Getting the paperwork
How to get complete copies of your medical records, scans and pathology slides
A specialist can review only what you can put in front of them. Start with the rule for your country, then the difference between a scan report, the scan itself and the pathology slides.
Yes: you can ask each provider that holds your medical records for a copy, and the rules we read in the UK, Ireland, the US, Australia and Dubai give it about a month to answer. Take the UK as an example. One month at the latest, extendable by up to two more months if the request is complex or you have made several, is how long the Information Commissioner’s Office gives a UK organisation to answer a subject access request.
Information Commissioner’s Office, "A guide to subject access", updated 16 July 2026 Checked 2026-09-25.
Regulator guidance written for organisations, updated on 16 July 2026 to reflect the Data (Use and Access) Act 2025.
Fees are limited too: nothing in most cases in the UK and Ireland, cost-based in the US, and not excessive in Australia. Canada and the UAE are in the table.
Ask for the scan images and the pathology slides by name. The record services we read describe scan reports, not the scan images.
Medically reviewed
Reviewed by Dr Gunjan Patel, MBBS, registered with the Gujarat Medical Council (G-65059). Last reviewed 25 September 2026. Reviewed for accuracy only. This page is general information, not advice about your own case, and Dr Gunjan Patel does not diagnose, prescribe or treat.
The rule in each country
Six countries side by side.
National rules where we read them; provinces, states and emirates can add their own, so check yours too.
| Country and who to ask | Time and fee | If it goes wrong, complain to |
|---|---|---|
| United KingdomAsk the organisation that holds the record, such as your GP practice or the hospital’s records manager. | One month, extendable by up to two more months for complex requests or several requests from you. The clock pauses for clarification it reasonably requires. No fee in most cases. | The organisation first, then the Information Commissioner’s Office, within three months of your last meaningful contact. |
| IrelandAsk the doctor, hospital or consultant that treated you, public or private. | One month, extendable by two more for complex requests or several requests from you. No fee in most cases; additional copies, and requests that are manifestly unfounded or excessive, can be charged. | The organisation first, then the Data Protection Commission, through its online form. |
| CanadaAsk the provider that holds the record. | Varies by province or territory. We did not compile the limits. | Your province’s or territory’s commissioner or ombudsperson. The federal privacy commissioner’s directory lists each. |
| AustraliaAsk the provider that holds the health record. | Private providers: federal guide says generally 30 calendar days. No charge for making the request; a charge must not be excessive, and some state laws cap it. Public hospitals: state or territory law applies, and rules differ, so check your own state or territory. | Private providers: the provider first, then the Office of the Australian Information Commissioner, in writing, if it does not answer within 30 days or you are unhappy with its answer. Public hospitals: your state or territory health complaints or privacy body, which the Commissioner’s page on state and territory privacy legislation lists. |
| United StatesAsk the provider that holds the record. If it sends health information electronically for things like insurance claims, HIPAA calls it a covered entity. | 30 days, plus one extension of up to 30. Some states set shorter limits. HHS has listed a planned proposal on the limit; the current federal limit stands. Cost-based fee only. | The provider’s named privacy contact, or HHS directly; HHS complaints generally have a 180 day limit. Blocked electronic records can also be reported through the information blocking portal. |
| United Arab EmiratesTwo emirate policies, Dubai’s and Abu Dhabi’s. This page says nothing about federal law. Ask the healthcare entity that holds the record. | Dubai: one month for entities under the Dubai Health Authority, no fee stated. Abu Dhabi: no number of days or fee stated; the standard requires a timely response. | Dubai: the supervisory authority, for example the Dubai Health Authority. Abu Dhabi: the Department of Health, and the entity itself. |
General information from the sources named in each note, not legal advice; no regulator endorses this page; ask a qualified adviser if a refusal is unclear.
United Kingdom
A request for your own records is called a subject access request.
One month at the latest, extendable by up to two more months if the request is complex or you have made several, is how long the Information Commissioner’s Office gives a UK organisation to answer a subject access request.
Information Commissioner’s Office, "A guide to subject access", updated 16 July 2026 Checked 2026-09-25.
Regulator guidance written for organisations, updated on 16 July 2026 to reflect the Data (Use and Access) Act 2025.
According to the Information Commissioner’s Office, the clock pauses only for a clarification the organisation reasonably requires, and the month runs from receipt of the request and of any ID, proof of a third party’s authority or fee that can lawfully be asked for.
Information Commissioner’s Office, "A guide to subject access", updated 16 July 2026, and "What should we consider when responding to a request?", updated 8 December 2025 Checked 2026-09-25.
The guide also says an organisation cannot force you to narrow your request. It does not mention scan images.
Cost and who to ask come next.
In most cases you cannot be charged for a UK subject access request, health information included, the Information Commissioner’s Office says; a reasonable fee is allowed for further copies or a request that is manifestly unfounded or excessive.
NHS England says to ask the organisation that holds your records, for example your GP practice, optician or dentist, and for hospital records the records manager or patient services manager at the relevant hospital.
NHS England, "Getting copies of medical records", read through an Internet Archive copy captured 13 July 2026 Checked 2026-09-25.
England only, undated, and no time limit or fee is stated.
If the answer is late or unwelcome, the regulator has a route.
Within three months of your last meaningful contact with the organisation is when you should raise a complaint with the Information Commissioner’s Office, which says you should first complain to the organisation.
Information Commissioner’s Office, "What to do if you don’t get a response or you’re unhappy with it" Checked 2026-09-25.
Undated page, marked by the regulator as under review after the Data (Use and Access) Act 2025.
Scotland, Northern Ireland and Wales publish their own patient guidance: NHS inform for Scotland, nidirect for Northern Ireland and NHS 111 Wales. This page states no rule from them.
Ireland
The right comes from data protection law.
One month at the latest, extendable by two more months if the request is complex or the person has made several, is how long the Data Protection Commission says an Irish organisation has to answer an access request, and it says the answer is due without undue delay.
Data Protection Commission (Ireland), "Access and portability" Checked 2026-09-25.
The Data Protection Commission says an Irish organisation cannot require a fee for an access request in most cases, but may charge a reasonable fee for additional copies and for requests that are manifestly unfounded or excessive.
Data Protection Commission (Ireland), "The Right of Access" Checked 2026-09-25.
Undated page. Requests can be verbal or written, and the Commission encourages written ones where practical.
The next two cover who you can ask and where to complain.
Doctors, hospitals and consultants, public or private, can be asked for your personal data, and the Data Protection Commission says a photocopy of an X-ray or scan meets the access right.
Data Protection Commission (Ireland), medical records FAQ; Irish Statute Book, S.I. No. 121/2022 Checked 2026-09-25.
Undated FAQ. S.I. No. 121/2022, as made in March 2022, lets a provider decline health data only where access would be likely to cause serious harm to your health, and requires an offer of access through a practitioner you name. The FAQ does not say whether you can insist on the original digital images; the Commission’s right of access page says electronic requests should get a commonly used electronic format.
Concerns go to the Data Protection Commission through its online form if you have contacted an organisation about a personal data concern and are unhappy with the outcome.
Data Protection Commission (Ireland), "Raising a concern with the Commission" Checked 2026-09-25.
Another Commission page says it will generally require you to have raised the matter directly with the organisation first.
Canada
Canada has no single health-records law that we could find, and the rules sit mainly in provincial and territorial law.
The Office of the Privacy Commissioner of Canada says each province and territory has its own commissioner or ombudsperson overseeing its own privacy legislation, and publishes a directory of each one’s laws and oversight body.
Office of the Privacy Commissioner of Canada, "Provincial and territorial privacy laws and oversight", modified 28 January 2026 Checked 2026-09-25.
The directory does not say whether a national health-records law exists. Use it as a directory only. The Commissioner’s other pages say federal privacy law (PIPEDA) applies to private-sector commercial activity across Canada except where a provincial law is substantially similar, and gives 30 days for an access response; we did not compile which applies to which provider.
Australia
Which rule applies depends on whether the provider is private or a public hospital.
30 calendar days is the general period in which the Office of the Australian Information Commissioner says a private-sector health service provider must respond to a patient’s access request under the federal Privacy Act; some states and territories also have their own health records laws, and public hospitals are covered by state or territory law rather than the federal Act.
Office of the Australian Information Commissioner, Guide to health privacy, chapter 4 (2019), "Access your health information" and "State and territory privacy legislation" Checked 2026-09-25.
A 2019 guide. One example of state law: the Health Complaints Commissioner (Victoria), "Health records: individuals", says private providers there have a maximum of 45 days and that fees are capped by regulation.
Under Australian Privacy Principle 12, a private-sector organisation cannot charge for making an access request and may charge for giving access only if the charge is not excessive, according to the Office of the Australian Information Commissioner.
Office of the Australian Information Commissioner, Australian Privacy Principle 12 guidelines, version 1.1, 22 July 2019 Checked 2026-09-25.
State and territory laws can also cap fees; the note above gives one example.
For private providers, complaints follow a set order.
For a privacy complaint about a private-sector provider, the Office of the Australian Information Commissioner says to complain to the organisation first, and that if it does not respond within 30 days, or you are not happy with its response, you can lodge a complaint with the Office, which must be in writing.
Office of the Australian Information Commissioner, "Lodge a privacy complaint with us", updated 2 March 2026 Checked 2026-09-25.
It adds that you may have to try an approved external dispute resolution scheme first. The categories it lists are energy and water, financial services, public transport, telecommunications and tolling, and health providers are not among them. The Office’s page on state and territory privacy legislation says the Privacy Act does not apply to state and territory public sector health providers such as public hospitals, and lists the state and territory bodies that handle complaints about them.
United States
In the US the right of access comes from HIPAA. HHS below means the federal Department of Health and Human Services.
30 days from receipt, extendable once by no more than 30 days with a written explanation, is the limit the federal HIPAA Privacy Rule sets for a US covered entity to act on your request for access to your own health records.
eCFR, 45 CFR 164.524(a)(1) and (b)(2), current to 23 September 2026 Checked 2026-09-25.
It excludes psychotherapy notes and legal-proceedings material. A 2021 HHS proposal said at least eight states have laws requiring copies in fewer than 30 days.
As at 23 September 2026 the eCFR still says 30 days for HIPAA record requests, while HHS has listed a proposed rule on right-of-access response times for November 2026, and a related final rule is under review at the Office of Management and Budget with its text not public.
eCFR title 45, current to 23 September 2026; Reginfo.gov entries for RIN 0945-AA28 and RIN 0945-AA00, and the list of rules under review published on 25 September 2026 Checked 2026-09-25.
Agenda dates are projections. We could not read the rule under review, so we cannot say whether it changes the 30 days.
Two more rules cover cost and complaints.
A US covered entity may charge you only a reasonable, cost-based fee for your own copy under the HIPAA Privacy Rule, limited to labour for copying, supplies, postage and, in some cases, preparing a summary.
eCFR, 45 CFR 164.524(c)(4), current to 23 September 2026 Checked 2026-09-25.
Under HIPAA, a notice refusing you access must describe how you can complain: to the covered entity through its own complaint procedure, using the contact person or office it names, or to the Secretary of the federal health department.
eCFR, 45 CFR 164.524(d), current to 23 September 2026 Checked 2026-09-25.
The rule sets the two routes side by side, so trying the provider first is our suggestion, not a requirement.
180 days is the general time limit for filing a HIPAA complaint with HHS, counted from when you knew or should have known of the problem, unless HHS waives it for good cause.
eCFR, 45 CFR 160.306(b)(3), current to 23 September 2026 Checked 2026-09-25.
This is the limit for a complaint to HHS. The rule does not say you must first complain to the provider.
Electronic records have one more route.
Information blocking, meaning a practice likely to interfere with access to electronic health information, can be reported through the Information Blocking Portal, which HHS calls the preferred way, or the HHS inspector general hotline, and reports can be anonymous.
ASTP/ONC, "Information Blocking Enforcement Alert", 4 September 2025; eCFR, 45 CFR 171.103, current to 23 September 2026 Checked 2026-09-25.
For a provider a practice counts only if it knows the practice is unreasonable, and the rules cover electronic health information, not physical slides.
United Arab Emirates
This page says nothing about federal law in the UAE. The two emirate policies below are the ones we relied on, and we did not check the other emirates.
One month (the policy gives 30 calendar days as its example) is how long a healthcare entity under the Dubai Health Authority’s jurisdiction has to answer a subject access request for your health records under its 2022 policy, which lists a right to complain to the supervisory authority, for example the Dubai Health Authority, and does not mention a fee.
Dubai Health Authority, "Policy for Data and Health Information Protection and Confidentiality" (DHA/HRS/HISHD/PP-11), issued 10 August 2022 Checked 2026-09-25.
A Dubai Health Authority policy for entities under its jurisdiction. The cover gives the effective date as 10 October 2022 and the footer 10 November 2022.
The Department of Health Abu Dhabi standard on patient healthcare data privacy says patients, except in certain circumstances, can review and obtain a copy of their protected health information and records; it sets no number of days and states no fee, but says the entity must respond in a timely way, and it requires an entity’s privacy policy to describe your right to complain to the Department of Health and to the entity and to give a contact point for complaints; it covers the providers the Department licenses.
Department of Health Abu Dhabi, "DOH Standard on Patient Healthcare Data Privacy", effective 16 September 2020, read through an Internet Archive copy captured 14 June 2025 Checked 2026-09-25.
Certain circumstances is not defined in the pages we read. We found no revision, but the Department’s own copy no longer loads and we could not open the live file, so the standard may have changed.
If your provider does not fit any of these rows, ask it who handles record requests, then follow the steps below.
Report, images, slides
Ask for the report, the images and the pathology material separately.
The report
A report is the written finding from a scan or a biopsy. A request for “my records” may return only the report, so ask for the images by name. The NHS App page we read lists reports from scans and does not mention scan images, and the Australian agency says the images are not included.
The NHS App can show reports from scans, and photos or other images you have shared with your GP surgery, to patients registered with a GP surgery in England; the NHS says some healthcare providers do not share hospital documents in the app, and its page does not say scan images are shown.
NHS, "Documents" (NHS App help), page last reviewed 13 January 2026, and the NHS App overview page Checked 2026-09-25.
The England and GP-registration wording comes from the NHS App overview page. The Documents page does not say scan images or pathology slides are in the app.
The Australian Digital Health Agency says that from July 2026 only written reports from pathology and diagnostic imaging services will be uploaded to My Health Record by default, and the images will not be included; you can ask for a report not to be uploaded.
Australian Digital Health Agency, "Better and faster access", 6 March 2026, read through an Internet Archive copy captured 18 May 2026 Checked 2026-09-25.
The agency described the new upload rules as starting in July 2026 and the Department of Health gave 1 July 2026, with a transition period, and we could not read the live pages after that date, so the current position may differ.
The images
The images are the scan itself, the pictures a radiologist studied.
The American Medical Association says most radiology images are in DICOM format, that DICOM viewer applications let patients view their images on a CD at home, and that every effort should be made to put both the images and the image report on the CD.
American Medical Association, "FAQs on Requesting Images on CD", 2021, guidance for physicians Checked 2026-09-25.
Written for US physicians. We found no comparable regulator or professional-body page for the UK, Canada or Australia, and could not read the Irish HSE image-sharing pages; the Data Protection Commission FAQ on X-ray and scan copies is cited above.
In the US, two more sources apply.
A 2020 HHS FAQ says X-rays and other images in your record are covered by the HIPAA right of access, in your requested format if the provider can readily produce it.
HHS Office for Civil Rights, FAQ 2059 on x-rays and other diagnostic images, read through an Internet Archive copy captured 2 November 2024 Checked 2026-09-25.
The text we read says nothing about physical slides or tissue blocks.
24 to 48 hours is how quickly many US physicians may be able to process a request for images on CD, according to the American Medical Association, which warns that ground shipping may take 7 to 10 business days and says a spoken request made on the day of a scan should be honoured where possible.
American Medical Association, "FAQs on Requesting Images on CD", 2021, guidance for physicians Checked 2026-09-25.
US only; guidance, not a rule.
Outside the US we found little written guidance on how a patient gets scan images. Ask the imaging department directly, name the study and its date, and say the format you want. In Ireland the Data Protection Commission says a photocopy of a scan meets the access right, which does not promise the digital images, so ask for them by name and say you want a disc or secure link.
Pathology slides and blocks
A pathology report is a written finding. The slides and the paraffin blocks are the tissue itself, and a laboratory holds them.
The American Cancer Society says some laboratories will give you your processed samples, often on microscope slides, for a second opinion at another cancer centre, while others mail the slides or send digital images to that centre, and you will probably have to sign forms.
American Cancer Society, "Understanding Your Pathology Report", last revised 26 March 2026 Checked 2026-09-25.
A charity information page reviewed by the American Society of Clinical Oncology. It states no rule.
The National Cancer Institute says patients seeking a pathology second opinion will need to obtain the slides and/or the paraffin block from the pathologist who examined the sample or from the hospital where the biopsy or surgery was done, and should contact the institution that will give the second opinion in advance to ask whether it offers the service, what it costs and how to ship the slides.
National Cancer Institute, "Surgical Pathology Reports" fact sheet, reviewed 8 August 2022 Checked 2026-09-25.
US-focused. It leaves procedure to each institution and does not say who owns slides.
Ask the pathology department that examined the sample, or the hospital where the biopsy or surgery was done.
The Royal College of Pathologists reports that in Scotland tissue blocks and slides become the property of the hospital, on the basis that they form part of the individual’s medical record, and says the position there differs from the rest of the UK.
Royal College of Pathologists and Institute of Biomedical Science, guidance G031, version 6, October 2025 Checked 2026-09-25.
This is the College’s report of the Scottish legal position, and we did not check it against statute.
If your biopsy was years ago, ask early whether the material still exists.
At least 30 years if facilities permit is what the UK Royal College of Pathologists and the Institute of Biomedical Science recommend for keeping tissue blocks; a laboratory with limited space may review at 10 years and keep only representative blocks, but blocks that were the basis of a cancer diagnosis should be kept for the full 30 years or until 10 years after the patient’s death, and stained slides that cannot be recut from a block are also recommended for 30 years, while replaceable sections are recommended for at least 8; this is UK laboratory guidance, not law.
Royal College of Pathologists and Institute of Biomedical Science, guidance G031, version 6, October 2025 Checked 2026-09-25.
A recommendation, not a promise that a laboratory still holds your block.
Histopathology slides 10 years, blocks 2 years are the minimum times a US laboratory certified under the federal CLIA rules must keep histopathology slides and pathology specimen blocks from the date of examination; these are floors, not what any particular laboratory keeps, and they say nothing about a patient’s access to slides.
eCFR, 42 CFR 493.1105(a)(7)(i)(B) and (a)(7)(ii), current to 23 September 2026 Checked 2026-09-25.
The text dates from 2003; state law was not read.
One is professional guidance for UK laboratories and the other is a legal minimum for US laboratories, so the two are not like for like. The laboratory’s own policy decides what still exists, and the only way to know is to ask.
Which of the three your case needs depends on the question the reviewing specialist is asked, so ask your own doctors what a specialist is likely to need before you order anything. If you are unsure, say so on the first call and we will help you work out how to get what is missing.
If a provider stalls
What to do when the answer is slow, partial or a refusal.
A common way to go about it, not legal advice; the Data Protection Commission, for example, encourages written requests.
- Put the request in writing and keep a copy. Name each thing you want: the report, the images on a disc or in a format you can open, the pathology report, and the slides or blocks. Give dates, and say when you need it.
- Note the date you sent it and, if you can, the date it arrived. The limits in the table generally run from receipt. In the UK and Ireland an extension of up to two more months is possible, and in the UK the clock pauses while the organisation waits for a clarification it reasonably requires.
- If the limit passes with no answer, or you get a refusal you don’t accept, write again. Quote the date of your first request and ask for the reason in writing.
- Then complain to the provider itself, in writing, and keep the date. The UK, Irish and Australian regulators above each expect you to have done this first.
- Only after that, take it to the body in the last column of the table. In the US, do not wait for a slow provider before filing with HHS, because HHS has a time limit for complaints.
Refusals need grounds set by law, and they differ by country. One health-specific ground in the UK guidance is serious harm.
The Information Commissioner’s Office says an organisation is exempt from giving health information to the extent that doing so would be likely to cause serious harm to anyone’s physical or mental health, and only a health professional, or someone relying on their opinion from the last six months, can apply that.
Information Commissioner’s Office, "Health information", updated 8 December 2025 Checked 2026-09-25.
Ireland has a comparable test, noted under the Irish records paragraph.
Still stuck after these steps? Tell us on the free 30 minute consultation where the request stopped, and we will help you work out how to get the rest.
What a specialist asks for
A general picture, from US physician guidance.
What a specialist asks for depends on the specialty and the question, and only the doctors reviewing your case can say what they need.
Many physicians prefer to see the actual images as well as the radiology report, according to the American Medical Association, which adds that some US specialties, such as oncology, orthopaedics or neurosurgery, require patients to submit records and images on CD before a new patient consultation is scheduled.
American Medical Association, "FAQs on Requesting Images on CD", 2021, guidance for physicians Checked 2026-09-25.
US only; it describes some offices, not every specialist.
Before you order anything, ask your own doctors what a specialist is likely to need.
Nothing here asks you to send us anything, and this site has no upload form. Rules change, so each note shows when it was last checked.
Questions
What people ask once they start requesting.
My waiting-list date is three weeks away and the limit is a month. Am I too late?
Not necessarily. A limit is the longest a provider may take, and the Irish guidance says the answer is due without undue delay, so some providers will be quicker than the limit. The UK and Ireland also allow up to two more months in some cases, and a disc that has to be collected or posted can add days.
So ask every provider today. If your date is close, ask the service that gave it to you whether it can move if your records are late. Our timing table counts the written plan from the day you hold a complete set of records.
What is a subject access request, and does it matter which word I use?
It is the UK and Irish name for a request for the personal data an organisation holds about you, and your health records count. The Irish regulator says a request can be verbal or written and encourages written ones, so say clearly what you want and keep a copy.
Can a relative or carer ask for me?
In the UK, a third party can make the request if they are authorised to act for you, and the month runs from when the organisation receives proof of that authority. We did not read what proof the other five countries ask for, so ask each provider before your relative or carer writes.
Not sure who to ask, or already stuck?
The first call is a free 30 minute consultation, and you do not need any records for it. Tell us what you have asked for and where it stopped, and we will help you work out how to get the rest. Please don’t send us anything yet: records move only after we have spoken, by secure transfer.