The Insurer Asked Me to Request My Own Records

If a life insurer has told you to request your own medical records and send them the results, you do not have to do it, and you are on firm legal ground in refusing. What you have been asked to do has a name — enforced subject access — and it is a criminal offence. Requiring someone to make a subject access request for their own records and hand the results over as a condition of receiving a service is prohibited by section 184 of the Data Protection Act 2018.

The proper route is narrower, and you should steer the insurer back to it. An underwriter who genuinely needs medical information asks your GP for a targeted report, with your written consent, limited to the questions that are actually relevant to the application. That is a world away from you walking into your surgery, requesting your entire file, and posting decades of notes to an insurance company.

It is worth being clear about the difference, because the two things can feel similar when you are anxious to get cover in place and someone official-sounding has asked. One is a proportionate request the law supports. The other asks you to become the instrument by which the insurer sidesteps the safeguards that exist precisely to stop it seeing more than it needs.

What "enforced subject access" actually means

A subject access request is your right. Under data protection law you can ask any organisation holding your personal data — including your GP surgery — for a copy of it, and they must provide it. The right exists for your benefit, so that you can see what is held about you and check it is accurate.

The problem arises when someone else leans on that right for their own convenience. Section 184 of the Data Protection Act 2018 makes it an offence for a person to require another person to make a subject access request, and to supply the results, as a condition of providing goods, facilities or services. Health records are expressly one of the categories of "relevant record" the section covers. An insurer selling you a policy is providing a service to a member of the public, so requiring you to fetch your own record and pass it over is exactly the situation the section was written to stop.

The reason the law treats this so seriously is that a subject access response is unfiltered. It is everything, in raw form, going back years — and once you have posted it, an organisation has seen far more than any assessment of it could ever justify. Parliament decided that people should not be pressured into surrendering that much simply because refusing would cost them a job, a tenancy, or a policy. Convenience for the insurer is not a defence to the offence.

None of this means the insurer is acting maliciously. Often it is a poorly designed process, or a request that has drifted from what the underwriter needs into a demand for everything "to be safe." But a request does not stop being enforced subject access because it was made without ill intent, and you are entitled to decline it.

What an insurer is allowed to ask for instead

There is a legitimate and well-worn route for an insurer to get medical information, and it looks nothing like the demand you have received. With your written consent, the insurer asks your GP for a targeted report — a General Practitioner's Report — answering the specific questions the underwriter has raised. Your GP reads those questions, looks at your record, and answers them. The insurer receives the answers, not the file.

That process runs under the Access to Medical Reports Act 1988, which gives you real rights over it. You can ask to see the report before it is sent to the insurer, you can ask the doctor to amend anything you consider incorrect or misleading, and you can withhold consent altogether. The report can only be written by a doctor who has been responsible for your clinical care, which in practice means your GP. Where the history is genuinely complex, an insurer may also ask for a targeted specialist report or a medical examination — but again, targeted, and again, with your consent.

The insurance industry's own guidance points the same way. The long-standing agreement between the Association of British Insurers and the British Medical Association on how medical information is requested favours proportionate, targeted reports over wholesale disclosure of the record. If you want to understand the boundary of what an insurer can and cannot see about you, our explainer on whether a life insurer can see your whole medical record sets out where the line falls and why.

Why the distinction is worth defending

It can be tempting to just do what is asked, get it over with, and get the policy in place. It is worth pausing before you do.

Your full record is not a tidy summary of the things an underwriter cares about. It is every consultation, every referral, every note a clinician has ever made — including mental health, sexual and reproductive health, medication you no longer take, things that turned out to be nothing, and comments about family members mentioned in passing. Almost none of that is relevant to a term assurance decision, and a targeted report exists precisely so that the irrelevant material is never disclosed. Handing over the lot removes that filter entirely, and once the insurer has seen something it cannot un-see it.

The point is sharpest where a record contains something sensitive that has since been resolved or brought under control. Someone in long-term recovery, for example, has every reason to want an underwriter assessing the current, stable position rather than trawling a decade of notes — and there is a proper way for that to be assessed, which we cover in our guide to life insurance for a recovering alcoholic. A targeted report lets the relevant facts be put fairly. A full-record dump does not.

Wording you can use to push back

You do not need to be combative, and you do not need to threaten anyone. A short, factual reply usually resolves it, because most front-line staff simply have not thought about the legal position. Something along these lines works:

I am happy to give my written consent for you to obtain a targeted General Practitioner's Report from my GP, covering the specific matters relevant to my application. I am not willing to make a subject access request for my full medical records and provide the results to you, as requiring that would be enforced subject access under section 184 of the Data Protection Act 2018. Please confirm you will proceed by way of a targeted report.

Put it in writing — email is fine — so there is a record. Keep a copy. In most cases the insurer will accept the consent form for a targeted report and the application carries on as normal, because that is what its underwriters actually wanted; the demand for your own records was the process going wrong, not a considered position it will defend.

If the insurer will not move

Occasionally an insurer digs in. If it does, you have two separate escalation routes, and you can use both.

The first is the insurer's own complaints process. Complain in writing, set out that you have offered consent to a targeted report and that the demand for your subject access response is enforced subject access under section 184. Ask for a final response. If the insurer does not resolve it, or eight weeks pass, you can take the complaint to the Financial Ombudsman Service, which is free to use and can look at whether the firm has treated you fairly.

The second route is the regulator for the data protection side. You can report the practice to the Information Commissioner's Office, which enforces the Data Protection Act and has been clear that enforced subject access is unlawful. You can read the offence itself in section 184 of the Data Protection Act 2018. Reporting it does not slow your application down — the complaint about your policy and the report about the practice are separate things.

Scotland and Northern Ireland

The criminal prohibition on enforced subject access is UK-wide: section 184 of the Data Protection Act 2018 applies in England, Wales, Scotland and Northern Ireland alike, so the core of this article holds wherever you live.

What differs is the machinery for the targeted medical report. The Access to Medical Reports Act 1988 governs it in England, Wales and Scotland. Northern Ireland has its own equivalent, the Access to Personal Files and Medical Reports (Northern Ireland) Order 1991, which provides comparable rights to see and correct a report before it goes to the insurer. The practical effect is the same in each nation — a proportionate report you can review, rather than your whole file surrendered by you — but if you are in Northern Ireland and citing the legislation, cite the 1991 Order rather than the 1988 Act.

Where this leaves your application

Refusing enforced subject access does not stall your cover, and it is not itself a black mark. You have offered the lawful alternative, and a well-run insurer will take it. Once the targeted report is in, the underwriter reaches a decision on the merits — which might be standard terms, a rating, an exclusion, or a postponement, none of which is triggered by your having pushed back on the records request.

If the eventual decision is an offer with a condition attached, our guide on whether to take cover offered with an exclusion talks through that choice. If it is a decline while you are mid-purchase, it is worth knowing early that this rarely touches the mortgage itself, which we explain in what a decline does, and does not do, to a mortgage offer. And if you were applying jointly, a split outcome has its own sensible path, set out in what to do when one of you is accepted and one declined.

If you are at the start of all this and simply want the application handled properly from the outset — targeted reports, not a demand for your file — you can get life insurance quotes and have an FCA-authorised broker manage the medical evidence the right way. For the wider picture on being assessed with a history or a condition, our hub on getting cover with a history, a condition or a job pulls the related situations together.

Frequently asked questions

Can an insurer make me get my own medical records?

No. Requiring someone to make a subject access request and hand over the results as a condition of providing a service is enforced subject access, a criminal offence under section 184 of the Data Protection Act 2018. The proper route is a targeted report obtained from your GP with your written consent, covering only the matters relevant to the application. You can consent to that while refusing the demand for your full record.

What should an insurer ask for instead?

A General Practitioner's Report, requested from your GP with your written consent and limited to the specific questions the underwriter needs answered. Where the history is complex, an insurer can also seek a targeted specialist report or ask for a medical examination. All of those are proportionate and are the established way medical information is obtained. Demanding your entire record, fetched by you, is not.

How do I push back?

Reply in writing. Say that you consent to a targeted GP report but not to making a subject access request and handing over your own records, and cite section 184 of the Data Protection Act 2018. Keep a copy. If the insurer persists, complain to it in writing, then take the complaint to the Financial Ombudsman Service, and report the practice to the Information Commissioner's Office.