I know how disorienting it feels when an operation goes wrong. You want answers — not just apologies — and the first step is getting your full medical records. I’ve navigated these requests myself and helped sources do the same. Below I share exact forms, realistic timelines, and ready-to-use escalation scripts that work in the UK context. Copy them, adapt them, and keep firm records of every interaction.
What exactly you should ask for
When a procedure is botched, the bare minimum of records won’t cut it. I always request everything relevant, not just the final discharge notes. Here’s the checklist I use and recommend you request in writing:
Which legal route to use: Subject Access Request vs. medical records request
I usually make two requests simultaneously: a formal Subject Access Request under the Data Protection Act/GDPR for “all personal data” and an NHS medical records request (if your care was NHS). The Subject Access Request (SAR) can compel disclosure of communications and internal notes; the NHS route is often quicker for standard clinical records.
For NHS care: use the NHS organisation’s dedicated medical records request process — many trusts have an online form or a specific address. Guidance: nhs.uk and the trust’s website. For SARs: use the standard wording below and send it by recorded delivery or secure email.
Exact wording — Subject Access Request (copy/paste)
Send this as an email and follow with a signed letter if possible. Replace bracketed items.
Subject Access Request under the UK GDPR/Data Protection Act 2018
To: [Data Protection Officer / Medical Records Department]
From: [Your Full Name]
Date of birth: [DD/MM/YYYY]
NHS number (if known): [NHS number]
Hospital number (if known): [Hospital number]
Correspondence address: [Your address]
Contact email/phone: [Your details]
Under the UK GDPR and the Data Protection Act 2018 I request a copy of all personal data you hold about me. This should include, but not be limited to, all clinical notes, operation notes, anaesthetic records, monitoring charts, medication charts, pre- and post-operative imaging and reports, consent forms, incident reports/Datix records, internal correspondence (including emails and messages), and any recordings or photographs related to my care from [date of admission] to [date of discharge].
Please provide this information in electronic format where possible, or advise how I may collect paper copies. If you refuse any part of this request, please state the legal basis for refusal and provide a description of the withheld material.
I am attaching photographic ID/utility bill as proof of identity. I expect a response within one calendar month as required by the UK GDPR. If you require clarification, please contact me within seven days.
Signed,
[Your name]
NHS-specific request wording
If dealing with an NHS Trust, use the Trust’s medical records form or send this email. Many trusts accept the national Subject Access Request forms linked from NHS.UK. Tailor the list above to include “operation notes and Datix/incident reports.”
Timelines you should expect — and what to do if they miss them
| Action | Legal/typical timeline | What I do if missed |
| Subject Access Request (SAR) | Up to 1 calendar month (can extend 2 months if complex) | Send reminder after 1 month. If no satisfactory response after 2 months, escalate to ICO. |
| NHS medical records request | Varies by trust — typically 1–6 weeks for standard notes; can be longer for imaging | Contact the records office, ask for expected completion date in writing. Escalate to complaints team after 6 weeks. |
| Request for copies of imaging | Usually available on CD or electronically in 2–6 weeks | Ask radiology directly; if delayed, log communication and inform complaints/ICO. |
Escalation scripts that work — complaints, ICO, and Ombudsman
Keep a clear log: dates, names, times, reference numbers. I always tell them I’m prepared to escalate and that tends to speed things up.
Complaint to Trust / Hospital (email or letter):
Subject: Formal complaint re delay/refusal to provide medical records — [Your name]
I am writing to make a formal complaint about the delay/refusal to provide my full medical records relating to my admission on [dates]. I submitted a Subject Access Request on [date] and have not received the requested information. Please provide a substantive response within 14 days and provide a named contact for my complaint. If this is not resolved I will escalate to the ICO and the Parliamentary and Health Service Ombudsman.
Escalation to the ICO (when SAR refused or unreasonably delayed):
Use the ICO online form, but this script is useful for the cover email/notes: I submitted a SAR to [organisation] on [date]. They have not provided the records and have not given a lawful reason. I have attached evidence of my request, identity, and reminders. I request ICO advice and, if necessary, an enforcement action to compel disclosure under the UK GDPR.
Complaint to Parliamentary and Health Service Ombudsman (PHSO) — NHS only:
After exhausting the NHS Trust’s internal complaint process (usually 6–12 weeks), use PHSO if you’re unhappy with the outcome. Say: I have followed the Trust complaints process and remain dissatisfied. I seek an independent review of how my records request and the investigation into my care were handled.
Practical tips that actually save time
When to call a solicitor
If records are withheld with no lawful justification, or if you’re preparing a claim, involve a solicitor experienced in clinical negligence. They can issue a formal pre-action disclosure request or a court order to obtain records more forcefully. For many people, that step comes after ICO or PHSO routes fail.
I’ve seen delays cause real harm — missed follow-ups, repeated procedures, and emotional distress. Insist on transparency, document every step, and use the scripts above. You deserve the full story of what happened to you; the records are the first and most essential step to getting it.
