Your rights to your health data

Health data is personal data. Under the GDPR, this covers information about your physical or mental health, including details of treatment you have received (Article 4(15)). Article 15 gives you a general right of access to your medical records in any EU country, whether the healthcare provider is public or private.

What you can ask for under Article 15

• confirmation that a practice or hospital processes data about you;
• a copy of that data;
• why the data is being processed and what categories it falls into;
• who has received your data, particularly recipients outside the EU;
• how long the data will be kept, or the criteria used to decide this;
• where the data came from, if you did not provide it yourself;
• details of your rights to correction, erasure, restriction and objection, and how to complain to a data protection authority.

Deadlines and costs

• One month. The organisation must respond without undue delay, and no later than one month after your request is received. For complex cases the deadline can be extended by two more months, but you must be told why within the first month (Article 12(3)).
• The first copy is free. You may only be charged a reasonable fee for further copies (Article 15(3)). The Court of Justice of the EU confirmed on 26 October 2023 (case C-307/22) that this applies to medical records, regardless of why you are asking. It also clarified that a “copy” can mean full copies of documents from the record where those are needed to understand the data.
• Identity checks are allowed if there is reasonable doubt about who is making the request (Article 12(6)).
• If nobody answers within a month, the practice must at least explain why, and you can complain to the data protection authority (Article 12(4)).

In the United Kingdom

After Brexit, the UK follows its own version of the GDPR. According to the Information Commissioner’s Office, the rules for a subject access request are very similar: the organisation has one month to respond, this can be extended by up to two months for complex requests, and there is usually no fee.

More on this topic

The pages below cover the practical side: a letter generator, the European Health Data Space, which brings new rights from 2029, and a comparison of national patient portals.