Requests for copies of health records

In the UK, data protection is governed by the General Data Protection Regulation (GDPR) 2018, and the Data Protection Act (DPA) 2018.

This legislation, together with the Access to Health Records Act 1990, entitles individuals to access personal data such health records (or that of another individual with explicit consent/evidence of lawful authority).

A request for copies of health records is commonly known as a Subject Access Request (SAR) however, it should be remembered that all patients, alive or deceased, and irrespective of age, are entitled to a duty of confidentiality of their health records.

We therefore have stringent protocols in place to ensure we do not make a disclosure of confidential patient health records to someone who cannot verify their identity or authority to be in receipt of these records.

Whilst a SAR can be made verbally or in writing, and no specific form is required, SAR’s must be supported by valid ID for the requestor. In addition to this, a SAR made for access to another individuals health records also requires evidence of the requestors lawful authority to be in receipt of that individual’s confidential health records.

We therefore recommend that you complete the appropriate form as explained below to prevent a SAR being rejected, or incurring any delays in our ability to assist you.

Once we are in receipt of a completed SAR, which must include the appropriate ID and supporting evidence of lawful authority as necessary, we have 30 days/one calendar month to disclose the requested health records. However, if the SAR is complex, this period can be extended by up to two further months. If this should be necessary, we will contact you within the statutory timeframe to advise of this.

Please note we can only disclose health records for which we are the Data Controller (i.e. they are our health records to share); for example, we cannot disclose GP records or the health records of care and treatment you received from another healthcare provider. In those instances, you must make a SAR directly to those organisations.

We are required to process a SAR free of charge, but a reasonable fee may be applied to cover administration costs if the SAR is excessive or repetitive. We disclose the requested health records via our secure portal; once disclosed, you have 30 days to download the records and then they will be removed. If you do not download the records within this timeframe, you will need to make a new SAR.

If you would prefer to have the requested health records posted to you instead, ensure this is clearly stated in your SAR and that you have given us your full postal address; however, please note we do not post copies of radiology images as these maybe significant in volume and printing radiology images affects their quality.

Accordion

If you have been a patient of our Trust (East Sussex Healthcare NHS Trust), you can apply for a copy of records of care and treatment we have provided you. Please follow this link Login – Portal, register with our secure portal (or use your existing log in credentials if you have made a SAR to us before), and select the “Request For My Own Health Records” form.

In order to satisfy our duty to data protection and patient confidentiality, you must ensure you provide the correct ID as stated in the form. If you do not provide the correct ID, this will delay our ability to assist you.

If you are the relative of someone who has been a patient of our Trust (East Sussex Healthcare NHS Trust), you can apply for a copy of records of care and treatment we have provided them on their behalf. Please follow this link Login – Portal and register with our secure portal (or use your existing log in credentials if you have made a SAR to us before), and select the “Relative Request For Patient Health Records” form.

In order to satisfy our duty to data protection and patient confidentiality, you must ensure you provide the correct ID as stated in the form for yourself as requestor, together with evidence of your lawful authority to be in receipt of the patients confidential health records as follows:

  • If the patient is alive and has capacity, we require a signed letter from them giving us their consent to make confidential health record disclosures to you (please note we may also ask for additional information to verify the patients ID);
  • If the patient is alive but does not have capacity to give us their consent, we require a document evidencing your lawful authority to act as their personal representative; this is often achieved by way of you being named an Attorney in the patients Lasting Power of Attorney;
  • If the patient is deceased, we require a document evidencing your lawful authority to act as their personal representative; this is often achieved by way of you being named an Executor in the patients Will, or given authority in a Grant of Probate or Letters of Administration; or
  • If the patient is under the age of 16, we require a document evidencing your parental responsibility for the child; this is achieved by way of the child’s full birth certificate naming you as parent or an adoption certificate naming you as the adoptive parent.

If you do not provide the correct ID and/or evidence of your lawful authority to act as the patients personal representative, this will delay or prohibit our ability to assist you. If you cannot provide the required documentation, then please contact our SAR Team at esh-tr.SAR@nhs.net to discuss the matter.

If you are a business, for example, a solicitor, insurance company, or medical expert reporting service, acting on behalf of someone who has been a patient of our Trust (East Sussex Healthcare NHS Trust), you can apply for a copy of records of care and treatment we have provided them. Please follow this link Login – Portal and register with our secure portal (or use your existing log in credentials if you have made a SAR to us before), and select the “Business Request For Patient Health Records” form.

In order to satisfy our duty to data protection and patient confidentiality, you must ensure you provide evidence that demonstrates you, your client or your client’s litigant friend has the lawful authority to give us consent to make disclosures of confidential health records to you as follows:

  • If your client is our patient, we require a signed consent form; or
  • If you are acting for your client’s litigant friend on behalf of or relating to a patient with no capacity, is deceased or is under the age of 16, then we require evidence of their lawful authority to act as the patients personal representative; this is often achieved by way of the client’s litigant friend being the patient’s Attorney in a Lasting Power of Attorney, named as an Executor in the patients Will if the patient is deceased, or a full birth certificate naming the client’s litigant friend as parent (if the client is under the age of 16).

Our Trust operates across a number of acute hospital sites and community locations, but holds one central medical record for each patient; you do not need to make a separate SAR for each of our hospitals/locations, nor do you need to make a separate SAR for different record types; one SAR, listing all required records, will suffice and reduce unnecessary administration.

Please also ensure the patient has received care and treatment from our Trust before submitting your SAR; other healthcare providers may operate from our acute sites or shared community locations, and there are a number of NHS Trust’s and healthcare providers across East Sussex, but we cannot access or disclose their records, nor do we hold the patients GP records. You will need to make a SAR directly to those organisations.

If you do not provide the correct documentation as stated above, this will delay or prohibit our ability to assist you. If you cannot provide the required documentation, then please contact our SAR Team at esh-tr.SAR@nhs.net to discuss the matter.

We appreciate that not everyone has the means or ability to make a digital SAR. If you would prefer to make a SAR using our paper form then please download the form below, complete it in full, and post it to the address shown enclosing copies of the correct ID.

Request for Copies of Health Records

If you cannot download or print off the form, please contact our Patient Advice and Liaison Service (PALS) at esh-tr.patientexperience@nhs.net and they will post one out to you.

Accordion

Please note there may be times when we are required not to show you parts of a requested health record. This will only happen if this is information that might relate to another patient, or if a healthcare professional considers that seeing the information might be harmful to you.

The Trust also complies with the NHS England “Records Retention and Disposal Schedule”. The key things to note which affect your SAR are:

  • The health records of deceased patients are destroyed after eight years. This eight year period is a legal requirement; it allows sufficient time for the relatives to find out any information regarding their family members’ health care leading up to their death. There are some exceptions to this rule;
  • Maternity health records are kept until the child of the patient is 25 years old;
  • The health records of deceased paediatric patients are kept for 25 years; and

If a patients cause of death is found to be suicide, health records are kept for 25 years.

If you are a member Trust staff, you can apply for copies of your employment records.

We are currently building a new digital SAR webform to facilitate this, and plan to launch it later this year. In the meantime, please continue to use the HR-SAR form on the Extranet (on the “Requests for Information” page) and submit your completed HR-SAR form to the email address provided at the foot of the form.

Please come back to this page in Autumn 2026 for an update.