A patient has asked for their records: what do we send, by when, and can we charge?

A request for a copy of a dental record arrives at the front desk by letter, email or phone, and the practice manager has to settle three things on the day: when the reply is due, whether anything can be charged, and who the copy goes to. This questionnaire asks who is asking, whether their identity or authority is settled, whether a child understands their own rights, and what kind of request it is. It gives the deadline, the fee rule and what to send, as we read the ICO's right of access guidance and the Access to Health Records Act 1990 on 2 October 2026.

Free tool

Records request: deadline, fee and who gets it

Answer each question. Some questions appear only when an earlier answer makes them relevant. Nothing you choose leaves this page.

1. Who is asking for the record?ChooseThe patient, for their own recordA parent or guardian, for a child's recordA solicitor, relative or other person acting for a living patientAn executor or relative of a patient who has died
2. Can you be sure it is the patient from what the practice already holds?ChooseYes: a known patient, and the details match the recordNo: details do not match, or there is real doubt
3. Have they sent the patient's signed authority, or a power of attorney that covers the request?ChooseYes, the authority is with the requestNo, or it does not cover a request for records
4. Is the child mature enough to understand their own rights over the record?ChooseNo, the child is too young to understandYes, the child understands (12 or over is the usual guide)
5. Is this a first request, a request for further copies of what was already sent, or plainly unfounded or excessive?ChooseA first request, or a new one since the last copyFurther copies of information we have already sentManifestly unfounded or excessive, and we can show why
6. Is the request complex, or one of several requests from the same person at the same time?ChooseNo, a straightforward requestYes, complex, or several requests at once

Start again

The outcome is the rule as our guides and the sources named set it out, applied to the answers you gave. It is not advice on your own case. Regulated work: a GDC-registered professional or the practice manager reviews every patient-facing draft before it is sent; nothing here is clinical advice and the AI assistant writes nothing clinical.

Works in your browser. Nothing you type leaves this device.

The questions, and why each is asked

1. Who is asking for the record? The right of access under UK GDPR belongs to a living patient, though others can use it for them. A deceased patient's record is reached under the Access to Health Records Act 1990 instead.

2. Can you be sure it is the patient from what the practice already holds? The ICO says to be reasonable and proportionate: ask for identity documents only if necessary, and use checks already in place. If you do ask, the month runs from the day the proof arrives. This question appears only when an earlier answer makes it relevant.

3. Have they sent the patient's signed authority, or a power of attorney that covers the request? The ICO says the third party is responsible for providing evidence that they are entitled to act. Without it the practice cannot comply, and should reply explaining why. This question appears only when an earlier answer makes it relevant.

4. Is the child mature enough to understand their own rights over the record? The right is the child's. In England, Wales and Northern Ireland competence depends on the child's understanding; the ICO says Scotland's presumption at 12 is a good guide. This question appears only when an earlier answer makes it relevant.

5. Is this a first request, a request for further copies of what was already sent, or plainly unfounded or excessive? In most cases no fee can be charged. The ICO allows a reasonable fee only for further copies, or for a request that is manifestly unfounded or excessive, which it says is a high threshold. This question appears only when an earlier answer makes it relevant.

6. Is the request complex, or one of several requests from the same person at the same time? The time limit can be extended by two months for a complex request or a number of requests from the same person. Needing clarification does not make a request complex. This question appears only when an earlier answer makes it relevant.

Every outcome, and the rule behind it

Deceased patient: the Access to Health Records Act, 40 days and no fee

Reached when: "Who is asking for the record?" answered "An executor or relative of a patient who has died".

UK GDPR covers living people only, so a deceased patient's record is reached under the Access to Health Records Act 1990. Section 3 lets the patient's personal representative, and anyone who may have a claim arising out of the death, apply. Access is due within 40 days of the application, or 21 days where the whole record was made in the 40 days before it, and section 3(4) says no fee shall be required. Section 5 withholds anything likely to cause serious harm, and, for a claimant, anything not relevant to the claim.

• Ask within 14 days for anything needed to identify the patient or confirm the applicant's standing, which restarts the period from the day it arrives.
• Have a dentist remove anything not relevant to the claim, or likely to cause serious harm, before the copy goes.
• Explain any term in the record that is not intelligible without explanation, as section 3(3) requires.

Source: Access to Health Records Act 1990, sections 3 and 5 (legislation.gov.uk, as amended to date); ICO, Right of access: Health information; both read 2 October 2026. The working is in How long to keep dental patient records.

Identity in doubt: ask for proof now, and the month starts when it arrives

Reached when: "Can you be sure it is the patient from what the practice already holds?" answered "No: details do not match, or there is real doubt".

The ICO says a practice must reply within one month of receiving the request, or of receiving any information it asked for to confirm identity. Where details do not match the record or there is real doubt, it is reasonable to ask the requester to verify their identity before anything is sent, asking only for what is needed. Ask straight away: the month for the copy then runs from the day the proof arrives, to the same date in the following month.

• Ask for proof of identity the day the request arrives, naming only what you need, and log the date you asked.
• When the proof arrives, log that date and set the reply date one month later, moved to the next working day if needed.

Source: ICO, Right of access: What should we consider when responding to a request? (Can we ask for ID?; time limits), guidance updated 8 December 2025, read 2 October 2026. The working is in Patient records request checklist for a dental practice.

No authority from the patient: reply to say why, and send nothing yet

Reached when: "Have they sent the patient's signed authority, or a power of attorney that covers the request?" answered "No, or it does not cover a request for records".

A relative, friend or solicitor can make a subject access request for a patient, but the ICO says the third party is responsible for providing evidence that they are entitled to act, such as written authority from the patient. With no evidence, the practice cannot comply until the authority arrives, and should respond to the third party explaining why. For a power of attorney, check its type and terms. A request from an insurer assessing a claim is not a subject access request at all.

• Write to the requester the same week asking for the patient's signed authority, or a copy of the power of attorney.
• Send nothing from the record until the authority is on file, and log both dates.

Source: ICO, Right of access: How do we recognise a subject access request? (Can a request be made on behalf of someone else?), and Health information (requests from a third party); both read 2 October 2026. The working is in Patient records request checklist for a dental practice.

A child who understands their rights: the request is answered to the child

Reached when: "Is the child mature enough to understand their own rights over the record?" answered "Yes, the child understands (12 or over is the usual guide)".

The right of access to a child's record is the child's, even when a parent uses it. In England, Wales and Northern Ireland competence depends on the child's understanding, and the ICO says Scotland's presumption at 12 or over is a good guide. Where the child is competent, the ICO says to respond to the child, and to let the parent exercise the right only if the child authorises it or it is clearly in the child's best interests. Court orders and the duty of confidence to the child also count.

• Ask the child, in a way they can understand, whether they agree to the parent receiving the record.
• Check the file for any court order about parental responsibility before sending anything to a parent.
• Answer within one month of the request, free of charge.

Source: ICO, Right of access: How do we recognise a subject access request? (requests for information about children, amended 7 April 2026), read 2 October 2026. The working is in Patient records request checklist for a dental practice.

Manifestly unfounded or excessive: refuse, or charge a reasonable fee

Reached when: "Is this a first request, a request for further copies of what was already sent, or plainly unfounded or excessive?" answered "Manifestly unfounded or excessive, and we can show why".

The ICO says a practice can refuse a subject access request, wholly or partly, if it is manifestly unfounded or excessive, or answer it and charge a reasonable fee for the administrative costs. The threshold is high: a request is not excessive just because the person made one before, and the practice needs strong reasons it can explain to the patient and to the ICO. A refusal must give the reasons, the right to complain to the practice and to the ICO, and the right to go to court, inside the time limit for the request.

• Write down why the request is manifestly unfounded or excessive before deciding, and keep it with the log.
• If refusing, tell the requester inside the time limit, normally one month, with the reasons and their rights to complain and go to court.
• If charging instead, ask for the fee within one month with a breakdown of the costs.

Source: ICO, Right of access: When can we consider a SAR to be manifestly unfounded or excessive?, and What should we consider when responding to a request? (Can we charge a fee?), and What exemptions are relevant for SARs? (refusals); UK GDPR, Article 12(4) as amended; all read 2 October 2026. The working is in How long to keep dental patient records.

Further copies of what was already sent: a reasonable fee is allowed

Reached when: "Is this a first request, a request for further copies of what was already sent, or plainly unfounded or excessive?" answered "Further copies of information we have already sent".

In most cases no fee can be charged for a subject access request, but the ICO allows a reasonable fee for the administrative costs where a person asks for further copies of information already provided. The fee can cover printing, postage, discs or USB devices and staff time at a reasonable hourly rate, and no regulations set a limit at present. Ask for it within one month of the request; the practice need not send the copies until the fee is paid.

• Check the log to confirm the information was already sent, and when.
• Ask for the fee within one month, with the costs broken down, and send the copies once it is paid.

Source: ICO, Right of access: What should we consider when responding to a request? (Can we charge a fee?), guidance updated 8 December 2025, read 2 October 2026. The working is in Patient records request checklist for a dental practice.

Complex or several requests: up to three months, if you say so in the first

Reached when: "Is the request complex, or one of several requests from the same person at the same time?" answered "Yes, complex, or several requests at once".

The ICO allows the time to respond to be extended by a further two months where a request is complex, or the same person has made a number of requests, such as a copy and an erasure request together. The extension is counted as three months from the original start date, and the patient must be told of it, with the reasons, within one month of receiving the request. A request is not complex just because clarification was needed. The copy is still free.

• Write to the patient within the first month saying the reply will come by the extended date, and why.
• Send whatever can be sent now rather than holding the whole record to the extended date.

Source: ICO, Right of access: What should we consider when responding to a request? (Can we extend the time for a response?), guidance updated 8 December 2025, read 2 October 2026. The working is in How long to keep dental patient records.

A straightforward request: a free copy within one month

Reached when: any other set of answers.

A subject access request must be answered without undue delay and at the latest within one month of receipt, counted to the same date in the following month and moved to the next working day if that falls on a weekend or public holiday. In most cases no fee can be charged. A non-clinician must not send health information unless the patient already knows it or a dentist has given an opinion in the last six months that the serious harm test is not met. A parent can act for a child who is not competent.

• Log the request and its reply date the day it arrives.
• Have the treating dentist check the record, and take out information about other people unless it is reasonable to leave it in.
• Send the copy free of charge by a secure method, in a common electronic format if the request was electronic.

Source: ICO, Right of access: What should we consider when responding to a request? (time limits, fees), guidance updated 8 December 2025; ICO, Right of access: Health information; ICO, requests for information about children; all read 2 October 2026. The working is in Patient records request checklist for a dental practice.

How to use the result

Write the result into the request log on the day the request arrives, with the date the reply is due. If the outcome holds the reply until something arrives, ask for it at once and record the date you asked and the date it came, because the month runs from that second date. Whatever the route, a dentist who treated the patient looks at the record before anyone else sends it. Then work through our records request checklist for the steps from search to sending, and keep both with the log.

The outcome applies the rule to the answers given; it cannot see the facts behind them. Where an answer is a judgement, or the facts are unusual, the outcome may not fit. A GDC-registered professional or the practice manager reviews anything a tool drafts before it reaches a patient, and this page is general information, not clinical or legal advice.

Overlyft sets up AI assistants for dental, physio and aesthetics clinics: they prepare drafts for a person to approve. None of these outcomes depends on them.