Most people’s medical history lives in a drawer, a plastic sleeve, and two or three email accounts. Discharge summaries, blood test printouts that have started to fade, a brown envelope with an X-ray film in it, a CD from a hospital radiology department that no computer in the house can read any more, and a stack of clinic letters addressed to a GP you no longer see.
Sorting that out takes a weekend rather than an hour. But it has a clear order, and doing it in the right order saves most of the work.
Disclosure
I am a doctor, and I founded exora, a personal health record app built for exactly this problem. It appears once, near the end. Everything before that works whatever you use, including nothing at all.
Step 1: work out what you are missing before you scan anything
The instinct is to start scanning the pile in front of you. Resist it for an hour, because the pile is not the record. It is whatever happened to survive.
Write a rough timeline instead: every GP practice you have attended, with rough years, every hospital stay, every consultant you have seen, public or private, and dentists, opticians, physios and counsellors. Aim to notice the gaps, not to be complete, because the gaps are what you will request in step 2, and requests take weeks.
Start the requests first, then scan the pile while you wait. Doing it the other way round costs you a month.
Step 2: request the records you do not have
In Ireland you have a legal right to a copy of the information any health provider holds about you, whether that is the HSE, a public or voluntary hospital, a private hospital or your GP. It comes from Article 15 of the GDPR, and the request is called a subject access request, or data access request. Four details make the difference between an easy request and a frustrating one:
- It is free. The Data Protection Commission says you have the right to request your data “free of charge and in an accessible format” (DPC: access and portability). Under Article 15, a reasonable fee is allowed for further copies, so ask once, for everything you want.
- One month is the deadline. The organisation must respond “at the latest within one month of receiving the request”, and can “extend the time to respond by a further two months if the request is complex” (DPC). Under Article 12, it must tell you about any extension, with reasons, within the first month.
- Ask for electronic copies. If you ask by email, Article 15 says the information should be provided in a commonly used electronic form, unless you ask otherwise. Say so explicitly: PDFs, by email or secure download. Otherwise you may get paper, and then you are scanning it yourself.
- Be specific. Name the services, places and dates you want. “My full GP record” or “everything about my stay in March 2024” gets a faster answer than “all my records”.
For the HSE, use its subject access request form, with a copy of government-issued photo ID, “such as your passport, driving licence, public services card”, sent to the regional data protection office for where you were treated. For a GP, hospital or private clinic, a short email to the practice manager or medical records department is enough: your name, date of birth, address, the period you want, and a request for a complete electronic copy. For the HSE and the voluntary hospitals, Freedom of Information is a second route. Our Ireland guide to getting your medical records covers both routes, the exemptions and what to do if you are refused.
Check the HSE Health App first, too. If you are 16 or over with a verified MyGovID, it can show your hospital discharge summaries, a record of hospital procedures and your COVID-19 and flu vaccines. It does not show test results; our guide to test results in Ireland explains where those go.
Step 3: sort before you scan
Sort the physical pile: one pile per person if you are doing a family, then roughly by period within each. Aim for “1990s, 2000s, 2010s, recent”, not exact dates: the dates go in the filenames later, and the computer does the fine sorting.
Pull two things into their own piles as you go. Anything where several pages belong to one document: a six-page discharge summary is one document, not six scans. And anything fading. Old printouts on thermal paper lose contrast over time. Those pages have a deadline, so scan them first.
Step 4: scanning settings that actually matter
Ignore most of what scanner software offers. Four settings matter.
Resolution: 300 dpi. The UK’s National Archives says “For ordinary documents, use a minimum of 300 PPI” in its digitisation guidance, and warns that too low a resolution can stop text recognition working. Higher mostly makes larger files for a typed page. For faint handwriting, 400 dpi is a reasonable step up.
Colour: greyscale is usually enough for typed pages; use colour where it carries meaning, such as a coloured chart, a highlighted result or a stamp.
Format: PDF, one file per document, with text recognition on. Not JPEG: a multi-page document should be one multi-page PDF. Turn on OCR (optical character recognition), which turns a picture of text into searchable text. If your software offers PDF/A, the archival variant of PDF, use it.
Deskew and auto-crop: on. Straight, cropped pages read better and OCR more accurately.
Phone or flatbed?
A phone is fine for most of this. Use its document scanning mode rather than the plain camera: it detects edges, flattens the page and outputs a multi-page PDF. Use a flat surface, even light from the side, no flash, and keep your shadow out of the frame. A flatbed is worth it for hundreds of pages or anything fragile; hand-feed old pages rather than trusting a sheet feeder.
Step 5: the imaging problem
Imaging is where people get stuck, because there are two things in that envelope. There is the report, the radiologist’s written findings, and there are the images themselves. For most purposes, including giving your history to a new consultant, the report carries the information. It is a text document: scan it like anything else, and do that first, because it is easy and it is most of the value.
The images are different. Medical images are stored in a format called DICOM, and a disc with medical images on it is most likely a DICOM CD rather than a folder of ordinary pictures. Discs often include a small viewer program, but fewer and fewer computers have a disc drive.
Practical options, in the order I would try them:
- Contact the hospital or clinic that did the scan. Ask what they can provide and in what form: another disc, a USB drive or a secure download. Arrangements vary, so this is a phone call or an email rather than something you can look up.
- Use your right of access. Images are information the provider holds about you, so a data access request covers them, and it is free. Expect to confirm your identity.
- Borrow an external USB disc drive and copy the disc contents into a normal folder, whether or not you can view them.
- Keep the DICOM files even if you cannot open them. They are the diagnostic-quality original. A radiologist or consultant can read them; a screenshot of a viewer is no substitute.
Old X-ray films can be photographed against a bright, even light, such as a window on an overcast day. That gives you a record that the study exists, not a diagnostic-quality image. The written report matters more.
Step 6: name files so you can find them later
One convention, applied consistently, and the problem is solved for good. Put the date first, in year-month-day order:
2019-03-14_StJames_DischargeSummary.pdf
2019-03-16_GP_FullBloodCount.pdf
2021-11-02_Dr-Murphy_CardiologyLetter.pdf
Date-first in YYYY-MM-DD order is the whole trick: it sorts chronologically on its own, in every operating system. Writing 14-03-2019, the usual Irish order, does not. Use the date on the document, the date of the appointment or the test, not the date you scanned it.
Keep folders shallow: a folder per person, and inside it one folder per year or per document type.
Step 7: back it up before you relax
You now have one copy, on one laptop, and one copy is not a record.
A common approach is the 3-2-1 rule: three copies of the data, on two different kinds of storage, with one copy somewhere else. For a household, that usually means the folder on your computer, a copy on an external drive, and a copy in a cloud service. The off-site copy survives a fire or a burglary.
For health information, choose cloud storage you trust with sensitive data, turn on two-step verification, and test the backup once by opening a file from it.
What to keep on paper
Do not shred as you scan. A few sensible rules:
- Keep anything you might need to show in person. Vaccination records, including your child’s books and cards, and anything with an official stamp or signature. Our guide to getting your vaccination records in Ireland covers where the rest is held, and child health checks and records covers the books that go with a young child.
- Keep anything you cannot request again. If the practice has closed, the doctor has retired, or the document came from abroad, that paper may be the only copy.
- Keep the DICOM discs until the files are copied and backed up somewhere you have checked.
- Be relaxed about routine duplicates, such as a letter your GP practice still holds.
How long will the HSE and your doctor keep their copies?
For the HSE, retention is set by the HSE National Records Retention Policy. The current version, version 4, took effect on 1 December 2025 and is due for revision in December 2028. For many clinical records, its schedule sets a retention period of the lifetime of the patient plus 8 years after death, including:
- discharge summaries and letters sent to GPs or public health nurses
- referral letters from GPs or hospitals
- radiology and diagnostic images and reports
The policy says its “Retention periods specified represent minimum standards”, and that there can be justified exceptions to hold records longer. Other kinds of record in the schedule have their own periods, so check the policy for anything specific.
Outside the HSE, that schedule may not apply. The Medical Council’s Guide to Professional Conduct and Ethics (9th edition, in effect from 1 January 2024) says doctors “must keep medical records for as long as required by law or for as long as they remain clinically relevant” (paragraph 39.2). It does not set a number of years. In a footnote it points to an HSE code of practice with a suggested retention schedule, which it describes as “not applicable to all settings”. So a private hospital or GP practice may keep records for a different period, and a practice that has closed may be hard to trace.
So HSE records are likely to last; older private and GP records may not. Keep the paper that matters to you.
The step people skip: making it usable
When you finish, you have a searchable, backed-up folder of PDFs, which is far better than a drawer. It is still not a health record. Searching for “cholesterol” gets you eleven documents; it does not get you your cholesterol over eleven years. Medicines are named differently by different providers, the ingredient name in one letter and a brand in another. The question “when did this actually start” still means opening documents side by side. Text search finds words; a health record is about facts, dates and how they relate. Closing that gap is either patient work, keeping your own summary, or software.
Where exora fits, and where it does not
exora is a personal health record app. You upload the PDFs you have just made, and exora reads them for you, with a reading system built for medical records. It pulls out the conditions, medicines, results, procedures, allergies and vaccinations, and assembles them into one searchable record with a timeline. Every fact links back to the page and line of the document it came from, so you can check any of it. It works on iOS, Android and the web. exora is free to start, with an optional membership.
Where it does not help, plainly:
- It can misread. The reading is automated, so check anything that matters against the original. That is why every fact links back to it.
- No HSE connection. exora has no link to the HSE Health App, your GP’s system or any HSE service, and no Irish health-data certification. It does not request records for you.
- Your data is stored in Sydney, Australia, outside the EU. How we handle it is on our security page; read it before you upload anything.
- It is not medical advice. It organises what you already have. It does not diagnose or interpret anything.
For a fair comparison with the HSE’s own app, see the HSE Health App versus a personal health record app. If some of your records are in another language, see getting medical records translated in Ireland. Whatever you use, the folder is the valuable part, and it is yours. The next step is understanding what it says.
The short version
- Map your providers and notice the gaps.
- Request the missing records with a data access request: free, one month (extendable by two for complex requests), and ask for electronic copies.
- Sort the pile roughly by person and period. Scan fading thermal paper first.
- Scan at 300 dpi, greyscale for text, one multi-page PDF per document, OCR on.
- Scan imaging reports as documents. Ask the hospital for the images, and keep the DICOM files.
- Name everything YYYY-MM-DD_Provider_Type. Keep folders shallow.
- Three copies, two kinds of storage, one off-site. Then test it.
If something you read worries you, take it to your GP, not the internet. Sorting records is admin; interpreting them is not.
Sources
- GDPR (Regulation (EU) 2016/679), Articles 12 and 15 (right of access, timing, electronic copies, fee for further copies)
- Data Protection Commission: access and portability (free, one month, two-month extension)
- HSE: data protection requests (form, photo ID, regional offices)
- HSE: about your HSE Health App
- HSE National Records Retention Policy, version 4 (effective 1 December 2025) (healthcare records schedule, minimum standards)
- Medical Council: Guide to Professional Conduct and Ethics, 9th edition (2024), paragraphs 38 and 39
- The National Archives (UK): digitisation guidance (300 PPI minimum for ordinary documents)
- DICOM standard: medical images on CD
Access rights and timeframes are sourced to the GDPR, the Data Protection Commission and the HSE, retention periods to the HSE National Records Retention Policy and the Medical Council’s guide, and scanning resolution to the UK National Archives, all linked inline and checked on 9 November 2026. Retention periods are minimums and apply to HSE records; private providers set their own. Imaging arrangements vary between hospitals, so treat that section as a starting point for a phone call. This article is general information, not medical or legal advice. How exora handles your information is in our privacy policy.
