Managing health records for your family in the UK: children, ageing parents and carers

In most families, one person ends up holding everyone’s health history in their head. Which consultant said what. Whether the dose changed. Whether Dad’s cardiologist knows about the tablet the GP started last month. Often that person is doing it for their children and their own parents at once, from memory.

There is one thing nobody tells you until the moment you need it, and it is why this gets hard: caring for someone does not give you a right to see their health records. Responsibility and authority are separate, and they come apart at the wrong moments. Here is how access works in the UK, mostly in England, and what to arrange early.

Disclosure

I am a doctor, and I founded exora, which is a personal health record app that can hold records for several people in one account. It appears near the end. Everything before that applies whatever you use.

Three situations, three different answers

Most readers are in one of three positions:

• Your own children. You start with authority, and it narrows as they grow up, earlier than most parents expect.
• A parent or partner who can still make their own decisions. Easy to arrange, needs their agreement, and almost nobody does it in advance.
• Someone who can no longer make their own decisions. Much harder, and it turns on legal authority you either set up in time or have to apply to a court for.

Your children: parental responsibility, then their own say

The starting point is parental responsibility. A birth mother has it automatically, and so, usually, does a parent married to her or in a civil partnership with her when the child is born. An unmarried father or second female parent can get it by registering the birth jointly. A step-parent does not get it automatically, even if married to the child’s parent (GOV.UK).

With it, you can ask your child’s GP surgery for family and carer access, which the NHS also calls proxy access or a linked profile. According to the NHS website, only a parent or guardian with parental responsibility can get it for a child under 16, you and the child must be registered at the same surgery (you do not have to live together), and the surgery may ask for ID and proof of parental responsibility, such as a birth certificate. It will also check with anyone else who shares parental responsibility. Once it is set up, you can order repeat prescriptions, book appointments, contact the surgery, see test results and vaccinations, and see all or part of the GP record.

In the NHS App, you then switch between your profile and your child’s. What you can see is whatever the surgery has agreed, and only the surgery can change or remove it (NHS App help: linked profiles).

Why access changes as they get older

This is the part that catches parents out. There is no single national age at which your online access stops. Instead, the NHS describes a gradual handover:

• From 11, children “can begin to make their own decisions” about their healthcare, and the surgery must get the child’s consent if they are able to understand what proxy access means. A health professional decides whether a child is mature enough to consent to their own care, which is called being Gillick competent.
• Between 11 and 14, most surgeries have an automatic cut-off, after which parental online access stops to protect an older child’s confidentiality. Ask yours.
• At 16, family and carer access usually ends. A surgery can restore it if the young person consents.

Losing online access is not losing involvement: you can still manage your child’s care at the surgery as before. (All from the NHS pages on access for children under 16 and its information for young people, which also tells them they can ask for their own NHS App access from 13.)

The doctors’ side of this is set out by the General Medical Council. Its guidance says young people with capacity have the legal right to access their own health records and “can allow or prevent access by others, including their parents”. Doctors should let parents see a child’s records if the child consents, or lacks capacity, and it is not against the child’s best interests, and should not normally pass on something the young person said in confidence without their consent (GMC, 0-18 years). Separation or divorce does not affect parental responsibility.

Doctors can also give contraception, abortion and sexual health advice and treatment to under-16s without their parents knowing, under set conditions, including that the young person understands the advice and cannot be persuaded to tell their parents (GMC). These are often called the Fraser guidelines.

This is a good system. Teenagers need to be able to see a GP about contraception, mental health or drink and drugs and know the conversation is theirs. Silent parental access would put off exactly the fourteen-year-olds who most need to walk in.

So the practical advice is not a workaround. It is a conversation before the surgery’s cut-off: your GP record is becoming yours, which is right, and I would still like to help with appointments and prescriptions if you are happy for me to. Most teenagers say yes when asked. Fewer do when they find out you have been looking.

In Scotland the law is different: a child under 16 can consent to their own treatment if a doctor thinks they understand it (Age of Legal Capacity (Scotland) Act 1991), and for data protection rights a child of 12 or over is presumed mature enough to exercise them (Data Protection Act 2018, section 208).

A parent or partner who can still make their own decisions

This is the most common situation. If your mother is perfectly capable and wants help with appointments and medicines, you need no legal authority. She asks for you.

Anyone aged 16 or over can ask their GP surgery for someone to be their trusted person, for any reason (NHS website). You contact her surgery, it checks that she understands and agrees, you may fill in a form and show photo ID, and the surgery decides what access is appropriate. For the NHS App route you both need to be at the same surgery. The surgery can refuse if it thinks access is not in her best interests, even if she asked for it, because surgeries have to guard against abuse, control and coercion (NHS website: access for adults).

The thing worth taking away is the timing. Set this up on an ordinary Tuesday, not during a hospital admission. A trusted person is appointed by someone who is able to agree to it. The paperwork is not the hard part; the conversation is, and it is much easier over a cup of tea than in a hospital corridor.

Proxy access covers the GP record. For hospital or private records, a relative can make a subject access request on the person’s behalf, but the organisation must be satisfied you are entitled to act for them, and providing evidence of that is your job (ICO: a guide to subject access). Our UK records guide covers how to make the request.

Someone who can no longer make their own decisions

This is where it gets genuinely complicated. Even here, a GP surgery may still give a family member proxy access to someone who lacks capacity, for example because of dementia. It decides on the basis of the person’s best interests (NHS website). That is the surgery’s judgement, not your right. Legal authority, in England and Wales, comes from one of two places.

Lasting power of attorney for health and welfare

A lasting power of attorney lets someone (the donor) appoint people to make decisions for them. There are two types, property and financial affairs, and health and welfare (GOV.UK). Three things about health and welfare LPAs are often missed:

• It has to be registered with the Office of the Public Guardian before it can be used. GOV.UK puts registration at 8 to 10 weeks if there are no mistakes, and the fee at £92 unless you get a reduction or exemption.
• It only works when the person cannot decide for themselves. GOV.UK says it “can only be used when you’re unable to make your own decisions”. While your mother can decide, she decides (GOV.UK: lasting power of attorney; using a health and welfare LPA).
• It is binding only in England and Wales.

On records specifically, the Office of the Public Guardian’s guidance for NHS staff says an attorney or a court-appointed deputy “should be able to access relevant medical records” (GOV.UK: medical disclosure to attorneys and deputies). Note the word relevant. The same guidance tells staff to check that the person lacks capacity to agree, that you are acting in their best interests, and whether the LPA itself says this kind of information should not be shared. It is information to do the job, not a right to the whole file.

A deputy appointed by the Court of Protection

If someone has lost capacity without making an LPA, a family member can apply to the Court of Protection to be their deputy. A personal welfare deputy makes decisions about medical treatment and care, but GOV.UK says the court will usually only appoint one where there is doubt that decisions will be made in the person’s best interests, or where a specific ongoing decision is needed (GOV.UK: become a deputy). It is a much harder road than an LPA made in time.

Scotland and Northern Ireland differ: the same page says Scotland uses guardianship instead of deputies, and Northern Ireland a role called a controller. This is general information, not legal advice; for a specific situation, the Office of the Public Guardian or a solicitor is the right call.

The single most useful line in this article: arrange this while it is hypothetical. An LPA is not only for the very old or very ill, and the difference between a family that has one and a family that does not shows within an hour of an unexpected admission.

After someone has died

Data protection law covers the living. For a person who has died, the Access to Health Records Act 1990 lets their personal representative, and anyone who may have a claim arising from the death, apply for access to their health records. It applies in England, Wales and Scotland.

Being a carer without the paperwork

The hardest position is responsibility without authority: a friend, a neighbour, an unmarried partner, one of several adult children who disagree. What helps:

• Get named while you can. The person you care for can ask their surgery to make you their trusted person, and can tell their GP and consultants you are involved. Easy while they are well.
• Keep your own notes. Nothing stops you keeping a diary, copies of documents you are given, and a current medication list. It is what clinicians want when they ask “what is she taking?”
• Ask for copies at the time. A discharge summary or consultant’s letter is far easier to get at the appointment than later.
• Remember the person has full rights themselves. They can request every record any provider holds about them, and you can help them do it.

What actually helps day to day

Legal access is necessary, but what makes a Tuesday easier is smaller:

• A current medication list for each person. Names, doses, prescriber, when it changed. The most useful document in family care, and almost always out of date.
• A one-page summary for each person. Conditions, allergies, key history, current GP and consultants. What you would hand someone in A&E.
• The answer to “what changed since last time?” The question that connects the GP, the consultant and the hospital.

Note where the NHS layer stops. Proxy access shows you each person’s GP record, one at a time, as their surgery allows. It is well worth having (I compared it with a personal record here), but it will not assemble hospital letters, private clinic reports and older paperwork into a picture of the family. It was never trying to.

Where exora fits

exora is built for this shape of problem: one account, a separate profile for each person, such as yourself, a child and a parent you care for, and each profile holding its own health record. You upload the documents you have for each person, such as PDFs, photos or scans of the discharge summary, the consultant’s letter or the lab results, and exora reads them for you, with a reading system built for medical records. It pulls out the clinical details and builds one searchable record with a timeline for each person. Every fact links back to the document it came from, so you can check it. You can share a chosen part of one person’s record by link, with a co-parent, a sibling or a clinician, with an expiry, and revoke it at any time. Your health data is never used to train AI models. exora is free to start, with an optional membership.

Where it does not help, plainly:

• It is not legal access. Creating a profile for your mother does not give you any right to her records, and exora does not check parental responsibility or an LPA. Access comes from the routes above, and nothing in software replaces them.
• You still need their agreement. Managing an adult’s health information without their knowledge is a problem no product should solve, and this one does not.
• No NHS connection. exora has no link to the NHS App, NHS login, any GP system or any NHS service. You download documents, or request records, and upload them yourself. It cannot get documents you do not have.
• Your data is stored in Sydney, Australia. That is outside the UK. exora has no NHS approval or UK health-data certification. How we handle data is on our security page; read it before you upload anything, especially for someone else.
• It can misread. The reading is automated, so check anything that matters against the original. That is why every fact links back to it.
• It is not medical advice. It organises information. It does not diagnose or tell you what to do.

A short checklist

1. Children under 11: check you have parental responsibility, then ask your child’s GP surgery for family and carer access.
2. Approaching 11: ask the surgery what its cut-off age is, and have the conversation with your child before it arrives. After that, access depends on them.
3. Capable adults you help: ask them to make you their trusted person at their GP surgery now, while it is routine, and to tell their consultants you are involved.
4. Anyone ageing: make and register a health and welfare LPA while it is hypothetical, or the equivalent where they live.
5. Everyone: keep a medication list and a one-page summary for each person. If you do nothing else on this list, do this.

Sources

• GOV.UK: who has parental responsibility
• NHS website: family and carer access for children under 16 (eligibility, checks, ages 11, 11 to 14 and 16)
• NHS website: information for under-16s and NHS App help: linked profiles
• NHS website: what is family and carer access and access for adults
• GMC: 0-18 years, accessing medical records and contraception, abortion and STIs
• ICO: a guide to subject access (requests on behalf of others)
• GOV.UK: lasting power of attorney, using a health and welfare LPA and medical disclosure to attorneys and deputies
• GOV.UK: become a deputy
• Age of Legal Capacity (Scotland) Act 1991, section 2, Data Protection Act 2018, section 208 and Access to Health Records Act 1990, section 3

Claims about NHS family and carer access, lasting powers of attorney, deputies and access to records are sourced to the NHS website, GOV.UK, the Office of the Public Guardian, the General Medical Council, the Information Commissioner’s Office and the legislation, linked inline, and were checked on 9 November 2026. GP surgeries set their own age cut-offs and access levels, so check with yours. This article is general information, not legal or medical advice. Mental capacity and substitute decision-making law differs between England and Wales, Scotland and Northern Ireland and turns on the documents in place; for a real situation, contact the Office of the Public Guardian or a solicitor.