The introduction of the General Data Protection Regulation (GDPR) on 25 May 2018 will bring about changes in the way in which personal data is handled by organisations. The new regulations will reinforce the right of individuals to access their personal information.  One important change is that patients will be able to obtain a copy of their medical records quickly and free of charge.

Why request your medical records?

  • To gain a better understanding of your own medical conditions and history, or that of the person you are caring for;
  • Be better informed about any medication prescribed, particularly where a condition needs frequent prescriptions;
  • If you are concerned about medical treatment that you or the person you are caring for has received;
  • Ensure that any information recorded is complete and accurate;
  • If, following a review of your records, you wish to amend or modify them by making a request for rectification (

What are the upcoming changes?

Presently, medical records can be obtained by making a formal or informal request for a copy of their records; an application form is not required. The GP/hospital/clinic is allowed 40 days to provide the records, charging a fee of up to £50.

The new rules will provide for the following: -

  • There will be no fee unless the request is clearly unsupported or excessive, in which case a ‘reasonable fee’ of the administration costs can be charged.
  • Any medical records requested will need to be provided within one month.
  • If the healthcare provider refuses such a request, they must give the patient the reasons for their refusal and inform them of their right to complain.

This will mean that patients will be able to access their medical records easily, without cost and quickly.   As specialist clinical negligence lawyers supporting the rights of patients, we welcome the new GDPR in providing patients with easier access to their records. 

Requesting medical records on behalf of a deceased person

Despite the upcoming changes, a request to amend medical records on behalf of a deceased person will continue to attract a fee, even after the implementation of the GDPR. Such medical records are currently not seen as personal data under data protection law.

If following review of your medical records, you have any concerns about the medical treatment that you have received, we are very happy to discuss your concerns with you and review your medical records - please call our specialist medical negligence lawyers on 0345 241 0154. 

Jennifer Peus- Jennifer Peus