Draft letter for your own medical records - Thyroid UK

Thyroid UK
101,259 members115,555 posts

Draft letter for your own medical records

Here is a copy of my letter to get my medical records from my doctor. you may use it when you speak to receptionist to save time, or if they are difficult, send the letter. you can alter it how you like just copy and paste (and add or delete). most surgeries usually don't charge once they get over the shock of the request, so the paragraph about fees may not be applicable.

Data Protection Act 1998

Freedom of Information and Data Protection (Appropriate Fees and Limits) Regulations 2000

Good Medical Practice

Subject Access Request – My Own Medical Records

Please will you provide a copy of my medical records as I am entitled to have under the above Act. I require my notes from #date to #date. Please will you provide the copies within 40 days of receipt of this letter.

I understand that you may charge a fee for providing copies of my notes and that such a charge is set at a MAXIMUM of £50. If you do wish to make a charge please inform me what that fee amounts to as soon as possible. Please note that, under the above Act and Regulations, such a charge has to be reasonable. Reviewing, redacting and considering whether information held is exempt from charging and cannot be considered as part of the Fees Regulations calculations. I estimate that a reasonable charge for a copy of my medical records should be around 20p to £1.00, based on the Fees Regulations and guidance from the Information Commissioners Office.

Further, please will you ensure that the records are in a format that I can understand as required by paragraphs 21 and 32 of good Medical Practice. This should include expanding all acronyms, including reference ranges and where possible, referencing the guidance or other document that you have based any of your conclusions on and explaining any unusual terms.

Yours Sincerely

27 Replies

Should that reference be to Good medical practice (2013) because as of, umm, coming Monday, that will be the version in force?

Looks good!

Rod (well known for being a pedant!!!)


Yes, it should. The paragraphs quoted refer to GMP 2013.


Thanks Bob.


Don't know if you have come across this site but it may be useful as it gives you a letter already drawn up.


Moggie x

1 like

Thanks for the link. I'm sure members will find it useful.

The main difference is that my letter adds a section requesting the info to be in a form that a patient can understand, in line with Good Medical Practice (2013).

What ever works for the members to get their records is most important.

The Govt and the GMC want us patients to help ourselves. Having our medical records to hand in a form that we can understand is a big way forward. Its also a huge change in the way that doctors think that they will simply have to get used to.


Couldn't agree more.

Moggie x


Also, I included a paragraph about charges not covered by the ico letter.

I did this because some practices charge a standard fee of the maximum of £50, contrary to the Regulations.

I just hope that members have the knowledge and confidence to be empowered to ask for their records and challenge any of the obstructive blocks some surgeries think they can put up.


The more I read on here the more my gp practice is not being fair. I got charged full 50 pound for mine and then hubbys. I've taken a while to go through them didn't realise at the time no blood results in there. When I asked they said oh you have to ask for them separately.

I asked for full records how am I supposed to know that.

I don't want to pay again and its last year I paid for them.

Our gp also won't give any supporting letters re dwp, will only if dwp write to them and then they didn't fill in and missed half my conditions off.

They say its practice policy.

I'm afraid of cha

Changing gp,s in case another one is worse.


My interpretation is that if you ask for all your personal data then they should provide all your personal data. your blood test results are personal data and should have been provided at the original request.

You have already paid for ALL you personal data so the surgery should comply with your original request and they failed to do so. Consequently, the surgery has not complied with the law.

If I were in your position I would write to the surgery informing them that the blood tests were missing from your original request for ALL of your personal data.

Ask them to comply with your original request otherwise you will have no option but to report them to the Information. The ICO has a great letter on its website ico.org.uk/for_the_public/p...

here's a copy

[Name and address of the organisation]

[Reference number (if provided within the initial response)]

Dear […]

Subject access request

Further to my letter of [date] in which I made a subject access request, I would now like you to revisit the way you handled my request.

I requested the following information: [List information]

I received a response from you on [date] from [name of person in the organisation responding]. I have attached a copy of both letters for your information. From the information you have provided and from my reading of the Information Commissioner’s Office website at ico.org.uk, I suspect you have failed to disclose all the relevant information I requested.

I believe that I have not received all the data I am entitled to. I expected to receive any personal data relating to me that may be contained within the following: [List the records that you want the organisation to search and where they might be found, including any relevant dates, for example:

your personnel file;

emails between ‘A’ and ‘B’ (between 1/6/11 and 1/9/11);

your medical records (between 2006 & 2009) held by Dr ‘C’ at ‘D’ hospital;

CCTV camera situated at (‘E’ location) on 23/5/12 between 11am and 5pm;

copies of statements (between 2006 & 2009) held in account number xxxxx).]

If you have withheld any information relating to me I would be grateful if you would confirm this and tell me why you consider it appropriate to do so.

If there is anything further you can do to resolve this matter, or further information you can provide, please do so.

As the statutory time limit for responding to my subject access request (40 days) has now expired, I would be grateful if you could provide this information within 14 days.

I must advise you that if I do not receive a satisfactory response from you, I will submit a ‘request for assessment’ to the Information Commissioner’s Office (ICO).

You can find advice on the ICO’s website on how to deal with a subject access request [ico.org.uk/sar] and information on their powers and the action they can take [ico.org.uk/action] or call them on 0303 123 1113.

*If there is anything you would like to discuss, please contact me on the following [telephone number].

Yours sincerely


if they dont reply report them to the ICO. In my view, its important to report surgeries that act like yours.

first, to get the info you want and

second to stop them acting like this with other patients.

Good luck!


Thanks Nbob the problem I have is I had my records last Aug, but with family situation, only looked at them after Xmas. I think it would be too late to ask or complain now.


its still less than a year.

I think that a year is a reasonable time period to resolve data protection issues


We asked for full medical records in person, mu son and myself, spoke to practice manager my son was complaining for me ad they had sent an important letter AMD missed of a few of my conditions, we wet.t happy.


I meant to say thanks good letter, but I started a ramble gtrr lol


Thankyou NBob

This will be a great help as with brain fog and memory loss I struggle with things like this. My endo has recently refused to let me see the tests he did and the results. Is it a different protocol with endocrinologists?



No, its the same for all data holding bodies.


Hi Bob,

When one makes a SUBJECT ACCESS REQUEST, under the Data Protection Act, the organisation (i.e. the GP practice) must provide all data i.e. data from ALL sources of data, that relate/refer to you the individual.

So, that includes:

medical records, non-medical records, emails, phone logs, messages, etc. Even emails that were sent between the staff and the GP's to one another about you, where they may've slagged you off.

That applies to all organisations.


Hi Londinium,

According to the ICO Subject Access Request is the term for any request for your personal information. I'm afraid that a SAR doesn't mean all of your information, unless you specifically ask for all of it. You can limit what you require in your request or letter.


Hi, I rang the ICO and the GMC, and they both said that via the subject access request, all data from all sources of data should be provided to me, if they relate to me.

I have failed (so far) to have my gp practice delete inaccurate and negatively intended remarks, from my records.

These people are not worthy of the trust that is bestowed on them. Little is done about them, and they're safe in that knowledge. That's why they feel entitled to treat us with contempt - because they know that no one is likely to do anything.

1 like

Hi Londinium

there are 2 separate issues in our reply above: what is a SAR and altering inaccurate records.

There may be some confusion re SARs. A SAR does not mean that ALL records are automatically released on every SAR. You can ask for all records if you want or you can ask for certain records if you want. It doesn't make sense to get all your records every time you submit a SAR. Here's an excerpt from the ICOs website ico.org.uk/for_the_public/p...

When requesting your personal information from an organisation, you should include the following information:

your full name, address and contact telephone number;

any information used by the organisation to identify or distinguish you from others of the same name (account numbers, unique ID's etc);

details of the specific information you require and any relevant dates, for example:

- your personnel file;

- emails between ‘A’ and ‘B’ (between 1/6/11 and 1/9/11);

- your medical records (between 2006 & 2009) held by Dr ‘C’ at ‘D’ hospital;

- CCTV camera situated at (‘E’ location) on 23/5/12 between 11am and 5pm;

- copies of statements (between 2006 & 2009) held in account number xxxxx .

Some GPs are very arrogant and think that just because they are GPs, they don't have to do the things that the rest of us do. That is not so as they have to abide by the Data Protection Act just like all other public bodies.Unfortunately it is up to the patient in most cases to start taking action against GPs who dont act in a professional manner.

Regarding the inaccurate information see the ICO page here


it says:

The fourth data protection principle requires personal data to be accurate. Where it is inaccurate, the individual concerned has a right to apply to the court for an order to rectify, block, erase or destroy the inaccurate information. In addition, where an individual has suffered damage in circumstances that would result in compensation being awarded and there is a substantial risk of another breach, then the court may make a similar order in respect of the personal data in question.

This right also applies to personal data that contains an expression of opinion based on inaccurate personal data.

here's a draft letter for you

Dear Doctor ?

Data Protection Act 1998 Fourth Data Principal

Good Medical Practice paragraph 21 and 68

I note from seeing my medical records that they contain some inaccurate information. The inaccurate in formation is …….

I also note that the records contains an expression of opinion based on inaccurate personal data, namely ………

Under my rights in the Data Protection Act 1998 I would like this inaccurate information rectified to ………. I would also like the opinion described above erased.

Please amend my medical records in the manner described above within 7 days and inform me that those changes have been made.

If you do not amend my medical records within 7 days I will have no choice but to go to court to obtain a court order requiring you to amend and erase my records in the manner described above or order that a statement of the true facts (in terms approved by the court) should be added to the record that contains it.

Yours Faithfully


Some interesting information!

Do you think there's any chance of having a diagnosis of depression removed due to GP error? I've not actually seen my records partly cos I'm so angry with NHS incompetence resulting in failure to diagnose hypo.


That is a really good question and I don't think I am qualified to answer that. It really should be addressed to a lawyer.

Nevertheless, here are my thoughts for what they are worth.

A diagnosis is based on the GPs opinion of the results of the investigation s/he made. If that opinion was based on inaccurate personal data then you can apply to have that opinion removed.

My interpretation is that if your GP recorded all your signs and symptoms and test results accurately and based his/her opinion of your diagnosis on those findings then the diagnosis cannot be amended.

e.g. AGP correctly records in your medical notes the TSH result of 2.5mIU/L, correctly records your signs and symptoms and bases his/her opinion that you do not have hypothyroidism but you are depressed. No action because s/he has not based his/her opinion on inaccurate data. The GP should be free to make an informed interpretation on accurate data.

If the GP gets his/her interpretation wrong on accurate data the redress lies elsewhere, in my view.The remedy for that situation, in my view, is with the GMC rather than via the Data Protection Act.

If, however, the GP's opinion is based on inaccurate personal data then the Data Protection Act can be used to strike out that opinion from the records, in my view.

e.g. the GP records your signs and symptoms correctly. the blood test is TSH = 25mIU/L but is recorded as 2.5mIU/L. the GP's opinion is a diagnosis of depression not hypothyroidism. The GP has based his opinion on inaccurate data and this statement of opinion can be rectified, blocked, erased or destroyed. this just deals with the data not the treatment.

What follows is an entirely different question!

REMEMBER this is not my area of expertise and just my own basic interpretation of the DPA. Anybody else any views?


Ha! Thanks for your reply NBob and a tricky question I posted.

In an ideal world I would like it to be documented that GPs were wrong and did not have the knowledge to make a proper and accurate diagnosis.

If we have access to our medical records then somewhere it should state on mine that my GPs screwed up and I sought alternative treatment hence my complaint against them.

I feel it's important that future GPs are aware of this and basically cut the cr*p!!

In an ideal world obviously ...


Extra paragraph

I am aware that there is an exemption for releasing personal data relating to an individual’s physical or mental health. This applies only in certain circumstances and only if granting subject access would be likely to cause serious harm to the physical or mental health of the individual or someone else. I can assure you that my physical or mental health will not be harmed on receipt of this information.


I read in Pulse this past week that doctors are opposed to patients having access to past records when the online service is introduced. I also read that GPs are being very careful about what they now write following a consultation which is a good thing.

I hope when the online access is introduced we can at least have access to test results from the past and that patient groups involved in the decision making process do not permit medical staff to determine what is in our best interests.


That's right. Doctors have to comply with Good Medical Practice, The Data Protection Act and the NHS Information strategy. This means that GPs will have to write proper accurate records in a form that patients can understand. So no acronyms, including reference ranges, explaining complex terms and quoting where they got their information from, recording what the patients preferences are and why the GP agrees or disagrees. Compared to the sparse notes some GP write, its a big change for some of them and I think that's why some of them are squeaking.

BUT, I work in an enforcement role at a local authority and i think about the notes I have to make in the course of an investigation and I have to write down a lot of notes in an accurate fashion in form that a court can understand. GPs will jsut have to get used to being accountable to their patients and write good records. Patients will also need to keep the GPs on their toes

1 like

Many thanks for that Nbob. Is filed away for future reference for me or anyone who needs it.



i send letter gp doctor to request medical record last month 6/04/17 to 9/05/2017 i didn't received my medical records .

i went two time at gp doctor to check about my medical report receptionniste she said your medical record is not ready yet , i told her whey , she said i didn't now .

I am diabetic and blood pressure and epileptic and two operation ....

I don't now Why they do this to me Why it make me that it tires me why all this and I need this document urgent ..

Could you please tell me how i can do


Thank you


You may also like...