How to Get Your Medical Records: Rights and Deadlines

This guide quotes the law itself: the EU's General Data Protection Regulation, the European Health Data Space Regulation, the UK's version of the GDPR, the US HIPAA Privacy Rule, and the NHS's own guidance. It is general information, not legal advice. Read on 6 November 2026.

Your health history is probably spread across a family doctor, two or three hospitals, a lab, a pharmacy and perhaps a clinic in a country you used to live in. Each of them holds a piece, and none of them holds the whole. When you need it, a new specialist, a second opinion, a move abroad, or just making sense of a long illness, you are usually told to call, wait, and call again.

You do not have to ask as a favour. In the EU, the UK and the US, you have a legal right to a copy of the health information held about you, with deadlines and rules on what it may cost. This guide sets out what each law says, gives you a request you can send, and ends with what to do once the records arrive.

In the European Union: one month, and free

In the EU, your medical records are personal data, and the General Data Protection Regulation gives you the right of access in Article 15: you have the right to obtain "confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data".

Three rules make that right practical:

• The deadline. The clinic or hospital (the "controller") must respond "without undue delay and in any event within one month of receipt of the request", and may extend that "by two further months where necessary, taking into account the complexity and number of the requests" (Article 12(3)). If it extends, it must tell you so "within one month of receipt of the request, together with the reasons for the delay".
• The cost. Your request and the response "shall be provided free of charge" (Article 12(5)). The controller "shall provide a copy of the personal data undergoing processing", and may charge "a reasonable fee based on administrative costs" only "for any further copies" (Article 15(3)).
• The format. If you ask electronically, "the information shall be provided by electronic means where possible, unless otherwise requested by the data subject" (Article 15(3)). An email asking for your records should get you a digital copy, not a stack of paper.

There is also a right to data portability (Article 20), which lets you receive data "in a structured, commonly used and machine-readable format" and move it elsewhere. It applies only to data you provided yourself and processed on the basis of your consent or a contract, so for most hospital records the right of access is the one to use.

What changes from 2029: the European Health Data Space

The EU has gone further. The European Health Data Space Regulation, Regulation (EU) 2025/327, gives every person the right to access their electronic health data through a national access service, and states that "access shall be provided immediately after the personal electronic health data have been registered in an EHR system ... and shall be provided free of charge and in an easily readable, consolidated and accessible format". You will also have the right "to download free of charge an electronic copy".

It arrives in two steps. From 26 March 2029 it covers patient summaries, electronic prescriptions and electronic dispensations; from 26 March 2031 it adds "medical imaging studies and related imaging reports", "medical test results, including laboratory and other diagnostic results and related reports" and discharge reports. Until then, the GDPR route above is how you get them.

In the United Kingdom

The UK kept its own version of the GDPR, and the right of access still applies: actions taken on a request are, in the words of Article 12 of the UK GDPR, "provided free of charge". Ask your GP surgery or hospital trust in writing for a copy of your records.

For GP records there is often a faster route: the NHS App shows your GP health record, including test results. The NHS notes that if a test was carried out before October 2023, it may not appear automatically in your NHS App, and that you can contact your surgery to request access to older results. Hospital records and results ordered privately usually need a separate request.

In the United States: 30 days, at a cost-based fee

In the US, the HIPAA Privacy Rule's right of access, 45 CFR 164.524, applies to doctors, hospitals, labs and health plans:

• The deadline. The provider "must act on a request for access no later than 30 days after receipt of the request". If it cannot, it "may extend the time for such actions by no more than 30 days", provided it tells you in writing why and when, and it "may have only one such extension".
• The format. You get your records "in the form and format requested by the individual, if it is readily producible in such form and format", so you can ask for an electronic copy.
• The cost. Unlike the EU, US providers may charge "a reasonable, cost-based fee", and the rule lists what it may include: labour for copying, supplies for creating the copy, postage, and preparing a summary if you agreed to one. Nothing else.

If your provider has a patient portal, it is often the quickest way to see recent results while the full request runs.

What to ask for

A request for "my records" can come back as a thin summary. Name what you want. These are the documents that matter most, both for your own care and for research:

• Lab results with values, units and reference ranges, ideally over several years (a series shows how things changed).
• Letters: diagnosis letters, referral letters, specialist letters and discharge summaries.
• Imaging reports for MRI, CT, X-ray and ultrasound (and the images themselves if you need them, which are often provided separately).
• Your medication history: what was prescribed, at which dose, and when it stopped.
• Your vaccination record.
• Pathology reports for any biopsy.

A request you can copy

Send this by email where you can, so you have a dated record and are entitled to an electronic copy. Address it to the practice manager or the records (or privacy) office of the hospital.

Subject: Request for a copy of my health records

Dear [practice or hospital],

I am requesting a copy of the health records you hold about me, under [Article 15 of the GDPR / Article 15 of the UK GDPR / the HIPAA right of access, 45 CFR 164.524].

Name: [full name]. Date of birth: [date]. Patient or NHS number, if known: [number].

Please include: lab and test results, letters (including referral, specialist and discharge letters), imaging reports, my medication history, my vaccination record and any pathology reports, from [year] to the present.

Please send them electronically, as PDF files, to this email address. I understand you are required to respond within [one month / 30 days].

Thank you, [name]

If the deadline passes without an answer, write once more and mention the deadline. In the EU and the UK, the national data protection authority handles complaints; in the US, it is the Office for Civil Rights at the Department of Health and Human Services.

Once you have them

Records that arrive as a dozen PDFs from five places are still scattered. The useful step is to put them in one place, in a form you can read and search.

That is part of what CureCircle is for. You can upload each document, a PDF or a photo, and the AI reads it into your own medical file: every lab value with its unit and range, every diagnosis, medication and vaccination, and even the entries of a diary you or your family kept through an illness. The document itself is not kept, only what it says. You can add your own account of what happened, and if you choose, share the de-identified result with research and earn a share each time it is licensed.

Your records describe what happened to you. Getting a copy is your right, and once you have them, what happens next is your choice.