4 November 2026 - Xavier Flanagan, Founder

How to get a copy of your medical records in Ireland

If the HSE, a hospital, your GP, a consultant or a private clinic in Ireland holds records about you, you have a legal right to a copy. That covers consultation notes, letters, test results, scan reports and discharge summaries.

Ireland gives you two routes. A data protection request (a subject access request) works with everyone. Freedom of Information (FOI) works with public bodies: the HSE, the voluntary hospitals, and GP records about medical card and GP visit card patients. Both are usually free.

The short version

GP, private hospital, consultant’s rooms, dentist: make a subject access request. They must reply within one month, extendable by two more months for complex or numerous requests, and the first copy is free.
HSE services and public or voluntary hospitals: you can use either a subject access request or an FOI request. FOI gives a decision within 4 weeks, and records that are only about you are normally free. If you have a medical card or GP visit card, FOI also covers your GP’s records of that care.
If you are refused: for a subject access request, complain to the Data Protection Commission. For FOI, ask for an internal review, then appeal to the Information Commissioner. Neither costs anything when the records contain only information about you.

Route 1: a subject access request

The right of access is Article 15 of the GDPR, which applies in Ireland as EU law. It covers all personal data a provider holds about you, and health records are personal data.

Timing: one month from when they receive your request. They can extend it by up to two further months if the request is complex or they have received a number of requests from you, but they must tell you, with reasons, within the first month (Article 12(3)).
Cost: free. A reasonable fee is allowed only for further copies, or if a request is manifestly unfounded or excessive, for example repeated requests for the same thing (Articles 12(5) and 15(3)). Some practices still quote a fee for a copy of your records; for your first copy under a subject access request, that is not allowed. A fee for a doctor writing a medical report is a separate matter.
Format: if you ask by email, they should give you the information in a commonly used electronic form unless you ask otherwise (Article 15(3)).

For the HSE, use its subject access request form and send it by email or post to the regional data protection office for the place where you were treated. Include a copy of photo ID, such as a passport, driving licence or public services card, and say which services, locations and dates you want. The more specific you are, the faster it goes.

For a GP practice, private hospital or clinic, write to the practice manager or the data protection contact named in their privacy notice. A short email is enough. You do not need a form.

Route 2: Freedom of Information

The Freedom of Information Act 2014 applies to public bodies. For health records, that means the HSE and the voluntary hospitals, which run their own FOI offices. It also reaches records held by someone providing a service under contract to the HSE (section 11(9)), and the Information Commissioner applies this to GPs: records a GP holds about medical card and GP visit card patients count as held by the HSE, so you make that FOI request to the HSE. FOI does not apply to private hospitals, or to purely private GP care.

How to ask: in writing, saying you are making the request under the FOI Act, describing the records, and including proof of identity. The HSE’s FOI page has an email template and the address for each region. For a voluntary hospital, write to the hospital directly.
Timing: a decision within 4 weeks (section 13), which means 20 working days, as weekends and public holidays do not count (section 2). They can extend this by up to 4 more weeks only if the request covers so many records, or there are so many other requests for the same records, that the deadline cannot reasonably be met, and they must tell you before it expires (section 14). You can appeal an extension straight to the Information Commissioner, but only within 2 weeks (section 22). If you hear nothing by the deadline, the law treats it as a refusal, and you can move straight to a review (section 19).
Cost: for records that contain only information about you, no search and copying charge is made unless a significant number of records is involved, and even then your means must be taken into account (section 27(4)).
Reach: you can request personal records from any date, not only recent ones.

Which route to use? For your own records, both work. A subject access request is the simpler choice, and it has the stricter rule on what can be held back (below). FOI is the one to use for a child’s or a deceased relative’s records, below, because it has rules written for those cases.

If they refuse or take too long

Under a subject access request, a provider can hold back health information on health grounds only where giving it to you would be likely to cause serious harm to your physical or mental health, and only as much and for as long as necessary. They must still give you everything else (Data Protection Act 2018 (Access Modification) (Health) Regulations 2022). Under FOI the test is wider: a body can refuse medical records that it thinks might harm your physical or mental health, wellbeing or emotional condition (section 37(3)). Either way, if they withhold records on this ground, they must offer to give them to a health practitioner you choose (section 37(4) for FOI). Information about other people, such as a relative who spoke to your doctor, may also be withheld.

Subject access request: raise it with the provider first. If that does not resolve it, complain to the Data Protection Commission, Ireland’s data protection regulator.
FOI: ask the body for an internal review within 4 weeks of its decision. The review must be decided within 3 weeks (section 21). If you are still unhappy, apply to the Office of the Information Commissioner within 6 months (section 22). When the records contain only information about you, neither the review nor the appeal has a fee.

Start with the HSE Health App

The HSE Health App, launched in February 2025, shows some of your information once you log in with a verified MyGovID: flu and COVID-19 vaccination records, medicines refunded under the medical card or Drugs Payment Scheme, maternity and BreastCheck appointments, and referrals and waiting times. The HSE lists more, such as information about your conditions and procedures, as still in progress.

It is useful, but it is not your medical record. It is not a copy of your GP notes, hospital letters or test results. For those, you need one of the requests above.

Common situations

Your child’s records. Under FOI, a parent or guardian can request the records of a child under 18, and access is granted where it is in the child’s best interests (Freedom of Information Act 2014 (Section 37(8)) Regulations 2016). The same applies to an adult son or daughter whom a doctor has certified as unable to make the request themselves. Include proof that you are the parent or guardian, such as a birth certificate, adoption papers, a court order or a joint statutory declaration. Under data protection law, a child’s legal guardian can usually ask on the child’s behalf, and is presumed to be acting in the child’s best interests unless there is reason to think otherwise. No Irish law sets an age at which a child can ask for themselves; the Data Protection Commission says a child can once they have the capacity to. With teenagers, a provider may ask for the child’s agreement or hold back information shared in confidence.
Someone who has died. Data protection law covers living people only, so FOI is the route for the HSE and voluntary hospitals. The executor or administrator of the estate can request the records. A spouse, civil partner or cohabiting partner, or the next of kin (children first, then parents, then brothers and sisters, then nieces and nephews), can too, where the body decides that release is in the public interest, weighing the confidentiality of the person who died (same Regulations). If they had a medical card or GP visit card, their GP records for that care count as held by the HSE, so the same FOI request goes to the HSE. For purely private GP care, or a private hospital, there is no statutory right of access to a deceased person’s records, so ask the provider; the Medical Council’s guidance allows doctors to weigh the benefit to the family.
Someone else asking for you. You can authorise another person, such as a family member or solicitor, in writing. They send your signed consent with the request.
Changing GP. Your new practice can ask your old one to transfer your records. You can still request your own copy at any time. The Health Information Act 2026 will give you the right to have a provider send a free copy to another provider within one month, but that part was not yet in force as of November 2026.
Old records. Under its records retention policy (version 4, December 2025), the HSE keeps many clinical records, such as discharge letters and referral letters, for the patient’s lifetime and 8 years after death. Private providers set their own periods.

Asking for mental health records? See how to get your mental health records in Ireland, including when something can be held back.

Why the records are only half of it

Your history is spread across your GP, one or more hospitals, private consultants and clinics, and it arrives as PDFs, scans and paper. None of them shows you everything in one place.

That is where exora fits. Upload the records you get back, from any provider, and it reads them, pulls out your medications, conditions, results, procedures and vaccinations, and lays them out in plain language. Every fact links back to the page it came from, so you can always check it.

exora does not connect to the HSE or to your providers’ systems, and it does not request records for you. You get them, using the rights above, and exora puts them together. How exora handles your copy is set out in our privacy policy.