🌐 Orbit Publishing Network | Public Interest Audit Division
Home › Dispatches › How to Get Your Full NHS Medical File
UK GDPR Article 15 & Data Rights Playbook

How to Get Your Full NHS Medical File & Computer History

A step-by-step statutory guide to requesting your complete medical notes, hospital computer access logs, erased entry metadata, and raw DICOM radiology imaging without paying fees or accepting partial summaries.

Legal Framework: UK GDPR Article 15 / DPA 2018 Section 45
Compliance Clock: 30 Calendar Days (Statutory Right)
Scope: GP Notes, Hospital EHR, PACS Imaging & Audit Logs

1. The Myth of the "Standard Printout"

When you ask your GP surgery or hospital trust for "a copy of my medical records," they almost always hand over a surface-level summary printout. Most patients assume this single stack of paper represents everything the NHS holds on them.

In reality, standard printouts frequently omit electronic consultation timestamps, deleted note histories, administrative staff comments, and raw computer access trails. If you are investigating a misdiagnosis, delayed treatment, or unlawful record peeping, a basic summary leaves you completely in the dark.

⚠️ The Summary Trap

NHS Data Protection Officers frequently issue standard Summary Care Records (SCR) or brief clinical timelines, asserting "this is your full file." Under UK GDPR Article 15, you have a statutory right to all personal data and metadata held in electronic databases—not just curated summaries.

2. What Your Full NHS Medical File Actually Contains

An electronic health record is not a single document; it is a complex web of interconnected databases spanning primary care (EMIS Web / SystmOne) and secondary hospital trusts (Epic / Cerner Millennium).

To conduct a true forensic audit of your care, your Subject Access Request (SAR) must explicitly specify these five distinct record layers:

Layer 01

Full GP Electronic Health Record (EHR)

Unredacted GP consultation notes, problem lists, diagnostic coding histories (SNOMED codes), internal practice tasks, repeat prescription logs, and incoming specialist letters.

Layer 02

Hospital Electronic Patient Records (EPR)

Admissions records, emergency department triage notes, nursing charts, multidisciplinary team (MDT) meeting minutes, discharge summaries, and outpatient clinic dictations.

Layer 03

Computer Audit Trails & Access Logs

Timestamped digital logs tracking every staff member who opened, viewed, modified, or printed your file—including user IDs, workstation locations, and access times.

Layer 04

Raw PACS Radiology DICOM Imaging

Original high-resolution DICOM files for X-rays, CT scans, and MRIs on CD/USB, alongside formal radiologist reports and scan acquisition metadata.

3. Standard Summary vs Full Forensic Subject Access Request

Understanding the difference between what the NHS offers by default and what you are legally entitled to receive under UK GDPR Article 15 is crucial for protecting your rights:

Record Category Standard Default NHS Summary Full Forensic Article 15 SAR
GP Consultations Recent 2–3 year summary list Complete lifetime electronic & paper Lloyd George cards
Audit Logs Omitted / Hidden Complete digital access & modification logs
X-Rays & MRIs Text report only Full DICOM raw scan images + PACS metadata
Administrative Notes Excluded Internal emails, secretarial tasks & referral logs
Statutory Cost & Limit Free (often limited access) Free of charge within 30 calendar days

4. Statutory SAR Template & Demand Notice

When submitting your request to the GP Practice Manager or Hospital Data Protection Officer (DPO), use explicit statutory language to ensure full disclosure without illegal redactions or delays:

FORMAL SUBJECT ACCESS REQUEST (UK GDPR ART. 15 / DPA 2018) To the Data Protection Officer / Practice Manager: Under Article 15 of the UK GDPR and Section 45 of the Data Protection Act 2018, please provide full electronic copies of all personal data held regarding [Your Full Name, DOB, NHS Number]: 1. Full electronic GP notes, historical paper Lloyd George records, and SNOMED diagnostic coding logs. 2. Complete hospital EPR records (Epic/Cerner), MDT minutes, discharge notes, and nursing charts. 3. System Audit Logs showing every staff user ID, timestamp, and location that accessed my record. 4. Raw PACS DICOM radiology image files (X-ray, CT, MRI) along with complete radiologist reporting. Statutory Compliance Deadline: 30 Calendar Days.

🤔 Formative Questions & Community Debate

Take a moment to reflect on your own experience with NHS record requests and share your insights:

  • Question 1: When you last requested your medical records, did your surgery provide complete computer access audit logs, or were you given only a surface-level summary?
  • Question 2: Have you ever discovered unexplained gaps, altered consultation dates, or missing specialist referral letters when reviewing your health notes?
  • Question 3: Were you aware that you are legally entitled to receive raw high-resolution DICOM scan files (MRIs/CTs) directly from the hospital radiology department free of charge within 30 days?