No. A doctor cannot withhold your medical records because you have not paid your bill. Federal law is explicit on this point: the HIPAA Privacy Rule gives you a right to access your health information, and a provider may not deny that access because you owe money for treatment.1HHS.gov. Your Medical Records The provider can charge a reasonable, cost-based fee for copying and mailing the records themselves, but that fee cannot be used as leverage to collect the underlying medical bill.
What the Law Actually Says
The HIPAA Privacy Rule gives you a legally enforceable right to inspect, review, and obtain a copy of the health information your providers and health plans maintain about you. That includes lab results, medical images, clinical notes, billing records, insurance information, prescription histories, and wellness program files.2HHS.gov. Individuals’ Right under HIPAA to Access their Health Information
The rule addresses the nonpayment question directly. A provider may not withhold or deny access to your protected health information because you have not paid for the healthcare services the provider delivered.1HHS.gov. Your Medical Records The Department of Health and Human Services has also closed a related workaround: a provider cannot take the money you pay for copies and apply it to your unpaid medical bill and then claim you still owe the copy fee.2HHS.gov. Individuals’ Right under HIPAA to Access their Health Information If you pay a copying fee, that payment goes to the copying fee. Nothing else.
A second federal law reinforces this. The 21st Century Cures Act, enacted in 2016, prohibits “information blocking,” meaning any practice likely to interfere with the access, exchange, or use of electronic health information unless a recognized exception applies.3ASTP. Information Blocking Refusing to release records over an unpaid bill does not fit any of the recognized exceptions, and providers who do so face civil penalties of up to $1 million per violation, enforced by the HHS Office of Inspector General.4HHS Office of Inspector General. Information Blocking
What a Provider Can Charge You For
Access is protected, but production of copies is not free. A provider can charge a reasonable, cost-based fee that covers certain labor for copying, the supplies used (paper or a USB drive, for example), and postage if you want the records mailed. Search and retrieval time is not a permitted charge.5HHS.gov. How Can Covered Entities Calculate the Limited Fee That Can Be Charged to Individuals to Provide Them with a Copy of Their PHI
For electronic copies of records already stored electronically, the provider can instead choose a flat fee of no more than $6.50 that covers all labor, supplies, and postage combined.5HHS.gov. How Can Covered Entities Calculate the Limited Fee That Can Be Charged to Individuals to Provide Them with a Copy of Their PHI
These fee limits still apply when you ask the provider to send records to a third party, such as another doctor. As long as you are the one making the request, the same limits govern the charge. The exception is when the third party independently contacts the provider with its own authorization; that is treated as a disclosure rather than your right of access, and the fee limits do not apply.6HHS.gov. When Do the HIPAA Privacy Rule Limitations on Fees Apply Practical point: if you need records at a new doctor, request them yourself.
The Patient Portal Is Free
Under rules implementing the 21st Century Cures Act, providers that use certified electronic health record systems must give you free, timely electronic access to your health information.3ASTP. Information Blocking The information blocking rules specifically prohibit charging fees as a condition of accessing your own electronic health information through a portal.7healthit.gov. Information Blocking Exceptions This has been the law since April 2021. If you just want to view or download your clinical notes, lab results, medication list, or referral information, the portal is usually the fastest route and it costs nothing. Formal record requests and their fees come in when you need certified copies, a specific format, or something the portal doesn’t carry.
Legitimate Reasons a Provider Can Deny Access
HIPAA does recognize a handful of narrow situations in which a provider can refuse to release records. None of them involve billing. If you receive a denial, check it against this list:
- Psychotherapy notes kept separate from the main medical record. Your regular therapy records, diagnoses, and treatment plans are not covered by this exception.8HHS.gov. HIPAA Privacy Rule and Sharing Information Related to Mental Health
- Information compiled specifically in anticipation of a lawsuit or other legal action.2HHS.gov. Individuals’ Right under HIPAA to Access their Health Information
- Certain inmate records where a correctional institution finds a copy would jeopardize safety or security. The inmate still keeps the right to inspect the records in person.2HHS.gov. Individuals’ Right under HIPAA to Access their Health Information
- Research data from a clinical trial you agreed at enrollment to have suspended until the study ends.2HHS.gov. Individuals’ Right under HIPAA to Access their Health Information
- Information obtained from a confidential source where release would likely reveal that source.2HHS.gov. Individuals’ Right under HIPAA to Access their Health Information
A provider that denies your request has to point to a specific exception and explain how it applies. Vague refusals, or refusals that reference your balance, are not legitimate denials under any of these provisions.
What to Do When a Provider Refuses
Start in writing. Send a request that references the HIPAA Privacy Rule and your right of access, and ask to speak with the office’s privacy officer or the person responsible for medical records. Every covered entity is required to designate a contact for privacy complaints and to describe the complaint process in its notice of privacy practices.9HHS.gov. Summary of the HIPAA Privacy Rule A written request that names the law often resolves the issue on its own, because staff who refuse records over a bill are usually following an internal collections policy rather than a legal one.
If the provider still won’t release the records, file a complaint with the HHS Office for Civil Rights through the online complaint portal at ocrportal.hhs.gov.10HHS.gov. Office for Civil Rights Complaint Portal The complaint must be filed within 180 days of when you learned about the violation, though OCR can extend the deadline for good cause.11HHS.gov. How to File a Health Information Privacy or Security Complaint
One limit to be aware of: HIPAA itself does not give you the right to sue your provider in court over a records denial. Enforcement sits with HHS. A number of states, however, have their own medical records access laws that do allow patients to bring a civil suit for damages, attorney’s fees, or both. If you are in one of those states, state law may give you leverage federal law does not.
Why a Written Reference to the Law Usually Works
OCR has made enforcement of the right of access a stated priority and has settled dozens of cases against practices that dragged their feet on producing records. Recent penalties in individual cases have reached $70,000 to $100,000 against a single provider for failure to hand over records, and HIPAA penalties for uncorrected willful neglect can exceed $2 million per violation.
Layered on top of that, the 21st Century Cures Act’s information blocking prohibition carries its own penalties of up to $1 million per violation, enforced separately by the HHS Office of Inspector General.4HHS Office of Inspector General. Information Blocking A provider that refuses to release electronic health records over a billing dispute risks exposure under both HIPAA and the Cures Act, which means two federal agencies could investigate the same conduct. Pointing that out in your written request tends to move records faster than anything else.