Yes, a doctor can charge you for a copy of your medical records, but under HIPAA the fee has to be “reasonable” and “cost-based,” meaning it can only reflect the actual cost of producing the copy.1Health Information Privacy (HHS). Individuals’ Right under HIPAA to Access their Health Information 45 CFR 164.524 A separate federal law, the 21st Century Cures Act, requires most of your electronic health information to be available through a patient portal at no charge at all. So the honest answer is yes with tight limits, and a growing share of what you might have paid for in the past should now be free to download.
What the Fee Can Legally Include
The charge is narrow by design. HIPAA lets a provider bill you for the labor of actually copying the record (onto paper or into an electronic file), the supplies involved such as paper or a USB drive, and postage if you ask for the records to be mailed.1Health Information Privacy (HHS). Individuals’ Right under HIPAA to Access their Health Information 45 CFR 164.524 If you agree in advance to receive a summary of the record rather than the full file, the provider can also charge for the time spent preparing that summary.
Providers have three ways to arrive at a number. They can tally the actual costs for your specific request, work from an average-cost schedule they’ve developed for standard requests, or, for electronic copies of records already stored electronically, charge a flat fee of up to $6.50 that rolls labor, supplies, and postage into a single figure.2HHS.gov. Clarification of Permissible Fees for HIPAA Right of Access – Flat Rate Option of Up to $6.50 is Not a Cap on All Fees for Copies of PHI That $6.50 is a shortcut, not a universal ceiling. A provider who documents actual or average costs can charge more if the math backs it up.
What Cannot Be in the Fee
This is where most overcharges show up. A provider cannot bill you for the time staff spend searching for and retrieving your records. General overhead, such as rent, electricity, or the cost of running the electronic health record system, cannot be folded in. Capital costs for data storage and infrastructure are also off the table.1Health Information Privacy (HHS). Individuals’ Right under HIPAA to Access their Health Information 45 CFR 164.524 The time it takes to verify your identity before releasing records isn’t chargeable either. If your invoice contains line items labeled “retrieval,” “search fee,” or “administrative cost,” those charges are not allowed under federal rules.
Check Your Patient Portal First
Before you pay anything, log in. The 21st Century Cures Act requires providers to give patients electronic access to their health information without charge and without unnecessary delay. In practice, your clinical notes, lab results, medication lists, and referral information should be viewable and downloadable through the portal at no cost.
The law has teeth. Providers who block or unreasonably delay electronic access can face penalties of up to $1 million per violation, enforced by the HHS Office of Inspector General.3Office of Inspector General (HHS). Information Blocking Starting in 2024, providers who commit information blocking also face financial disincentives under Medicare, including reduced hospital reimbursement rates and lower performance scores for clinicians.4Federal Register. 21st Century Cures Act: Establishment of Disincentives for Health Care Providers That Have Committed Information Blocking If a provider is telling you to submit a paper request and pay a fee for information already sitting in the portal, push back.
State Laws Can Lower the Cap
HIPAA sets a federal floor. Many states go further, capping the per-page charge for paper copies, setting a maximum total fee regardless of record size, or doing both. Per-page rates vary widely, from under $0.50 to several dollars, and some states use tiered rates that charge more for the first batch of pages and less for the rest.
When state law gives you a better deal than HIPAA does, the provider has to follow state law. HIPAA operates as a minimum patient protection, not a ceiling, so the rule more favorable to you wins.5HHS.gov. Preemption of State Law Your state’s department of health or medical board usually publishes the specific schedule. Worth a look before you accept a large invoice.
When Records Go to a Third Party, the Cap Doesn’t Apply
Here is a detail that trips people up. HIPAA’s strict fee limits apply only when you request copies of your own records for yourself. If you direct a provider to send the records to someone else, such as an attorney, insurance company, or another physician, the fee restrictions do not apply.6Health Information Privacy (HHS.gov). Important Notice Regarding Individuals’ Right of Access to Health Records A 2020 federal court ruling struck down the portion of HIPAA that had extended fee caps to third-party transmissions.
What that means in practice: a provider fulfilling a request from your lawyer can charge more than they could charge you directly. If cost matters and you have the option, request the records yourself and then forward them. Your personal fee limits stay intact.
Imaging and Other Special Formats
Standard per-page and flat-fee schedules usually don’t cover imaging. Physical X-ray films, MRI scans, and similar specialized records cost more to reproduce, and most states let providers charge the actual cost of duplication for these formats. Some states set specific imaging fees, others allow “reasonable cost” without defining a number. If your request includes imaging, expect a separate charge on top of the standard copying fee, and ask for an estimate before you authorize the work.
Free Copies for Social Security Disability Claims
If you are applying for Social Security disability benefits or appealing a denial, you may be entitled to free copies. More than a dozen states have laws requiring providers to waive record fees when the request is tied to a Social Security disability or SSI claim. The details vary. Some states provide one free copy per year, others waive fees only for appeals, and a few limit the waiver to patients who aren’t represented by a private attorney. Check your state’s rule before paying out of pocket for records you need to support a benefits claim.
How Fast the Provider Has to Respond
HIPAA gives providers 30 calendar days from the date they receive your request to act on it.7U.S. Department of Health and Human Services. How Timely Must a Covered Entity Be in Responding to Individuals’ Requests for Access to Their PHI That is the outer limit, not the target. HHS has said it expects most requests to be fulfilled well before 30 days, particularly when records are already stored electronically.8HHS.gov. Why Does HIPAA Give Covered Entities 30 Days to Respond to Individuals’ Requests for Access to Their PHI
If a provider cannot meet the 30-day deadline, it can take a one-time extension of up to 30 additional days, but only if it tells you in writing during the first 30 days, explains the delay, and gives you a specific date for delivery.9HHS.gov. In Some Cases the 30-Day Timeframe May Not Be Sufficient No further extensions beyond that second 30-day window are allowed. A provider who goes past 60 days total without producing your records is in violation.
If a Doctor Overcharges or Refuses to Release Records
Start with a written letter to the provider that cites HIPAA’s right-of-access rules and identifies the specific fee limits at issue. Many overcharges are outdated billing habits rather than bad faith, and a clear letter often resolves the problem faster than a formal complaint.
If that doesn’t work, file a complaint with the HHS Office for Civil Rights. The complaint must be filed within 180 days of the violation, though OCR can extend that window for good cause, and it must identify the provider and describe what happened. You can file online through the OCR Complaint Portal, by email at OCRComplaint@hhs.gov, or by mailing a written complaint to the HHS Office for Civil Rights in Washington, D.C.10HHS.gov. How to File a Health Information Privacy or Security Complaint
OCR treats these cases seriously. Its Right of Access enforcement initiative has produced settlements ranging from $15,000 against small practices to $200,000 penalties against large health systems for failures to provide timely access to patient records.11HHS.gov. Resolution Agreements The rules on what a doctor can charge you are enforceable, and they get enforced.