A Subject Access Request (SAR) is your legal right under UK GDPR to receive copies of all personal data held about your relative. Getting these records is often the first step in building a strong CHC case — and without them, you're walking into an MDT meeting without your strongest evidence.

TL;DR: NHS organisations must respond to Subject Access Requests within one calendar month under UK GDPR Article 15. Send SARs to your GP, hospital, and care home at least 8–10 weeks before the MDT meeting. If your relative lacks mental capacity, you'll need to establish proxy access first — either via Lasting Power of Attorney or by demonstrating you're acting in their best interests. Escalate to the ICO if there's no response within 45 days.

Step 1: Which medical records do you need for a CHC case?

For a CHC assessment, you typically need records from three sources:

GP records — medication history, consultation notes, referral letters
Hospital records — discharge summaries, consultant letters, inpatient notes
Care home records — daily care notes, incident logs, medication administration records

Start with GP and hospital records. Care home records become important if the current care provider is claiming needs are "managed" or lower than they appear.

For a full breakdown of the 12 CHC domains and the type of evidence that matters in each, see our DST Evidence Builder guide.

Step 2: Who can make a SAR? Proxy access when someone lacks capacity

This is the question most families forget to ask — and it causes significant delays.

If your relative has mental capacity, they must make or formally authorise the SAR themselves, or you must act on their explicit written instruction. But most families navigating CHC are doing so because their relative has dementia or another condition that has reduced or removed their capacity.

If you hold a Lasting Power of Attorney (LPA) for Health and Welfare, you can make a SAR on their behalf. The LPA must be registered with the Office of the Public Guardian — an unregistered LPA carries no legal weight. Note that a Property and Financial Affairs LPA doesn't grant access to health records; you specifically need the Health and Welfare LPA.

If no LPA is in place, you can still request records, but the organisation must decide whether disclosure is in your relative's best interests under the Mental Capacity Act 2005. In practice, most NHS organisations will share records with a close family member acting in good faith. State clearly in your SAR letter that you believe your relative lacks capacity, that no LPA is in place, and that you're making the request in their best interests.

If the organisation refuses and you believe disclosure is appropriate, escalate to the ICO. The ICO can require organisations to reconsider refusals that don't meet the legal threshold for withholding records.

Step 3: How do you write a Subject Access Request letter?

Use the templates linked in the sidebar — they include the correct legal references (UK GDPR Article 15) and the specific wording that obliges organisations to respond within one calendar month.

Personalise each letter with:

Your relative's full name and date of birth
Your own name, relationship, and authority (registered LPA reference number, or a best-interests statement if no LPA exists)
The approximate date range of records you want (e.g. "all records from January 2022 to present")

If you're acting as a proxy, include a copy of the registered LPA or a brief written explanation of the capacity situation and your relationship to the person.

Step 4: Send the requests

Send each letter by recorded post (keep proof of posting) or by email if the organisation accepts electronic SARs. Most NHS trusts publish a Data Protection Officer (DPO) contact address on their website.

Timing tip: Send SARs at least 8–10 weeks before a planned MDT meeting. Organisations have 30 days to respond, and you may need to chase. If your relative is deteriorating rapidly, note this in your letter and ask for an expedited response.

Step 5: What do you do if the organisation does not respond?

If you receive no response within 30 days:

Send a follow-up letter referencing your original request date and proof of postage or email receipt
Escalate to the Information Commissioner's Office (ICO) if still no response after 45 days

The ICO complaint process is free and can be filed online. The ICO will contact the organisation on your behalf, and this almost always prompts a swift response.

Step 6: What if records arrive incomplete or heavily redacted?

Records frequently arrive with pages missing, illegible handwriting, or sections blacked out. Don't accept this without questioning it.

Ask the DPO in writing to confirm whether any redactions are made under a specific legal exemption and, if so, which one. Most exemptions don't apply to health records requested by a patient or their authorised proxy. If you believe records from specific dates or care episodes are absent, ask for a fresh search.

If a key document — such as a hospital discharge summary or a consultant's letter you know exists — is missing entirely, contact the relevant ward or clinic directly and request a copy. Records sometimes exist but weren't captured in the initial SAR search.

Step 7: How should you review and organise the records?

Once received, read through the records systematically. Look for:

Evidence of high, severe, or priority needs across the 12 CHC domains
Incidents, falls, infections, and crisis events
Descriptions of care that goes beyond what social care can provide
Any assessments or professional opinions already on file

Highlight passages and organise by domain — behaviour, cognition, mobility, and so on (see the full 12 domains). A simple table with one column per domain, and relevant quotes and dates pasted in, works well. This becomes the evidence base for your Family Statement of Needs and your submissions at the CHC assessment meeting.

Sources: ICO — Right of Access under UK GDPR | NHS National Framework for CHC (2022) | Mental Capacity Act 2005