How to make a subject access request

We collect some information from medical records, so that we can carry out our duties for the health and care service in England. Read more about the information we collect and the legal basis of these collections.

Where we store and use data collected from medical records, it is mostly held in the form of codes rather than words. We can check if there is any information about you stored in our collections. Where there is, we will send you a copy. We will give you a list of the codes used to help you understand the information we give you. Learn more about the health and care information we collect and why.  Where we process data about you, you can request to see it free of charge. (A reasonable fee may be charged in some cases, for example if repeated requests are made.)

If you work or used to work for NHS Digital, or related organisations that have now been replaced by NHS Digital, you can also request to see your employment records. 

We require proof of your identity before we can disclose personal data. This should include copies of two documents such as:

• your birth certificate
• your passport
• your driving licence
• an official letter addressed to you at your address (e.g. bank statement, recent utility bill or council tax bill)

The documents should include your name, date of birth and current address. If you have changed your name please supply relevant documents evidencing the change.

We require one form of documentation to confirm name and a separate form of documentation to confirm address. Please note that proof of address must be dated within the last 3 months.  

Please fill in the subject access request form and email it to enquiries@nhsdigital.nhs.uk   You will also need to include copies of information that confirms your identity.   

You can apply as a third party for someone that you are responsible for, including for a child, or for someone who has died. You will need to provide proof that you are allowed to act on their behalf. Health records are confidential so you can only access someone else’s records if you are authorised to do so. 

We do not hold medical records in the same format as a GP or hospital. If you want to see copies of someone else's medical records, you should ask your GP or the health setting that provided your care or treatment. Learn more about how to accessing someone else’s records. 

The Information Governance team who deal with Freedom of Information requests and Data Subject requests are not be able to collect or send post. 

We are not able to access our offices due to following government guidance around social distancing.

All freedom of information requests and data subject access requests should be submitted by email. If you have recently sent one in the post you can resubmit by email.

We thank you for your patience and are sure you understand the need to follow government advice. We hope to resume normal service as soon as possible, in line with government guidelines.

You can email your completed form and electronic copies of your identification documents to: enquiries@nhsdigital.nhs.uk. 

We will usually process your request within 30 days. As long as we have received proof of your identity. 

Following your request, we may write back to you within the 30-day time frame to request you to narrow or modify your requirements. This may also result in an extension of a further 60 days whilst we examine your request.

Information is provided in line with the General Data Protection Regulations (GDPR), Chapter 3, Article 15 (Recitals 63 & 64).

Take our short survey to tell us what you're looking for and why.