Applying for Healthcare Records. Dealing with delays

Applying for Healthcare Records. Dealing with delays

DelaysWhether appealing a decision to refuse NHS Continuing Healthcare Funding to a Local Resolution Panel Meeting or appealing to an Independent Review Panel, it’s essential that you get hold of a copy of your relative’s health records.

Under the Data Protection Act 2018, a health record is defined as one “which relates to the physical or mental health of an individual which has been made by or on behalf of a health professional in connection with the care of that individual”.

Health records include: care home/nursing records, GP records and hospital records.

When considering your appeal, you will need to review the entries in these healthcare records in some detail, and look for changes in your relative’s healthcare needs and other vital evidence that will support your relative’s claim for eligibility for NHS Continuing Healthcare Funding. For help with appeals, read our blogs Rejected for CHC Funding? Part 1: How to Appeal the MDT Decision and Rejected for CHC Funding? Part 2: How to appeal the Local Resolution Decision for more information on appeals…

However, most Care Homes, GP practices and Hospitals, don’t often make copying a large bundle of (jumbled) records a priority, especially if staff resources are already stretched carrying out other duties. Smaller GP practices and care homes view these requests for records as an ‘annoyance’ or an ‘inconvenience’.

However, getting hold of these records must be a priority for you, as often rigid timescales will be imposed within which to lodge your appeal submissions – so timing could be critically urgent as there can be an awful lot of paperwork and fine detail to consider.

Even though you can make a subject access request verbally, we recommend that any request for these records is made formally and in writing, preferably by recorded delivery (or by email) – at least that way you will have a traceable record of it.

There are forms you can access on the internet to assist you, or else you can prepare your own written authority. A free template letter can be found on the Information Commissioners Office (ICO) website:

The requests for healthcare records can either be done under the General Data Protection Regulation 2018 (GDPR) or the Data Protection Act 2018, giving patients a right of access to their own health records – using a Subject Access Request.

Under GDPR, the party supplying the records (eg care home) cannot legally charge you a fee to comply with your Subject Access Request, unless the request is manifestly unfounded or excessive – particularly if it is repetitive. In this case there may be a fee for the administrative costs of complying with your request.

Unless you are the patient applying for your own records, you will need prior written authorisation giving you legal capacity to represent the patient in order to be able to access these records, e.g. a Power of Attorney, copy Will, or Grant of Probate etc.

You may also be asked to provide photographic identity (eg a copy of your current valid driving licence or passport) and confirmation of your address (e.g. bank or building society statement, credit card statement, financial statement, mortgage statement, Council Tax statement or utility bill – dated within the last three months).

Some providers may insist on seeing the original documentation rather than a copy. But, rather than risk parting with your originals, certified copies will usually suffice.
Certification can be done by a professional such as a solicitor or someone in the medical profession (a GP or Consultant). NB: there may be a small charge applied for certification.

The provider of the records only has one calendar month from the date they receive your request to comply, failing which you can look at sanctions.

Remember to ‘remind’ the records provider of the timescales that apply and diarise forward before the 30 days are up to ensure that the records are on their way, if they have not yet arrived. You can threaten to report them to the ICO if there are delays.

Alternatively, if applying for medical records for a deceased person, the Access to Health Records Act 1990 gives every person the right to apply for access to their own medical records. Again, similar requirements as to proof of your capacity to act, proof of identity and address will usually be requested as standard before they will release any medical records. Under this Act there may be a reasonable charge for copying and administrative expenses, but this is limited to £50. The records provider only has 40 calendar days to respond. Again, it’s best to diarise forward and chase a reply.


  • If requesting documentation on behalf of a child, then you will need to provide their birth certificate (full version only) and a Court Order of Parental Responsibility.
  • If acting on behalf of the patient, you will need to provide their written consent, Power of Attorney for health and welfare (not property and financial affairs) or Deputyship under the Mental Capacity Act.
  • If acting on behalf of a deceased patient, you will need to provide a copy of the Last Will and Testament naming you as the Executor, a Solicitor’s letter granting Executor status, or a Grant of Probate.


Getting hold of healthcare records can often be a frustrating and tedious chasing process. However, the Data Protection Act 2018 and Access to Health Records Act 1990 legislation are there to help you.

Delays beyond the prescribed timescales are unfortunately quite common, so you must be prepared to act swiftly at the first sign of any delay. Press for your records. Time is of the essence, and if you are to bolster your chances of a successful appeal, you need to see these records as early as possible.

1 Comment

  1. paul speight 1 year ago

    Reading this article alerts me to one worrying possibility: that if my Mother dies, the little progress we have made even on securing info via subject access request (12 months after our request was first submitted we have only had one of 10 points supplied in a satisfactory manner or at all) will be voided as we may have to start again under new provisions regarding our need to prove we have the right to request her data.. Could you comment on this please? Paul

Leave a reply

Your email address will not be published. Required fields are marked *


2100 characters max. All comments are moderated in line with our Acceptable Use Policy and our Terms of Website Use.