How to make a subject access request
You have the legal right to request a copy of the information we hold about you, in line with the General Data Protection Regulation (GDPR).
If you want to see copies of your medical records, you should ask your GP or the health setting that provided your care or treatment. We do not hold medical records in the same format as a GP or hospital, for example: GP notes, X-rays or scans.
What information we hold
We collect some information from medical records, so that we can carry out our duties for the health and care service in England. Read more about the information we collect and the legal basis of these collections.
Where we store and use data collected from medical records, it is mostly held in the form of codes rather than words. We can check if there is any information about you stored in our collections. Where there is, we will send you a copy. We will give you a list of the codes used to help you understand the information we give you. Learn more about the health and care information we collect and why. Where we process data about you, you can request to see it free of charge. A reasonable fee may be charged in some cases, for example if repeated requests are made.
If you work or used to work for NHS Digital, or related organisations that have now been replaced by NHS Digital, you can also request to see your employment records.
How to make a subject access request for yourself
Only complete this form if you wish to obtain a copy of the coded/statistical information as held by NHS Digital in line with data protection legislation and return to the address below.
Please do not use this form if you require copies of your medical notes (for example: x-rays, scans, consultant/GP notes) as we will not be able to assist you.
Find out more about how to make a data subject access request.
Requests may be made in writing, by email, or by speaking to us. Find out about the different ways of contacting us.
How to make a request for someone else
You can apply as a third party for someone that you are responsible for, including for a child, or for someone who has died. You will need to provide proof that you are allowed to act on their behalf. Health records are confidential so you can only access someone else’s records if you are authorised to do so.
We do not hold medical records in the same format as a GP or hospital. If you want to see copies of someone else's medical records, you should ask your GP or the health setting that provided your care or treatment. Learn more about how to accessing someone else’s records.
Our response
We will usually process your request within 30 days. As long as we have received proof of your identity.
Following your request, we may write back to you within the 30-day time frame to request you to narrow or modify your requirements. This may also result in an extension of a further 60 days whilst we examine your request.
Information is provided in line with the General Data Protection Regulations (GDPR), Chapter 3, Article 15 (Recitals 63 and 64).
Last edited: 12 February 2025 4:29 pm