5 November 2026 - Xavier Flanagan, Founder

How to get your mental health records in Ireland

The short answer: yes. Your mental health records are personal data about your health, and in Ireland you have a legal right to a copy of the personal data an organisation holds about you. That includes records from HSE mental health services, a public or voluntary hospital, your GP, a private hospital, and a private psychiatrist, psychologist, counsellor or psychotherapist.

The longer answer is that health records are one of the few areas where Irish law lets a provider hold something back on the grounds that seeing it could seriously harm you. This guide explains when that can happen, what they have to do instead, and what you can do if you are refused. It was checked against the legislation in November 2026. It is general information, not legal advice.

The short version

You can ask. A data protection request (a subject access request) works with every provider, public or private. For the HSE and public or voluntary hospitals, you can also use Freedom of Information (FOI).
Timing: a subject access request must be answered within one month, extendable by two more months for complex or numerous requests. An FOI request gets a decision within 4 weeks.
Cost: your first copy under a subject access request is free. Under FOI, records that are only about you are normally free too.
Limits: under a subject access request, health information can be withheld only where giving it to you would be likely to cause serious harm to your physical or mental health, and only as much and for as long as necessary. If anything is withheld, you can have it given to a health practitioner you choose.
If you are refused: raise it with the provider, then complain to the Data Protection Commission. For FOI, ask for an internal review, then appeal to the Information Commissioner.

Which route to use

A subject access request: works with everyone

The right of access is Article 15 of the GDPR, which applies in Ireland as EU law. It covers all the personal data a provider holds about you, whoever they are: the HSE, a hospital, a GP practice, a private clinic, a charity, or a therapist working on their own. They must respond within one month, which they can extend by up to two further months only if the request is complex or they have received a number of requests from you, telling you why within the first month (Article 12(3)). The first copy is free (Article 12(5)).

Irish law has no separate category for a psychiatrist’s or therapist’s session notes. If you have read American content about “psychotherapy notes”, that is a rule under HIPAA, a United States law, and it does not apply in Ireland. Here, session notes are health data like the rest of your record. The rules written specifically for health data are in the Data Protection Act 2018 (Access Modification) (Health) Regulations 2022 (S.I. No. 121 of 2022), below.

Freedom of Information: for the HSE and public hospitals

The Freedom of Information Act 2014 covers public bodies, including the HSE and the voluntary hospitals. It does not cover private hospitals or purely private care. Our guide to getting your medical records in Ireland explains how FOI requests work, including deadlines and the HSE’s forms.

For mental health records, the difference between the two routes matters. The FOI test for holding something back is wider than the data protection one (see below). If you want your own records, a subject access request is usually the stronger route.

When something can be held back, and what has to happen instead

Under a subject access request

The 2022 Regulations replaced the old 1989 health regulations (S.I. No. 82 of 1989), which they revoke (regulation 2). They set out a narrow test:

Serious harm to you. A provider can decide not to give you health data only if it “has reasonable grounds for believing that granting access … would be likely to cause serious harm to the physical or mental health of the data subject” (regulations 6 and 7). The test is about harm to your own health.
Only as much, and for as long, as necessary. Any restriction must be “necessary and proportionate”, and only “for as long as necessary only to protect the health of the data subject” (regulation 4).
You still get the rest. Nothing in the Regulations excuses a provider from giving you “so much of the information sought … as may be granted without causing serious harm” (regulation 5).
Who decides. A health services provider can make this decision itself. Any other organisation holding your health data may consult a health practitioner with the right experience before deciding, giving them only the data needed, in pseudonymised form. If that practitioner advises withholding anything, the advice must be in writing (regulation 8).
A health practitioner of your choice. If anything is withheld, the provider must tell you that, if you ask, it will offer access to that information to a health practitioner “having experience and qualifications in the subject matter of the data as the data subject may specify”, and keep it available for that purpose (regulation 9). So you can name a GP, psychiatrist or psychologist you trust to see it.

Under Freedom of Information

Under FOI, a body can refuse a request for “a record of a medical or psychiatric nature” about you if, in the opinion of the head of the body, disclosure “might be prejudicial to his or her physical or mental health, well-being or emotional condition” (section 37(3)). That is a lower bar than “likely to cause serious harm”. If a body refuses on this ground, it must offer to give the record to a health professional with expertise in the subject who you choose (section 37(4)).

Information about other people

Mental health records often include what relatives, partners or friends told a clinician. Under GDPR, your right to a copy “shall not adversely affect the rights and freedoms of others” (Article 15(4)), so information about another person may be held back. Under FOI, personal information about other people is generally protected (section 37). That should not stop you getting the rest of your record.

How to ask

Ask each place that treated you. HSE community mental health services, a public or voluntary hospital, your GP, a private hospital, and a private psychiatrist, psychologist or counsellor each keep their own records. For the HSE, send a subject access request to the regional data protection office for the place you were treated, using its data protection request form.
Ask in writing. An email is fine for a private provider; write to the practice manager or the data protection contact in their privacy notice. Give your name, date of birth and contact details, the dates of treatment, and what you want.
Say how you want to receive them. If you ask by email, they should give you the information in a commonly used electronic form (Article 15(3)). If you would rather go through the records with your clinician, you can ask for that too.
Keep a copy of your request and note the date you sent it.

If you are refused, or nobody answers

Subject access request: raise it with the provider first, in writing. If something was withheld, ask which parts, and ask for them to be given to a health practitioner you name. The Data Protection Commission says it will generally require you to have raised the matter with the organisation before it takes up a concern. If that does not resolve it, raise a concern with the Data Protection Commission using its online form.
FOI: ask the body for an internal review, then, if you are still unhappy, apply to the Office of the Information Commissioner. Our Ireland medical records guide sets out the time limits.

A word on reading your own records

Clinical notes are written for clinicians. They can use blunt language, shorthand and diagnostic labels that read very differently on the page than they did in the room. Some people find that confronting. It can help to read them with someone you trust, or to ask your clinician to go through them with you. If reading them brings up something difficult, Samaritans is available on 116 123, at any time.

If you think something in your records is inaccurate, you can also ask for it to be corrected (GDPR, Article 16).

Where exora fits

Once you have your records, you can upload them to exora along with the rest of your health documents. exora reads them and organises the conditions, medicines and history into one record you control, with every detail linked back to the page it came from. You choose what to upload and who, if anyone, it is shared with. How exora handles your information is set out in our privacy policy. exora is free to start, with an optional membership.

exora does not connect to the HSE or to your therapist’s systems. It works with the documents you request and decide to add.