In the UK, how long medical records are kept depends on the record type and where you were treated. NHS GP records in England are held for your entire lifetime and then at least 10 years after death. Adult hospital records are kept for a minimum of eight years after treatment ends. Children’s records run until the 25th or 26th birthday, maternity records for 25 years, and some cancer and clinical trial records for 30 years or more. Scotland uses shorter timelines for several categories.
GP Records
If you are registered with an NHS GP in England, your medical record is kept continuously for as long as you are alive. The record follows you when you change practices, so there is no gap in your history. After death, GP records in England are retained for at least 10 years before being reviewed for disposal.1NHS Transformation Directorate. Records Management Code of Practice 2021
That 10-year period aligns with the outer limits for bringing certain legal claims under the Limitation Act 1980.2legislation.gov.uk. Limitation Act 1980
If you leave a GP practice and do not register elsewhere, the electronic record is retained indefinitely by the practice or by NHS England’s Primary Care Support England (PCSE) service. PCSE also holds records for patients who have moved to another UK country, registered solely with a private GP, or died without their records being claimed by a new provider.3NHS England. Migrating Records
Adult Hospital Records
Standard adult hospital records, including care plans, X-rays, scans, and other imaging, are kept for eight years after treatment ends or eight years after death, whichever comes first. The clock starts when the record stops being actively used, which usually means the point of discharge.1NHS Transformation Directorate. Records Management Code of Practice 2021
Eight years is the baseline. Several categories run far longer. Disease surveillance records for long-term conditions can be held for up to 100 years, screening programme records for 25 years, and independent investigation records related to serious incidents in mental health settings for 20 years.4NHS England. Records Retention and Disposal Schedule
Children’s and Maternity Records
Records for children and young people are kept until the patient’s 25th birthday. If the young person was 17 when treatment ended, retention extends to their 26th birthday. If the child dies before reaching that age, records are held for eight years after death.1NHS Transformation Directorate. Records Management Code of Practice 2021
Maternity records, covering antenatal, postnatal, and obstetric care, are retained for 25 years after the birth of the last child. The NHS treats these as belonging to both mother and child, which is why the period is longer than for standard adult hospital records.1NHS Transformation Directorate. Records Management Code of Practice 2021
Mental Health and Dental Records
Mental health records, including psychology records, are retained for 20 years after the last contact between the patient and any health professional, or 10 years after the patient’s death. The extended period reflects the long-term nature of mental health conditions and the likelihood that older records will still be clinically relevant.1NHS Transformation Directorate. Records Management Code of Practice 2021
Adult dental clinical care records are retained for 15 years under the Records Management Code of Practice 2021.1NHS Transformation Directorate. Records Management Code of Practice 2021 Children’s dental records follow the same timeline as other children’s health records: kept until the 25th birthday, or the 26th if treatment concluded at age 17.
Cancer Treatment and Clinical Trial Records
Cancer records carry extended timelines. NHS England guidance advises retaining oncology records for a minimum of 30 years from diagnosis, or until eight years after death. This covers planning scans, radiation dose records, treatment verification imaging, and details of chemotherapy or other drug therapies. Where the oncology record forms part of the main patient record, the whole record is kept for the longer period. Invasive cancer audit data is held for 20 years from diagnosis, though NHS England notes some records may need to be retained for 30 years and require further review.4NHS England. Records Retention and Disposal Schedule
If you took part in a clinical trial, your medical file from that trial must be kept for at least 25 years from the day after the trial concluded. If the data is later used to support a marketing authorisation for a medicine, records are held for a further two years after the authorisation is granted. For advanced therapy products, traceability records are kept for at least 30 years after the product’s expiry date.5GOV.UK. Archiving and Retention of Clinical Trial Records
How Scotland Differs
Scotland has its own Records Management Code of Practice, and several retention periods are shorter than in England. Adult health records in Scotland are kept for six years after the date of the last entry, or three years after death, whichever is earlier.6NHS Scotland. Scottish Government Records Management Code of Practice 2020
Children’s records in Scotland follow the same age thresholds as England, held until the 25th or 26th birthday, but post-death retention is three years rather than eight. Mental health records are kept for 20 years after the last professional contact, matching England, but only three years after death rather than 10.6NHS Scotland. Scottish Government Records Management Code of Practice 2020
The shorter Scottish timelines reflect the Scottish Prescription and Limitation Act rather than the English Limitation Act 1980. If you were treated in Scotland and later need historical records for a legal claim, this difference matters.
Private Healthcare Records
Private providers are subject to the same data protection law as the NHS, specifically the Data Protection Act 2018 and the UK GDPR. The General Medical Council requires all doctors, whether NHS or private, to store, protect, and dispose of patient records in line with data protection law.7legislation.gov.uk. Data Protection Act 2018 In private practice, records belong to the individual doctor rather than to a public body.8Premium Medical Protection. Storage and Retention of Medical Records
No single regulation prescribes exact retention periods for private practice. Most private providers use the NHS Code of Practice as a baseline, but policies vary. Ask your provider directly about their schedule. The main risk with private records is what happens if the provider retires or the clinic closes, because there is no automatic equivalent of PCSE to hold orphaned private patient records.
What Happens When a GP Practice Closes
When an NHS GP practice closes, merges with another practice, or changes clinical system, patient records do not disappear. PCSE manages the migration and storage of those records. If you are not registered with a new GP when your practice shuts down, PCSE holds your records until you register elsewhere.3NHS England. Migrating Records
For electronic records, if the old system cannot delete records in line with the retention schedule, the records are made inaccessible to users once the system is decommissioned. The system itself, along with its audit trails, is retained for the full retention period of the last entry. If your old practice has closed and you need your records, contact PCSE or your local Integrated Care Board.
Accessing Your Records
You have a legal right to access your medical records under the Data Protection Act 2018. This applies to NHS and private providers. The most common route is a Subject Access Request, submitted in writing to your GP surgery, hospital records department, or private clinic.7legislation.gov.uk. Data Protection Act 2018
For day-to-day GP records, the fastest option is the NHS App, which gives you online access to consultation notes, test results, and vaccinations. No formal request is required.
A Subject Access Request must be answered within one calendar month. Complex requests, or multiple requests submitted at once, can take up to three calendar months. The clock starts when the provider receives your request, but if identity verification is needed first, it begins once they have those documents.9Information Commissioner’s Office. Time Limits for Responding to Data Protection Rights Requests
You may need to prove your identity before records are released, typically with a passport, driving licence, or birth certificate. If someone else is requesting records on your behalf, such as a solicitor or family member, they will need your signed written consent or evidence of legal authority such as a court order.10NHS Transformation Directorate. Subject Access Requests Access is free in most cases. A reasonable fee can be charged only if the request is manifestly unfounded or excessive, for example repeated identical requests in a short period.
Can You Have Your Records Deleted?
The UK GDPR includes a right to erasure, but medical records are one of the clearest exceptions. Providers can refuse a deletion request if records are needed for medical diagnosis, the provision of health or social care, the defence of legal claims, or public health purposes. In practice, virtually all active medical records are exempt.11Information Commissioner’s Office. Right to Erasure
The ICO gives a worked example where a healthcare provider refuses an erasure request because its liability insurance requires retaining patient records in case of complaints or legal claims. That refusal is lawful. If you believe specific entries are factually wrong, you have a separate right to request correction rather than deletion.