A patient asks for a copy of their records. Do you know what to do?
Data protection is part of every practice manager's job. Here is a practical checklist for getting it right.
Is this you? Tap any that are true.
Most people reading this tick at least one.
It only takes one to cost you.
- steps
- 8
- steps
- to start
- 30 minutes
- to start
- scorecard
- Free
- scorecard
The short answer
Confirm the practice pays the ICO data protection fee, log every subject access request on the day it arrives and answer within one month, and send anything clinical by secure email or portal. Have a simple breach process, because serious breaches must be reported to the ICO within 72 hours. Follow the Records Management Code for how long to keep records.
What good looks like
Where you stand, before and after
Data protection
- ICO registered · requests logged and answered on time
- Secure sending · breach process in place
Illustrative sample, not a real person or result.
8 steps
Do it yourself: step by step
0 of 8 done
Search the ICO register of fee payers for the consultant or practice. Confirm the right legal entity is registered (sole trader or limited company), details are current and renewal date is diarised. Most small practices fall into tier 1 or tier 2
- Time
- 30 minutes
- Typical cost
- £52 (tier 1) or £78 (tier 2) a year
- Who does it
- Practice manager
Why it matters
Most organisations that handle personal data must pay it.
Done when: You have the registration number and renewal date on file
This problem is Solvable.
Copy this checklist
Patient data checklist and subject access reply
Free to copy, adapt and use. No sign-up.
Patient data checklist
- ICO fee paid. Registration number: [number]. Renewal: [date]
- Correct legal entity registered (sole trader / limited company)
- Named data protection lead: [name]. DPO decision recorded
- Privacy notice on website, reviewed [date]
- Subject access request log in use
- Secure email or portal for clinical information
- Breach process and breach log in place
- Data protection complaints route in the privacy notice; complaints acknowledged within 30 days
- Retention schedule based on the Records Management Code of Practice
- Data processing agreements with every supplier holding patient data (practice system, transcription, billing, IT)
- Annual staff training recorded
Subject access request log
| Date received | Patient | ID checked | Due date (one month) | Extended? (reason, date patient told) | Date sent | Method | Notes |
|---|
Acknowledgement
Dear [patient name],
Thank you for your request of [date] for a copy of your records. We will send these to you by [due date]. There is no charge.
[If needed:] To protect your information, please send a copy of [photo ID] or confirm [identifying details].
We will send the records by [secure email / portal / recorded post]. Please let us know if you would prefer another method.
Kind regards, [Name], on behalf of [consultant name]
Breach process (one page)
- Contain: recall the email, retrieve the paper, change the password.
- Record: what happened, when, whose data, how many people, in the breach log.
- Assess: could it harm the patient? Consider the type of data and who received it.
- Report: if there is a risk to people, report to the ICO within 72 hours of becoming aware. If high risk, tell the patients affected.
- Learn: what will stop it happening again? Record the change.
Avoid these
Common mistakes
- Paying the ICO fee under the wrong name after a consultant incorporates.
- Starting the subject access clock when someone gets round to it, not the day the request arrived.
- Sending clinic letters to patients by ordinary email.
- Keeping every record for ever because nobody set a retention schedule.
- No data processing agreement with the transcription or IT supplier.
Free personal check
Done by Paul Robinson, not software
I'll check your data protection basics and show what needs attention first
What I need from you
- Your practice name, so I can check the ICO register
- Answers to eight tap questions
What you get
- Gaps against the ICO basics
- The three changes that matter most
- Which ones you can do yourself today
Within 2 working days
No sign-in, no sales call. I read every request myself and reply on WhatsApp.
Free tools
Check where you stand
Benchmarks
£52 / £78 / £3,763
ICO data protection fee for tier 1, tier 2 and tier 3, applying to payments on or after 17 February 2025
Source: ICO
One month
Time to respond to a subject access request, extendable by up to two months for complex requests
Source: ICO
72 hours
Time to report a notifiable personal data breach to the ICO after becoming aware of it
Source: ICO
30 days
Since 19 June 2026, controllers must make it easy for people to complain about how their data is handled, and acknowledge each complaint within 30 days
Paul Robinson
14 years in UK private healthcare
I'll introduce you to someone who solves this for practice managers
Want a hand? I'll look at your situation and tell you the three things I'd tackle first.
A few quick questions, about two minutes. I read every one myself and usually reply the same day.
No sales call unless you ask for one. Just a straight answer from me.
I reply personally, usually the same day.
Questions
Frequently asked questions
How long do we have to answer a records request?
One month from the day you receive it. You can extend by up to two months for complex or multiple requests, but you must tell the patient within the first month. If you ask them to clarify the request, the clock pauses until they reply.
Can we charge for copies?
Usually not. You can charge a reasonable fee only if a request is manifestly unfounded or excessive, or for further copies.
Can we hold anything back?
Only in limited cases, such as information about other people, or anything a health professional judges likely to cause serious physical or mental harm to the patient or someone else. Ask the consultant to review the records before they go out.
Do we need a Data Protection Officer?
It depends on the scale of health data processing. Many small consultant practices decide they do not, but record the reasoning. This is general information, not legal advice. Speak to a data protection specialist about your situation.
Which tier of ICO fee do we pay?
Most small practices pay tier 1 or 2, based on turnover and staff numbers. The ICO's self-assessment tells you which.
Is ordinary email ever acceptable?
Yes for non-clinical messages, such as appointment times. Use encryption or a portal for anything clinical. If a patient asks for ordinary email after you have explained the risk, record their choice.
How long do we keep records?
Many private practices use the NHS Records Management Code of Practice as a guide: most adult health records are kept eight years after last treatment, and children's and some specialty records are kept longer.
Last reviewed:
The Solvable community
You're not the only one with this problem.
One problem solved every week, on WhatsApp.
One message a week. No sales messages. Reply STOP any time.