Current UK legislation is impacting upon the feasibility and cost-effectiveness of medical record-based research aimed at benefiting the NHS and the public heath. Whereas previous commentators have focused on the Data Protection Act 1998, the Health and Social Care Act 2001 is the key legislation for public health researchers wishing to access medical records without written consent. The Act requires researchers to apply to the Patient Information Advisory Group (PIAG) for permission to access medical records without written permission. We present a case study of the work required to obtain the necessary permissions from PIAG in order to conduct a large scale public health research project. In our experience it took eight months to receive permission to access basic identifying information on individuals registered at general practices, and a decision on whether we could access clinical information in medical records without consent took 18 months. Such delays pose near insurmountable difficulties to grant funded research, and in our case 560,000pound of public and charitable money was spent on research staff while a large part of their work was prohibited until the third year of a three year grant. We conclude by arguing that many of the current problems could be avoided by returning PIAG's responsibilities to research ethics committees, and by allowing "opt-out" consent for many public health research projects.