You may need your medical records to understand what happened during your care. You may also need them to obtain a second opinion, make a complaint or investigate a possible medical negligence claim.
Many patients do not realise that they have a legal right to access their records. Others know they can ask but are unsure where to send the request or how long the healthcare provider has to respond.
The practical solution is an Article 15 Subject Access Request.
The short answer
To get your medical records in Ireland, send a written Subject Access Request, usually called a SAR, to the hospital, GP practice, clinic or other healthcare provider holding them.
State that you are making the request under Article 15 of the General Data Protection Regulation, or GDPR.
The provider must normally respond without undue delay and within one calendar month of receiving your request. This is often described as the 30-day rule, although the legal deadline is one calendar month rather than a fixed 30 days.
Your first copy should normally be free.
What is an Article 15 Subject Access Request?
Article 15 of the GDPR gives you the right to ask an organisation whether it is using personal data about you and, if so, to obtain a copy.
Your medical information is personal data. This can include:
- Hospital and GP notes
- Handwritten and electronic clinical records
- Referral letters
- Test and laboratory results
- Radiology reports and images
- Medication records
- Nursing and observation charts
- Consent forms
- Operation notes
- Discharge summaries
- Correspondence about your care
- Records of telephone calls
- Relevant emails and internal communications
- Personal data contained in incident reports or reviews
You may also ask for information about why your data is being used, who has received it, where it came from and how long it will be retained.
The Data Protection Commission’s guidance on Article 15 confirms that there is no required format for a valid request. You can make one verbally. However, a written request is safer because it gives you clear evidence of what you asked for and when you asked.
Who can make a request?
You can make a Subject Access Request for your own personal data.
An authorised representative, including a solicitor, may also make a request for you. The healthcare provider will usually ask for written authority confirming that the representative may receive your records.
Parents and guardians can sometimes request records on behalf of a child. However, the provider must also consider the child’s age, understanding, wishes and data protection rights. Parental access is not automatic in every case.
A GDPR request generally concerns the personal data of a living person. Different rules can apply when a family member wants access to the records of someone who has died. In that situation, legal advice may be needed about access under the Freedom of Information Act, estate law or another legal process.
Why medical records matter in a negligence claim
Medical records help establish the timeline of your treatment. They may show:
- What symptoms you reported
- What examinations were performed
- What diagnosis was considered
- What tests were ordered
- Whether results were reviewed
- What treatment options were discussed
- Whether you gave informed consent
- When your condition changed
- Whether concerns were escalated
- What follow-up care was arranged
The records do not decide whether negligence occurred. That usually requires an independent medical expert to assess whether the care fell below an acceptable standard and caused an injury.
However, the records are often the starting point for that assessment.
You do not have to tell the provider that you are considering a claim. You do not have to give any reason for making a Subject Access Request. The Court of Justice of the European Union has confirmed that a patient may use Article 15 to obtain a first copy of medical records free of charge, even where the purpose is to investigate possible liability arising from treatment. See Case C-307/22, FT v DW.
How the one-month deadline works
The provider must respond without undue delay and, at the latest, within one calendar month of receiving your request.
This is commonly called a 30-day deadline. The precise calculation is important.
If the provider receives your request on 12 March, the deadline will normally be 12 April. If it receives the request on 31 August, the deadline will normally be 30 September because September has no 31st day.
The period includes Saturdays, Sundays and public holidays. If the final day falls on a weekend or public holiday, the deadline will generally move to the following working day. The DPC explains the calculation in its Subject Access Requests guide.
The clock normally starts when the request reaches an established communication channel used by the provider. That might be its data protection email address, postal address or reception.
A request for clarification does not automatically restart the clock. If the provider reasonably needs more information to verify your identity and asks for it promptly, the deadline may be paused until you supply that information.
Can the provider extend the deadline?
The provider may extend the response period by up to two further months where this is necessary because the request is complex or numerous.
It cannot simply take an extra two months as a matter of routine.
The provider must tell you about the extension within the original one-month period. It must also explain why the extension is needed. A late extension notice does not correct an already missed deadline.
How to request your medical records
1. Identify every organisation holding records
Your GP, hospital, consultant, physiotherapist and private clinic may each be a separate data controller. One request will not necessarily collect records from all of them.
Make a list of every provider involved in your treatment. Send a separate request where necessary.
For HSE records, send the request to the local hospital, unit or service where the records are held. The HSE provides a Subject Access Request form, but you can also make the request by letter or email.
For a private hospital, GP or clinic, check its privacy notice for the data protection contact. If no contact is listed, send the request to the practice manager, medical records department or Data Protection Officer.
2. Put the request in writing
Use the words “Subject Access Request under Article 15 GDPR” in the subject line.
Include:
- Your full name
- Your date of birth
- Your current address
- Any previous name or address used during treatment
- Your hospital or patient number, if known
- The dates and locations of treatment
- The relevant department or consultant
- A clear description of the records requested
- The format in which you want to receive them
- Your email address and telephone number
You do not have to use legal language.
3. Ask for the complete record
Avoid asking only for “a copy of my chart” if you need a full account of your care. Records may be spread across different departments and electronic systems.
You can use this wording:
Subject: Article 15 GDPR Subject Access Request
Dear Data Protection Officer,
I wish to make a Subject Access Request under Article 15 of the General Data Protection Regulation.
Please provide a copy of all personal data relating to my treatment and care held by your organisation.
This request includes, where held, my complete clinical file, handwritten and electronic notes, nursing records, observation charts, medication records, consent forms, test results, imaging reports and images, referrals, correspondence, telephone records, emails, operation notes, discharge records and personal data contained in any incident report, review or investigation concerning my care.
My details are:
Full name:
Date of birth:
Current address:
Previous name or address:
Hospital or chart number:
Dates and location of treatment:Please provide the records electronically in a commonly used and accessible format. Please supply radiology images in their available electronic format.
Please confirm receipt of this request and the date on which the one-month response period began.
Kind regards,
[Name]
You can narrow the dates or departments if you want specific records. If you are investigating a possible negligence claim, however, records from before and after the main event may also be relevant.
4. Deal with identity checks promptly
A provider may ask for information to confirm that it is releasing sensitive medical data to the correct person.
The HSE form asks patients to attach photo identification. A provider should only ask for information that is reasonably necessary. It should not demand excessive identification where it already has a reliable way to confirm who you are.
If you send identification, use a secure method. Ask whether unnecessary details, such as your document number, may be covered.
5. Keep proof of the request
Save:
- Your email or letter
- Any delivery receipt
- The provider’s acknowledgement
- Any request for identification
- Any extension notice
- Your follow-up correspondence
- The final response
Calculate the one-month deadline and add it to your calendar.
Can a provider charge for medical records?
Your first copy should normally be free.
A provider may charge a reasonable administrative fee if you ask for additional copies. It may also charge or refuse to act where a request is “manifestly unfounded or excessive”. This is a high legal threshold. The provider must be able to prove that it applies.
A request is not excessive merely because your file is long or because retrieving the records will take staff time.
A GP or hospital should not impose a routine administration, photocopying or processing fee for your first Article 15 copy. The DPC’s 2025 case studies include a complaint about a GP seeking an administrative fee for medical records.
Can information be redacted?
Some information may lawfully be removed. However, redaction should be limited and justified.
The most common reason is that a record also contains personal information about another person. Article 15(4) allows a provider to protect the rights and freedoms of others.
That does not always justify withholding the whole document. The provider should consider whether it can redact the third-party information and release the remainder.
The names of doctors, nurses or other professionals involved in your care should not automatically be removed simply because they are other people. Current HSE guidance recognises that the names of professionals who treated a patient can normally be provided.
Information may also be withheld where it is protected by legal professional privilege or where a specific restriction under the Data Protection Act 2018 applies.
The serious harm restriction
Irish law permits a healthcare provider to restrict access to health data where it has reasonable grounds to believe that disclosure would be likely to cause serious harm to your physical or mental health.
This is a narrow exception under the Data Protection Act 2018 (Access Modification) (Health) Regulations 2022.
The restriction must be necessary and proportionate. It should only apply for as long as necessary and only to the information that creates the relevant risk. It is not a general power to refuse access because the information may be upsetting, embarrassing or critical of the care provided.
If information is withheld, ask the provider to identify:
- The legal basis relied upon
- Whether entire documents or only parts were withheld
- Why partial access could not be provided
- How you can challenge the decision
What if the records are incomplete?
Check the records against the index, cover letter and your own recollection.
Look for obvious gaps, such as:
- Missing dates
- Missing nursing notes
- Test results without reports
- Reports without the underlying images
- References to letters that were not supplied
- Page numbering gaps
- Notes mentioning an incident review that was not addressed
- Missing records from a particular department
Write back promptly. List each category that appears to be missing and ask the provider to search all relevant paper and electronic systems.
Do not simply say that the response is incomplete. Be specific.
What if the provider misses the deadline?
Send a written reminder. Attach your original request and proof of delivery.
State that the one-month period has expired and ask for the records or a full explanation within a short, reasonable period.
You may also make a complaint to the Data Protection Commission. The DPC advises complainants to provide:
- The original request
- Any reminders or later correspondence
- The provider’s cover letter or response
- A clear list of the information still missing
You can find further guidance on the DPC’s page about difficulties with a Subject Access Request.
If the delay is affecting a potential legal claim, speak to a solicitor instead of waiting indefinitely for the complaint process.
Do not let a records request delay legal advice
Obtaining records takes time. Reviewing them and arranging an independent medical opinion can take considerably longer.
In most Irish medical negligence claims, legal proceedings must be brought within two years of the date of knowledge of the injury, subject to important exceptions. A Subject Access Request does not stop or extend that limitation period. The two-year rule is set out in section 3 of the Statute of Limitations (Amendment) Act 1991, as amended.
You should seek legal advice promptly if:
- You have suffered a serious or lasting injury
- You believe a diagnosis or treatment was delayed
- You were not warned about a significant risk
- Your condition worsened after possible errors in care
- The provider has refused or repeatedly delayed access
- Important records appear to be missing or altered
- You are unsure when the legal time limit began
HOMS Assist’s medical negligence team can help identify the relevant providers, obtain the necessary records and arrange an expert review of the care you received.
Getting your records gives you information. Timely legal advice helps you understand what that information means and what options remain open to you.
About the author: Marie Moloney is a dedicated solicitor at HOMS Assist, specialising in medical negligence claims. Marie combines her legal expertise with a compassionate approach to support clients navigating complex medical negligence claims in Ireland.
