Generic Medical Records Request Form Template for England and Wales

You have a legal right to access your medical records under the Data Protection Act 2018 and UK GDPR in England and Wales. The Generic Medical Records Request Form provides a structured approach to exercising this right, ensuring healthcare providers have all necessary information to process your request efficiently while maintaining compliance with data protection legislation.

When do you need this document?

You'll need this form when requesting copies of your medical records from NHS trusts, private hospitals, GP surgeries, or other healthcare providers. Common situations include preparing for legal proceedings where medical evidence is required, applying for insurance policies that require medical history disclosure, changing healthcare providers and needing to transfer your medical history, or simply wanting to review your own health information for personal records. The form is also essential when acting as an authorized representative for someone who lacks mental capacity under the Mental Capacity Act 2005, or when accessing deceased relatives' medical records as permitted under the Access to Health Records Act 1990.

Key legal considerations

Healthcare providers must respond to your request within one month under UK GDPR, though complex requests may be extended by up to two months with notification. You cannot be charged a fee for accessing your own records, but reasonable administrative costs may apply for additional copies or extensive requests. The form must clearly identify the specific records you're requesting, as providers are not obligated to search through entire medical histories without clear parameters. When requesting records on behalf of another person, you must provide legal documentation proving your authority, such as a lasting power of attorney or court order. Healthcare providers may refuse requests if releasing the information would cause serious harm to your physical or mental health, though they must provide clear justification for such decisions.

Legal requirements in England and Wales

Under the Data Protection Act 2018, healthcare providers must verify your identity before releasing any medical records, typically requiring photographic identification and proof of address. Special category data protections apply to health information, meaning stricter consent and processing requirements govern your request. If you're requesting records for legal proceedings, you must specify this purpose as it may affect how quickly the provider responds and what format they provide. The Mental Capacity Act 2005 governs requests made on behalf of individuals lacking capacity, requiring evidence of lasting power of attorney or court-appointed deputyship. For deceased patients' records, the Access to Health Records Act 1990 limits access to personal representatives, close family members, or those with legitimate claims, and only allows access to records created after the patient's death or within 40 days before death unless there are ongoing legal proceedings.