2018 or by another specific statutory provision. The most commonly cited exemption in a healthcare context is the 'serious harm' exemption, which allows a controller to withhold information where disclosure would be likely to cause serious harm to the physical or mental health of the data subject or another individual. However, this exemption must be applied narrowly and must be justified in each specific case.

A Medical Records Subject Access Request is needed in a wide range of situations where you wish to review, verify, or obtain copies of your own health information held by a healthcare provider in England and Wales.

The most common reason for making a SAR is to obtain a full copy of your medical records for personal review. Many patients make requests after changing GP practice, after a prolonged hospital admission, or after a serious health event to ensure they have a complete record of their medical history. Having access to your records allows you to identify any inaccuracies (which you can then seek to have corrected under Article 16 of UK GDPR), to understand diagnoses and treatment decisions, and to compile a complete health history.

A SAR is also frequently used in connection with personal injury claims, clinical negligence litigation, and insurance disputes. Solicitors acting in personal injury cases routinely advise clients to exercise their subject access rights to obtain medical records that may be relevant to quantum of damages or the causation of an injury. In clinical negligence cases, the records obtained through a SAR form the foundation of the investigation into whether the standard of care fell below an acceptable level.

Employment-related health matters are another common trigger. If your employer has obtained a medical report about you under the Access to Medical Reports Act 1988, you have specific rights to see and comment on that report before it is sent to your employer, or to request a copy after it has been sent. If your GP or an occupational health provider holds other health data relevant to your employment, a UK GDPR SAR may be the appropriate mechanism to access that information.

Making a SAR is also important when you suspect your medical records contain errors. Inaccurate medical records can lead to incorrect diagnoses, inappropriate prescriptions, or adverse insurance decisions. Once you have obtained your records and identified an inaccuracy, you may request rectification under Article 16 of UK GDPR. If the controller disputes that the information is inaccurate, you may request that a restriction is placed on processing under Article 18.

Finally, a SAR may be needed when planning for future healthcare, when seeking a second medical opinion, when applying for life insurance or income protection (where insurers ask for access to your medical history), or simply as a precautionary measure to ensure that your records are complete and accurate before a planned surgical procedure or other significant medical intervention.

A well-drafted Medical Records Subject Access Request should contain several essential elements to ensure that it is legally compliant, clearly communicated, and effective in obtaining the information you require.

The identity of the requester is the most fundamental element. The letter must clearly state the full legal name, date of birth, current address, contact details, and NHS number (if known) of the data subject. Where the request is made on behalf of another person, the identity of both the requester and the data subject must be stated, together with the legal basis of authority (such as a registered Lasting Power of Attorney for Health and Welfare or evidence of parental responsibility). Data controllers are entitled to ask for evidence of identity, but may only require information that is necessary to verify identity with reasonable confidence — they cannot demand disproportionate amounts of documentation.

The legal basis of the request must be explicitly stated. Referencing Article 15 of UK GDPR and section 45 of the Data Protection Act 2018 establishes the statutory framework and signals to the controller that you are aware of your rights. Controllers who receive a technically framed SAR are less likely to delay or obstruct the response.

The scope of the request must be clear. Specifying whether you are requesting all records, records for a defined period, or specific types of records (such as GP notes, referral letters, test results, or imaging reports) helps the controller process the request efficiently and reduces the risk of an incomplete response. You should also specify any additional contextual information that will help identify the relevant records, such as a hospital episode, a specific condition, or a treating consultant's name.

The preferred format for delivery is an important practical element. Under Article 15(3) of UK GDPR, where technically feasible and where the request is made electronically, the controller should provide the information in a commonly used electronic form. You should specify whether you prefer email delivery, access via an online patient portal, paper copies by post, or access to inspect records in person.

The request for supplementary information under Article 15(1) of UK GDPR should be included. This ensures that the controller provides not just the records themselves but also the accompanying information about processing purposes, retention periods, recipients, and your right to complain to the ICO.

The data portability request under Article 20 of UK GDPR may be included where relevant. This right allows you to receive the data in a structured, commonly used, machine-readable format — useful if you wish to transfer your records to a new healthcare provider or to use them with a health management application.

A reference to any previous unanswered request, or to any previous partial response, should be included where applicable. This provides a clear chronology and signals that you are aware of the statutory time limits and the consequences of non-compliance.

Finally, a clear statement of your intention to escalate the matter to the ICO or to seek a court order under section 167 of the DPA 2018 if the request is not properly complied with within the statutory period provides an important incentive for prompt and complete compliance.