How the Medical Records Trust Collects Your NHS Records on Your Behalf

We follow a straightforward, step-by-step process designed to protect your privacy and keep you in control.

1. Gather the Details We Need from You

We ask for:

• Full name, current address, and date of birth:
  To match you accurately to the NHS Spine and other provider systems.

• Photo identification (e.g. passport, driving licence) and proof of address (e.g. recent utility bill):
  To meet NHS identity-verification guidance and confirm we are acting for the right person.

• List of where you have received care:
  This can be as simple as “saw GP in Gateshead” or as detailed as “admitted to X Hospital for heart-bypass surgery, 2018”. It helps us pinpoint which hospitals, GP practices or clinics hold records about you.

• Previous UK addresses:
  Some records are indexed by historic address; providing these avoids missed matches.

We supply secure online forms for each item and can accept scanned documents or verified digital ID services.

2. You Authorise Us to Act on Your Behalf

You sign a single, time-limited authority that allows the Trust to request copies of your health records from the named providers. The authority:

• Cites the UK GDPR right of access (subject-access request)
• Specifies that data are to be supplied in UK FHIR Core format wherever possible

3. We Contact Each Provider and Retrieve the Records

• Requests issued:
  We submit a subject-access request to every GP surgery, hospital or clinic on your list, including copies of your ID.

• Data received:
  Providers send the records back to us; if they are not already in FHIR we convert them to the standard.

• Progress updates:
  You can check a dashboard showing which requests are complete and which are still pending. Turn-round times vary: GP records often arrive within a month; older hospital archives may take longer.

4. You Review and Manage Your Consolidated Record

Once all responses are in, we present your complete record through a secure portal and a UK FHIR Core API.

You can download, share with a nominated clinician or family member, or raise queries if something looks incorrect.

5. Your Ongoing Choices

• Keep your record with us:
  We store it securely in encrypted UK data centres, with audit logs and role-based access controls.

• Delete everything:
  Select “Delete my record” in the portal. We erase all data we hold for you and send confirmation.

• Pause or stop new searches:
  You can cancel outstanding requests at any time; we will not contact additional providers.

Deletion requests are processed within 14 days and are irreversible.

Important – Your GP (or Another Provider) May Verify Your Request

To protect patient confidentiality, many GP practices and hospitals perform an extra identity-check before they release records. After we submit your authorised request:

• Your GP surgery may phone, text or write to you to confirm that you have genuinely asked the Medical Records Trust to collect your notes.
• They might ask simple questions—e.g. your date of birth or details of the request letter—to be sure the enquiry is legitimate.
• Some practices will ask you to sign a short consent form or reply to a secure NHS email.

Please respond promptly; it prevents delays and shows the provider that you remain in control of the process.

If anything looks unclear, contact us or your surgery directly. We can re-issue documentation, and you can cancel or pause the request at any time.

Key Points to Remember

• You remain in charge – we never contact a provider or share data unless you have authorised it.
• Everything uses recognised NHS standards – data are stored exclusively in UK FHIR Core format, so any GP or hospital can read them easily.
• No long-term commitment – you may leave, delete or return at any time, and there is no fee for removing your data.

If you have further questions, our support team will be pleased to help.