Getting Your Medical Records in Scotland — Your Rights Explained
When you make a personal injury or medical negligence claim in Scotland, one document sits at the foundation of everything that follows. Before your solicitor can properly assess your injuries, before an independent medical expert can produce a report, before the value of your claim can be calculated, and before any meaningful negotiation with an insurer can begin, your medical records must be obtained. They are the primary evidence of what happened to your body, what treatment you received, what your prognosis is, and in clinical negligence cases, whether the treatment you received fell below the standard required by law.
Yet despite the central importance of medical records to the claims process, many people in Scotland are unaware that they have a clear and enforceable legal right to access their own records. They do not know how to exercise that right, what it covers, what the process involves, or what happens when things go wrong. This essay sets out everything you need to know about your right to access medical records in Scotland — the legal framework, the practical process, the timescales, the costs, and the specific significance of medical records in the context of a compensation claim.
The Legal Framework
The right to access your own medical records in Scotland is rooted in two overlapping legal frameworks that operate alongside each other.
The primary framework is the United Kingdom General Data Protection Regulation — commonly known as UK GDPR — and the Data Protection Act 2018. Under these provisions, your medical records are personal data and you are the data subject. As a data subject you have a right of access to your personal data, including your medical records, by making what is known as a subject access request to the data controller — which in the context of medical records means the NHS health board, GP practice, hospital trust, or private medical provider that holds those records.
The right of access under UK GDPR is broad. It covers not just the raw clinical records but also any information derived from those records, correspondence between clinicians about your care, referral letters, discharge summaries, operative notes, pathology results, imaging reports, and any other information held about you in connection with your medical treatment. The right applies regardless of when the records were created — you can request records going back decades if they still exist and are held by the relevant organisation.
The second framework is the Access to Health Records Act 1990, which applies specifically to records created after November 1991 and which provides additional rights in relation to deceased patients — relevant in the context of fatal accident claims under the Damages (Scotland) Act 2011 where the executor or relatives may need to access the deceased's records as part of pursuing a claim.
Together these two frameworks give patients in Scotland a comprehensive and enforceable right to access their medical records. The right is not dependent on having a legal claim, a solicitor, or any particular reason for wanting the records. You are entitled to your own medical information simply because it is information about you.
What Records Can You Access?
The scope of the right of access is wide. In the context of a personal injury or clinical negligence claim, the records you will typically need to obtain include your GP records, which provide a longitudinal history of your health before and after the accident or treatment in question. Hospital records relating to any admission, operation, outpatient appointment, or emergency attendance connected to your injuries. Imaging records including X-rays, MRI scans, CT scans, and ultrasounds — both the images themselves and the radiologist's reports. Physiotherapy records, occupational therapy records, and records from any other allied health professional involved in your treatment. Prescription records showing the medication prescribed and any changes to your medication following your injury.
In a clinical negligence case, the records extend beyond your own treatment history to include the clinical notes made by the treating clinician at the time of the treatment in question, nursing notes, theatre records, anaesthetic records, and any internal communications or incident reports generated in connection with your care. These records are not separate from your right of access — they are part of your medical records and you are entitled to them under the same subject access request framework.
For historical cases involving industrial disease or gradually developing conditions, records may need to be sought from multiple providers covering a long period of time. Employment health records, occupational health assessments, and records held by former employers' occupational health services may also be relevant, and the same subject access request framework applies to those records where they constitute personal data about you.
How to Make a Subject Access Request
Making a subject access request for your medical records is straightforward in principle. You write to the data controller — the NHS health board, GP practice, or other provider — identifying yourself, specifying the records you want, and requesting them under the UK GDPR right of access. Most NHS health boards and GP practices now have a standard subject access request form available on their website or at their reception, which simplifies the process.
You will typically need to provide proof of identity — a copy of your passport or driving licence and proof of address — to enable the organisation to confirm that the records belong to you before releasing them. This is a standard data protection precaution rather than an obstacle to access.
In Scotland, NHS health boards handle subject access requests through their patient records or information governance departments. The contact details for making a request will be available on the health board's website. For GP records, the request is made to the GP practice directly. For hospital records held by a specific hospital, the request may be directed to the hospital's medical records department or to the health board's central information governance team depending on the organisation's structure.
Your solicitor will typically make the subject access request on your behalf as part of preparing your claim. They will have standard letters and processes for doing so and will manage the follow-up if records are delayed or incomplete. However, there is nothing to prevent you from making a request yourself if you want to start gathering your records before instructing a solicitor, and doing so can sometimes accelerate the early stages of the claims process.
Timescales and Costs
Under UK GDPR, the data controller must respond to a subject access request without undue delay and in any event within one calendar month of receiving the request. Where the request is complex or involves a large volume of records, the organisation can extend the response period by a further two months — but they must notify you of the extension within the first month and explain why it is needed.
In practice, NHS health boards in Scotland frequently struggle to meet the one month deadline. The volume of subject access requests received by large health boards is substantial, and the resources available to process them do not always match the demand. Delays of two, three, or even four months are not uncommon, particularly for large or complex requests involving multiple departments or long periods of treatment.
Your solicitor will chase overdue requests proactively, and where an organisation is significantly overdue in responding, a complaint can be made to the Information Commissioner's Office — the UK's data protection regulator — which has enforcement powers including the ability to order compliance. In practice, a formal complaint or the threat of one often produces a prompt response from organisations that have been slow.
The cost of a subject access request under UK GDPR is in most cases nil. The right of access is free of charge. Organisations can charge a reasonable fee only where a request is manifestly unfounded or excessive — for example where the same records have been requested multiple times in a short period — but for a standard first request for your medical records, no charge should be levied.
Medical Records in Personal Injury Claims
In a personal injury claim, the medical records serve several distinct functions that collectively determine the strength and value of your case.
First, they establish the baseline — your state of health before the accident. A GP record showing no prior history of back problems is powerful evidence in a claim for a back injury caused by a workplace accident. Conversely, a pre-existing condition disclosed in the records will be taken into account by the insurer and may affect the value of the claim, though it does not necessarily defeat it. The principle in Scots law is that you take the pursuer as you find them — if an accident aggravates a pre-existing condition, you are entitled to compensation for that aggravation even if the underlying condition already existed.
Second, they document the injuries and treatment. The contemporaneous clinical notes made by doctors and nurses at the time of treatment are the most reliable evidence of the nature and extent of your injuries. They record what you reported, what was observed on examination, what investigations were carried out, what diagnoses were made, and what treatment was given. This contemporaneous record is far more persuasive than a claimant's recollection alone.
Third, they inform the independent medical expert's report. The expert instructed by your solicitor to assess your injuries will review your medical records as part of their examination. The quality and completeness of those records directly affects the quality of the expert's report and therefore the strength of the medical evidence in your claim.
Medical Records in Clinical Negligence Claims
In a clinical negligence claim, the medical records are not just supporting evidence — they are the primary battleground on which the case is fought. The clinical notes, operative records, and correspondence between treating clinicians are the documentary evidence against which the expert witnesses on both sides will form their opinions about whether the treatment fell below the standard required by Hunter v Hanley.
Obtaining complete and unredacted records is therefore particularly critical in clinical negligence cases. Records should be checked carefully for completeness — gaps in the records, missing entries, or inconsistencies between different sets of records can themselves be significant and may need to be addressed in the expert evidence. Your solicitor will review the records with care and will identify any concerns about completeness before instructing the independent expert.
Access to Records of Deceased Patients
Where a fatal accident claim is being pursued under the Damages (Scotland) Act 2011, the executor of the deceased's estate has specific rights of access to the deceased's medical records under the Access to Health Records Act 1990. These rights allow the executor to obtain the records needed to pursue the estate's claim for pre-death losses and to support the relatives' claims for loss of support and loss of society.
The process for accessing a deceased patient's records is similar to a standard subject access request but requires evidence of the requester's status as executor — typically a copy of the confirmation document issued by the sheriff court — and proof of the relationship between the requester and the deceased.
The Bottom Line
Your medical records are yours. The law in Scotland gives you a clear and enforceable right to access them, free of charge, within a defined timescale. In the context of a personal injury or clinical negligence claim, those records are the foundation on which your entire case is built — the evidence of your injuries, the documentation of your treatment, and the raw material from which your independent medical expert will form the opinions that determine the value of your claim.
Understanding your right to access those records, and ensuring that your solicitor obtains them promptly and completely at the outset of your claim, is one of the most important practical steps in the entire claims process. Everything that follows depends on it.