Patient records request checklist for a dental practice: a copy of the record within one month

A patient who asks for a copy of their record is making a subject access request, whether or not they use those words, and the practice has one month to answer. Most requests are simple. The ones that go wrong were not logged on the day, were held up for identity documents nobody needed, or were sent without a clinician seeing them first. This list follows one request from the day it arrives to the entry in the request log. It is written for the practice manager or the information governance lead of a dental practice in England. Start a new list for each request and tick each step as it is done.

Free tool

Patient records request checklist

Tick each step as it is done. The ticks are kept in this browser only, so you can come back to the list; nothing is sent anywhere.

The day the request arrives

Treat any request for a copy of the record as a subject access request, however it is worded Log the request with the date it arrived and who took it Work out the deadline: the same date in the following month Offer your request form if you have one, but do not insist on it Request arrived with a complaint: run the two side by side, each with its own date

Check who is asking and what they want

Confirm the requester is the patient, using checks in proportion to what you already know Request from a solicitor, relative or other third party: ask for evidence that they act for the patient Ask for clarification only if you cannot answer without it, and ask straight away Patient sent by the Dental Complaints Service to ask for their records: handle it as any other request

Gather and check the record

Search every place the patient's information is held: practice system, imaging, email and paper files Include information held for you by any software supplier or AI tool that processes patient data Have the treating clinician confirm the record can be released before a non-clinician sends it Take out information about other people unless they consent or it is reasonable to leave it in Decide whether the request is complex enough to extend, and tell the patient within the first month

Send the copy

Send the copy free of charge Request made by email or online: supply the copy in a commonly used electronic format Send it securely: an encrypted file with the code sent separately, or tracked post for paper Include the supplementary information, or a link to the privacy notice that gives it Withholding all or part of the record: give the reasons and the patient's rights to complain

Close the request

Record what was sent, when, how and to whom in the request log Keep the original record: supplying a copy changes nothing about how long it is kept Patient asks for deletion as well: answer that separately, also within one month Keep the request log with the data protection policy the practice shows at inspection

Copy what is left Print the list Clear the ticks

A working list, not a certificate and not advice: the rule behind each step, with its source, is set out below. Regulated work: a GDC-registered professional or the practice manager reviews every patient-facing draft before it is sent; nothing here is clinical advice and the AI assistant writes nothing clinical.

Works in your browser. Nothing you type leaves this device.

The day the request arrives

Treat any request for a copy of the record as a subject access request, however it is worded. The ICO says there are no formal requirements. A request can be made verbally or in writing, including by social media, to any part of the practice, and it need not mention the law or be sent to a named person. Source: ICO, Right of access: How do we recognise a subject access request?, read 1 October 2026. The working is in How long to keep dental patient records.

Log the request with the date it arrived and who took it. The month runs from the day of receipt, even when that is a non-working day. Without that date in a request log, nobody can say when the reply is due or show afterwards that it went in time. Source: ICO, Right of access: What should we consider when responding to a request?, read 1 October 2026. The working is in How long to keep dental patient records.

Work out the deadline: the same date in the following month. The ICO counts from the day of receipt to the same date in the next month, moved to the next working day if that is a weekend or public holiday. A request received on Monday 5 October 2026 is due by Thursday 5 November 2026. Source: ICO, Right of access: What should we consider when responding to a request?, read 1 October 2026. The working is in How long to keep dental patient records.

Offer your request form if you have one, but do not insist on it. A practice may invite people to use a standard form, and the ICO says it should make clear that the form is not compulsory. A request made by any other means is still valid, and its month has already started. Source: ICO, Right of access: How do we recognise a subject access request?, read 1 October 2026.

Request arrived with a complaint: run the two side by side, each with its own date. A complaint is acknowledged within three working days and a records request is answered within one month, and both clocks run at once. Logging them as one item is how the second date gets missed. Source: NHS Complaints (England) Regulations 2009, regulation 13(3); ICO guidance on the right of access. The working is in The dental complaints procedure that meets the GDC and the NHS regulations.

Check who is asking and what they want

Confirm the requester is the patient, using checks in proportion to what you already know. The ICO says to be reasonable and proportionate: ask for formal identity documents only if necessary, and use checks you already have. If you do need proof of identity, the month runs from the day you receive it. Source: ICO, Right of access: What should we consider when responding to a request?, read 1 October 2026. The working is in How long to keep dental patient records.

Request from a solicitor, relative or other third party: ask for evidence that they act for the patient. A third party can make the request, but it is for them to show they are entitled to act, for example with the patient's written authority or a power of attorney. Without it you cannot comply, and you should reply to say why. Source: ICO, Right of access: How do we recognise a subject access request?, read 1 October 2026.

Ask for clarification only if you cannot answer without it, and ask straight away. The ICO allows a request for clarification only where it is reasonably required. The time limit pauses on the day you ask and resumes the day after the patient answers, so a question asked late leaves too little time to search. Source: ICO, Right of access: What should we consider when responding to a request?, read 1 October 2026.

Patient sent by the Dental Complaints Service to ask for their records: handle it as any other request. The service's list of things it cannot help with includes a copy of the records, which the patient asks the practice for. The request has the same one-month limit, alongside whatever the complaint requires. Source: Dental Complaints Service. The working is in What happens if a private patient goes to the Dental Complaints Service.

Gather and check the record

Search every place the patient's information is held: practice system, imaging, email and paper files. The right covers the patient's personal information wherever the practice holds it, and the ICO expects a reasonable and proportionate search. The NHS contract's record-keeping rule lists treatment plans, radiographs, photographs and study casts alongside the patient record, so look for all of them. Source: ICO, Right of access, read 1 October 2026; GDS Contracts Regulations 2005, Schedule 3, paragraph 32. The working is in How long to keep dental patient records.

Include information held for you by any software supplier or AI tool that processes patient data. The practice is the controller and the supplier is a processor acting on its instructions. Information a supplier holds on the practice's behalf is still the practice's to find and disclose. Source: ICO guidance on controllers and processors. The working is in AI and patient data in a dental practice.

Have the treating clinician confirm the record can be released before a non-clinician sends it. Someone who is not a health professional must not disclose health information unless the patient has already seen or knows about it, or the appropriate health professional has given an opinion within the last six months that the serious harm test is not met. Source: ICO, Right of access: Health information, read 1 October 2026; Data Protection Act 2018, Schedule 3.

Take out information about other people unless they consent or it is reasonable to leave it in. Where the record identifies someone else, the ICO's three steps are: can the information be removed, has the person consented, and if not, is it reasonable to disclose anyway. It is normally reasonable to leave in a health professional named in that role. Source: ICO, Right of access: information about other people, and Health information, read 1 October 2026.

Decide whether the request is complex enough to extend, and tell the patient within the first month. The time limit can be extended by a further two months for a complex request or a number of requests. The patient must be told, with the reasons, within one month of receipt. Needing clarification does not make a request complex. Source: ICO, Right of access: What should we consider when responding to a request?, read 1 October 2026. The working is in How long to keep dental patient records.

Send the copy

Send the copy free of charge. In most cases a fee cannot be charged. A reasonable fee for administrative costs is allowed only where a request is manifestly unfounded or excessive, or where the patient asks for further copies of what they have already been given. Source: ICO, Right of access: Can we charge a fee?, read 1 October 2026. The working is in How long to keep dental patient records.

Request made by email or online: supply the copy in a commonly used electronic format. Where the request was made electronically the copy must be in a commonly used electronic format. The ICO's example is files in a proprietary format the person has no software to open: that does not count as providing a copy. Source: ICO, Right of access: How can we supply information to the requester?, read 1 October 2026.

Send it securely: an encrypted file with the code sent separately, or tracked post for paper. The ICO says sensitive information should go by an appropriately secure method. It suggests an encrypted file with the access code sent separately, or special delivery or a courier for hard copy, and says a reply over social media is not secure. Source: ICO, Right of access: How can we supply information to the requester?, read 1 October 2026.

Include the supplementary information, or a link to the privacy notice that gives it. The right of access also covers supplementary information such as the purposes of processing. If the privacy notice already contains it, the ICO says a link to the notice will do, and it is due within the same month. Source: ICO, Right of access: What should we consider when responding to a request?, read 1 October 2026.

Withholding all or part of the record: give the reasons and the patient's rights to complain. A refusal must tell the person the reasons, their right to complain to the practice, their right to complain to the ICO and their ability to enforce their rights through the courts. Source: ICO, Right of access: What exemptions are relevant?, read 1 October 2026. The working is in How long to keep dental patient records.

Close the request

Record what was sent, when, how and to whom in the request log. The log is what shows the reply went inside the month if the patient or the ICO asks later. Our retention guide ends its own steps the same way: the decision recorded in the patient's file and in the request log. Source: Our records retention guide; ICO guidance on the right of access. The working is in How long to keep dental patient records.

Keep the original record: supplying a copy changes nothing about how long it is kept. NHS dental practices in England keep clinical care records for 11 years, on the NHS Business Services Authority's published answer. A request for a copy is not a request for deletion. Source: NHS Business Services Authority knowledge base article KA-01913. The working is in How long to keep dental patient records.

Patient asks for deletion as well: answer that separately, also within one month. The right to erasure does not apply to records needed to provide health care or to defend legal claims. The usual answer is that the clinical record stays until its retention date and anything the practice does not need goes now. Source: ICO guidance on the right to erasure. The working is in How long to keep dental patient records.

Keep the request log with the data protection policy the practice shows at inspection. CQC inspectors ask for policies that are dated and reviewed, data protection among them, and for training records that cover information governance. A request log with reply dates shows the policy being followed. Source: CQC Regulation 17. The working is in CQC dental inspection in 2026.

How to use the list

Keep the finished list with the entry in the request log, dated, and note what was sent and how. If a step does not apply, such as the one for a solicitor's request, tick it and move on; what matters is that somebody decided. If the patient later complains to the practice or to the Information Commissioner's Office about the reply, the list shows the date the request arrived, the date the copy went and who checked it.

A ticked list is a record that the steps were done, not proof that each was done properly. The list covers the points our guides and the official pages named above set out; it is not every duty a firm has. A GDC-registered professional or the practice manager reviews anything a tool drafts before it reaches a patient, and this page is general information, not clinical or legal advice.

Overlyft sets up AI assistants for dental, physio and aesthetics clinics: they prepare drafts for a person to approve. They do not tick off any of these steps for you, and you can do every one without them.