Health records are confidential so you can only access someone else's records if you’re authorised to do so.
To access someone else's health records, you must:
- be acting on their behalf with their consent, or
- have legal authority to make decisions on their behalf (power of attorney), or
- have another legal basis for access
Applying for access to someone else's health records
A request for someone's medical records should be made directly with the healthcare provider that provided the treatment, such as:
This is known as a Subject Access Request (SAR), as set out by the Data Protection Act of 1998.
Many healthcare providers have SAR forms that you can complete and return by email or by post.
Here is an example of an SAR form on the North Bristol NHS Trust website.
You will need the patient's written consent if you wish to inspect their record.
Where written consent is not possible, other arrangements will be necessary.
Under the Data Protection Act, requests for access to records should be met within 40 days. However, government guidance for healthcare organisations says they should aim to respond within 21 days.
Refused request
A healthcare provider can refuse to supply some of your request if, for example:
- it is likely to cause serious physical or mental harm to the patient or another person
- the information you have asked for contains information that relates to another person
If your request is rejected, or you have a complaint about the process, you can complain to the healthcare provider.
If you are still not satisfied, you can make a complaint to the Information Commissioner.
Patients unable to give consent
If a person does not have the mental capacity to manage their own affairs and you are their attorney, you will have the right to apply for access.
This would apply, for example, if you have a Lasting Power of Attorney with authority to manage their property and affairs.
The same applies to a person appointed to make decisions about such matters by the Court of Protection in England and Wales.
Accessing children's records
A person with parental responsibility will usually be entitled to access the records of a child who is under 16. However, the best interests of the child will always be considered.
If the healthcare provider is confident that the child can understand their rights, then it will respond to the child rather than the parent.
Application fees
You may have to pay a fee to access someone else's medical records. Find out how much you'll have to pay to access medical records.
Further information:
Your health, your choices