Access to Medical Records

Under UK Data Protection Legislation, individuals have the right to view or obtain copies of the personal information that we hold about them, including medical records. The Disclosure Team is responsible for responding to requests for information made under UK GDPR, Data Protection Act 2018, this is known as a Subject Access Request (SAR).

Requests for access to the records of deceased individuals are managed separately under the Access to Health Records Act 1990.

Access your records through MY CARE 

MY CARE is our patient portal and provides access to key parts of your medical record, allowing you to view information in near real time, including:

  • Upcoming and past appointment information

  • Clinic letters

  • Test results

  • Other information relating to your care

For many patients, MY CARE provides the quickest and easiest way to access information about their care. 
If you are not already registered, visit our MY CARE page to find out more and sign up

Using Artificial Intelligence (AI) to Help Draft Information Requests

We are seeing an increase in requests and follow-up correspondence that appear to have been generated using Artificial Intelligence (AI) tools. AI can be helpful when making an information request, however, AI-generated content can contain inaccuracies, include unnecessary information or make requests more complex than intended. Before using AI to draft an information request, it is important to consider what information you are seeking and whether the wording accurately reflects what you are seeking to achieve by making a request for information from UHP.

Where requests contain factual inaccuracies, overly broad wording or unnecessary complexity, the team may need to seek clarification before processing your request. This can create delays for both requesters and the Disclosure Team and increase the workload and administrative burden on the Trust.

Before submitting a request, we recommend reviewing the​ guidance published by the Information Commissioners Office (ICO) - How to write an effective request for information - ICO

To help ensure the Disclosure Team have all the information needed to process your request efficiently, we recommend using the application template provided in the "Alternative ways to make a Subject Access Request" section. If you choose not to use the template, please check that:

  • You only ask for information that you are genuinely looking for. AI tools sometimes generate requests that are broader than necessary or includes information that is excessive and goes beyond the information you actually want.

  • You specify a period of time where possible. For example, "the last 12 months" or "January 2023 to December 2025". This can help the team identify the information you need more efficiently.

  • Your request is clear, concise and focused. Requests that are specific and easy to understand are generally processed more quickly and accurately. If the team need to seek clarification regarding your request, this will result in a pause in processing and delay in your disclosure date.

  • There are no obvious factual inaccuracies. AI tools can misrepresent legislation, processes and organisational responsibilities. Please review the text of your request carefully ensuring you understand and agree with everything included in it, if it refers to something you don’t understand, please check what it is and that it is relevant before including. Don’t assume AI is right.

  • The tone is appropriate. AI-generated content can sometimes produce wording that sounds abrupt or inappropriate. Your request is read by a person who is trying to help and process your request as efficiently as possible. Please consider reviewing the tone before sending.

Requesting copies of your medical records

Subject Access Request made through MY CARE

In line with your UK GDPR Right of Access, you can submit a Subject Access Request (SAR) through MY CARE to request copies of your medical records.

Please note that while MY CARE provides immediate access to some information, the disclosure of records requested through a SAR is a manual process and records will not be released instantly. Requests will be reviewed and processed in accordance with relevant legislation and statutory timescales.

If you require access to a broader range of records, such as full clinical notes, audit trails, historical documentation, or other specific records not routinely available within MY CARE, please specify this in the free-text comments section of the MY CARE request form.

If you have any questions or require assistance with a request submitted through MYCARE, please contact the Disclosure Team at uhpdisclosureteam@nhs.net

For general MYCARE queries, please contact our dedicated MY CARE Helpdesk on: rduh.mycarehelp@nhs.net or call 01392 404664, 8:30am to 4:30pm, Monday to Friday. Outside of these hours, please email and we will respond as soon as we can.

The helpdesk can support MY CARE users from across Devon.

Alternative ways to make a Subject Access Request 

If you are unable to use MY CARE, a Subject Access Request can be made in writing to the Disclosure Team by post or email using the contact details at the bottom of the page and contained within the form. Please complete our ‘Subject Access Request (SAR) Form’ and clearly describe the information you would like to receive. If insufficient detail is provided, we may need to contact you for clarification, which could delay your request. 

Subject Access Request (SAR) Form 2026.docx [docx] 40KB

Before we can process your request, the Disclosure Team must be satisfied as to the identity of the person making the request. We require one form of identification before disclosing personal information. A list of accepted forms of identification can be found on the ‘Subject Access Request (SAR) Form’.

Requesting copies of records of a deceased individual

The Access to Health Records Act 1990 protects the confidentiality of patients after death. Next of kin do not have an automatic right of access to a deceased person's records unless they are:

  • The personal representative of the deceased (the executor of the will or administrator of the estate), or

  • A person with a claim arising from the individual's death.

Please use the ‘Access to Health Records (AHRA) Request Form’ when making a request for records relating to a deceased individual.

Access to Health Records (AHRA) Request Form 2026.docx [docx] 38KB

Right to Rectification

Under current Data Protection Legislation, you have the right to request the correction of personal information that is inaccurate or incomplete.

Please note that diagnoses and clinical opinions are matters of professional clinical judgement and cannot be amended solely at the request of a patient.

If you believe information held about you is inaccurate or incomplete, please contact the Disclosure Team using the details above and identify the information you believe requires correction.

FAQs

How long do we have to respond to your request?

Subject Access Requests

In accordance with Information Commissioner's Office (ICO) guidance, Subject Access Requests will be processed without undue delay and normally responded to within one calendar month of receipt of a valid request. Where a request is particularly complex or numerous, an extension of up to a further two months may be applied. If an extension is required, we will inform you and explain the reasons.

Access to Health Records Request for Deceased Individuals

Requests for access to the records of a deceased person are considered under the Access to Health Records Act 1990 (AHRA) rather than UK GDPR. Requests will be processed without undue delay and responded to within 40 days of receiving a valid request.

What is required for a valid request?

For a request to be processed, it must be considered a valid request. A valid request will consist of:

  • A clear description the information you would like to access. For example, specific appointments, clinic letters, test results, or a particular time period of care.

  • Proof of identity, we require one form of identification before personal information can be disclosed.

  • If you are acting on behalf of someone else, evidence that you have the authority to do so will need to be provided (for example, written consent, parental responsibility, lasting power of attorney, or evidence that you are the personal representative of a deceased person's estate).

  • Any additional information that may help us locate the records you require.

If we need further information to confirm your identity or clarify the scope of your request, we will contact you. This may affect the timeframe for responding to your request.

Is there a fee for making a Subject Access Request?

In most cases, there is no fee for making a Subject Access Request and your information will be provided free of charge.

However, a reasonable fee may be charged where a request is considered manifestly unfounded or excessive, or where further copies of the same information are requested. Any fee charged will be based on the administrative costs associated with processing the request.

Contact details Disclosure Team 

University Hospitals Plymouth NHS Trust

Central Records Library

Bush Park

Plymouth

PL6 7RG

Email: UHPDisclosureTeam@nhs.net  

Telephone: 01752 431678 
 

Was this page helpful?

Was this page helpful?
Rating

Please answer the question below, this helps us to reduce the number of spam emails that we receive so that we can spend more time responding to genuine enquiries and feedback. Thank you.

*
Recruitment - Page Footer Image