Patient Access Requests Under GDPR: Guidance for Irish Health Services

A patient who asks a health service for a copy of their records is, in most cases, making a data protection access request. The right comes from the GDPR and the Data Protection Act 2018, it applies to public and private providers alike, and it comes with a clock. This guide covers patient access requests under GDPR for health services in Ireland: what the Data Protection Commission (DPC), Citizens Information and the HSE say about how to receive, handle and answer them. It is general information, not legal advice.

The process is not specific to health, so if you need the general mechanics first, our guide to data subject access requests (written from an HR angle) covers the basics. This post concentrates on what is different when the records are clinical.

Who the right applies to

According to the DPC's FAQ "Can I access my medical records under data protection law?", the right of access applies regardless of who holds the data, including doctors, hospitals and consultants in public or private practice. The page says a person should receive anything held on file or on computer that relates to them or identifies them. The page shows no date, so check it for the current wording.

Citizens Information (page "Access to medical records in the public healthcare system", last edited 4 June 2026) describes the same picture from the patient's side. Data protection law covers public and private providers. Freedom of Information (FOI) is a separate route that covers bodies such as the HSE, voluntary hospitals and some health agencies, but the page says FOI does not cover private hospitals or GP visits as a private patient. For private care, access may instead rest on data protection law, the contract with the provider, or a court order.

For a provider, the practical point is that a request does not need to use the words "GDPR" or "subject access request" to be treated as one. The Citizens Information page on the right of access (last edited 17 February 2023) says requesters should state that it is an access request, but the pages we read do not say a request is invalid without particular wording. Our suggestion: treat any clear written request for records as an access request, and make sure reception, ward and clinic staff know to pass any request for records to the person who handles them, the same day.

How patients can make a request

Citizens Information lists several routes: the HSE Health App (for some appointments, medicines and vaccine records), a written request to the service where the person was treated, a data access request under GDPR using the HSE Subject Access Request Form for HSE services, an FOI request, or a court order of discovery. It notes that the HSE can only provide information about services it delivers directly, so records held by another hospital or agency must be requested from that body.

The HSE's own page on data protection requests (no date shown) says people can ask for a copy of their personal and health data, such as treatment records, test results and clinicians' notes. It asks for a description of the data wanted, dates of service, locations and the department involved. It asks for government-issued photo ID, and for someone applying on another person's behalf it asks for written consent or a signed letter of authority. Requests go to the regional data protection office covering the service.

Not every health service is the HSE. The DPC page says the right of access applies to doctors, hospitals and consultants in public or private practice, so a private provider should expect to receive requests directly. A simple, published way for patients to ask is one practical option (our suggestion, not a legal requirement): put the contact details of whoever handles requests (a practice manager, a DPO if you have one) on your privacy notice and website.

The time limit

The DPC's FAQ on timing says controllers must respond within one month of receipt of the request. It adds that the period can be extended by up to two further months, for example where the request is complex, but the organisation must tell the individual that an extension is needed, with reasons, before the first month ends. The page shows no date. Citizens Information (right of access page, last edited 17 February 2023) says the same.

The DPC's guide "Subject Access Requests: A Data Controller's Guide" (version last updated October 2022) adds detail that matters in busy services:

• The month runs from the day a valid request reaches the organisation, whichever department receives it or however it was submitted.
• The clock does not start until the requester's identity is adequately established.
• Weekends and public holidays count; if the deadline falls on a non-working day it moves to the next working day.
• The DPC recommends policies that aim to respond within 15 working days.
• Extensions should be as short as possible, and partial responses are an option.

The HSE's internal procedure for handling access requests (a document dated June 2019) shows one way a large service builds this in: the request is date-stamped as day 1, a file is opened, all correspondence is logged, and assembling the records is expected within 7 days. That document refers to older regulations on health data restrictions, so use it as an example of structure, not as the current legal text.

Identity and authority

For health records, getting identity right is more than a formality. The DPC's guide says controllers should use reasonable measures to identify the requester and ask for more information only where there is reasonable doubt; it says identity checks must conform to the principle of reasonable doubt. It also says health data is special category data, so unauthorised disclosure carries higher risk and stronger safeguards are expected. Our guide to special category health data under GDPR explains why that category is treated differently.

Requests made for someone else need extra care. The HSE page asks for written consent or a letter of authority. Citizens Information says a parent or guardian can use FOI to access a child's records, with access granted only if it is in the child's best interests, and that GDPR does not apply after death; for deceased patients, access may be available to the personal representative or certain other people under the FOI route it describes. The DPC's guide separately says controllers must take reasonable steps to help people with disabilities lodge and receive requests, for example by allowing verbal requests.

What goes in the response

The DPC's guide says the response should confirm whether personal data is being processed, give access to it, and provide tailored information about the processing rather than a copy of the general privacy notice. The copy should be in a durable, commonly used electronic format, following the requester's preferred format where stated, sent securely and made intelligible. The DPC FAQ on medical records adds that a photocopy of an X-ray or scan can satisfy a request, since the law only requires a copy.

The guide gives the example of internal emails about a data subject's health situation and says they should be provided appropriately redacted, if necessary. Fees: the DPC guide says access requests must be responded to free of charge, with a reasonable fee based on administrative costs possible only in limited cases, such as manifestly unfounded or excessive requests or additional copies.

Other people's information and restrictions

Clinical records often mention relatives, colleagues or other patients. The DPC's guide says not to disclose other people's data, and warns that redacting names alone may not be enough, since roles, shift details or employee numbers can still identify someone. For mixed data it points to assessing the balance of rights or obtaining consent.

On health information specifically, the DPC's medical records FAQ says a health professional or facility may restrict access if, in their opinion, releasing some or all of the information could harm the person's physical or mental health. It cites the Data Protection Act 2018 (Access Modification) (Health) Regulations 2022 (S.I. No. 121 of 2022), and says any restriction must be necessary, proportionate, only as long as needed, and apply only to the specific part of the data causing concern. The DPC's guide says that when a request is refused or limited, the requester must be told the reasons, their right to complain to the DPC and their right to seek a judicial remedy, within the one-month period.

A related example from the DPC concerns insurers. Its FAQ on insurance requests says insurers normally ask for medical information with the patient's consent, that requests should be relevant and not excessive, and that a request for a complete medical file would be "disproportionate and excessive". The page quotes ICGP guidance telling GPs to get written consent for each report request. If your service gets third-party requests like this, they are a different process from a patient's own access request.

Keeping records and training staff

The DPC's guide says to keep a record system, including details of oral requests, to confirm your understanding of the request in writing, and to keep the requester updated on progress. Accountability means being able to show what you did.

A practical approach, labelled as our suggestion rather than a legal requirement: keep a simple log with the date received, date identity was confirmed, deadline, who decided any restriction and why, and the date of reply; and make sure front-line staff, clinicians and administrators all know their part. Our overview of GDPR and data protection training for healthcare staff covers the wider training picture.

Our suggestion, not a legal requirement: when a health data restriction is under consideration, name in your procedure the clinician and the person handling the request, so the decision is documented at the time.

If the patient complains

Citizens Information says the Data Protection Commission deals with complaints about data protection, and that for disputes about FOI access the person should contact the Office of the Information Commissioner. The Citizens Information medical records page does not state any timelines or fees for requests, so rely on the DPC pages for those.

Limits of this guide

Citizens Information's medical records page also says the Health Information Act 2026 was signed on 30 April 2026 and, once commenced, is intended to create a Digital Health Record and give patients greater access to their own health information. We have not read the Act itself, so check the current position before changing your procedures.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Does a patient have to use a specific form?

Citizens Information says a request should be in writing and state that it is an access request. The HSE has its own Subject Access Request Form for HSE services. Private services can set up their own, but the DPC's guide says identity checks must conform to the principle of reasonable doubt.

How long does a health service have to reply?

The DPC says one month from receipt, extendable by up to two further months for complex requests if the requester is told with reasons within the first month. The DPC's guide says the clock starts once identity is adequately established.

Can a clinician refuse to release part of a record?

The DPC says access to health data may be restricted if release could harm the person's physical or mental health, citing S.I. No. 121 of 2022. The restriction must be necessary, proportionate and limited to the relevant part of the data.

Can a relative request a patient's records?

Not automatically. The HSE asks for written consent or a letter of authority. Citizens Information describes separate rules for children, adults who cannot exercise their own rights, and deceased patients under FOI.

Where can a patient complain?

To the Data Protection Commission for data protection complaints, and the Office of the Information Commissioner for FOI disputes, according to Citizens Information.

Handling these requests well is mostly a matter of clear procedures and trained staff, so review your process against the DPC pages above before the next request arrives.