How to make a subject access request

Summary

You have the legal right to request a copy of the information we hold about you, in line with the General Data Protection Regulation (GDPR).

We do not hold medical records in the same format as a GP or hospital. If you want to see copies of your medical records, you should ask your GP or the health setting that provided your care or treatment.

We collect some information from medical records, so that we can carry out our duties for the health and care service in England. Read more about the information we collect and the legal basis of these collections.

Where we process data about you, you can request to see it free of charge. (A reasonable fee may be charged in some cases, for example if repeated requests are made.)

If you work or have previously worked for NHS Digital, or related organisations that have now been replaced by NHS Digital, you can also request to see your employment records.

The information we hold

Where we store and use data collected from medical records, it is mostly held in the form of codes rather than words. We can check if there is any information about you stored in our collections. Where there is, we will send you a copy. We will give you a list of the codes used to help you understand the information we give you. Data from our collections which may include some of your patient data includes:

Data on hospital visits, stays and treatments

We collect data on the times you have visited a hospital in England, either as an out-patient, in-patient or as an emergency. This is held in the Hospital Episode Statistics (HES) database.

Example of HES data

If you request to see data held about you in HES, it will look like this:

HES data example

Patient information on medical visits and treatments

The Secondary Uses Service (SUS) is used to collect, store and analyse patient level information for the NHS in England, which is used for planning, commissioning, payment and policy development.

Information on patients is collected when they get treatment or help from the NHS. It is also used to plan and commission health services, develop policy and pay different parts of the health service correctly. Because these uses are not to do with direct patient care, they are called 'secondary uses'. All organisations that provide NHS funded healthcare in England, including organisations in the independent sector, contribute data on their patients and their care and treatment to SUS. This information can then be used by commissioners, providers and planners.

Using SUS means that patient-level information is available for the good of the health service, without compromising patient confidentiality. Access to SUS data is strictly controlled. Users only get the level of access needed to do their jobs.

Example of SUS data

If you request to see data held about you in SUS, it will look like this:

SUS data example

Information on x-rays and other imaging used to diagnose illness

The Diagnostic Imaging Dataset (DID) is a central collection of detailed information about diagnostic imaging tests, for example x rays and MRI scans, carried out on NHS patients. DID includes information on imaging tests carried out from 1 April 2012. It does not include the images that are produced as a result of these tests. 

Information about you for your direct care

Your summary care record is an electronic record of important patient information, created from GP medical records. This helps other health and care professionals give you the right treatment when you are seen away from your GP practice, particularly in an emergency or at evenings or weekends. It can be seen and used by authorised staff in other areas of the health and care system involved in your direct care. Your SCR holds important information about current medication, allergies and details of any previous bad reactions to medicines.

Information on treatments offered to people with depression and anxiety

Improving Access to Psychological Therapies (IAPT) is an NHS programme in England that aims to improve the care of people with depression or anxiety by offering National Institute for Health and Care Excellence (NICE) approved treatments. The organisations that provide these treatments send data to NHS Digital so that the results of the treatment can be monitored, and used to improve care for depression and anxiety. This data is published in monthly reports.

Information on patients using mental health services

The Mental Health Services Data Set (MHSDS) contains data about the care of children, young people and adults who are in contact with mental health, learning disabilities or autism spectrum disorder services, and is used to improve patient care.

Your name, contact information and NHS number

The National Back Office (NBO) provides a national data quality service. It's responsible for the management of NHS Numbers and Personal Demographic Service (PDS) records, investigation and resolution of data quality incidents on demographic records. The PDS is the national electronic database of NHS patient details such as name, address, date of birth and NHS Number (known as demographic information).

How to make a request

Download the subject access request form, fill it in and return it to us, along with copies of information that confirms your identity. Please do not send in any original copies of documents.

You can apply as a third party for someone that you are responsible for, including for a child. You will need to provide proof that you are allowed to act on their behalf.

More details of acceptable types of identification documents are included in the application form.

You can email your completed form and electronic copies of your identification documents to:

enquiries@nhsdigital.nhs.uk

Or download the form, fill it in and post it with paper copies of your identification documents to:

Information Governance Compliance Team

NHS Digital

1 Trevelyan Square

Boar Lane

Leeds

LS1 6AE

Following your request, we may write back to you within the 30-day timeframe to request you to narrow or modify your requirements. This may also result in an extension of a further 60 days whilst we examine your request.

Information is provided in line with the General Data Protection Regulations (GDPR), Chapter 3, Article 15 (Recitals 63 & 64).