Under federal law, doctors can only charge a “reasonable, cost-based fee” for medical records, meaning the price has to reflect the actual direct cost of making your copy and nothing more. For electronic records already stored digitally, providers can charge a flat fee of up to $6.50 that covers everything. For paper copies, state per-page caps take over and typically run from about $0.25 to $2.00 per page, sometimes with a small handling or certification charge on top. What you pay comes down to the format you request, the state you live in, and how the provider calculates the fee.
What the Fee Is Allowed to Cover
HIPAA’s Privacy Rule lists exactly four costs a provider can build into your bill:
- Labor for copying the records, whether paper or electronic.
- Supplies, such as paper and toner for printouts or a CD or USB drive if you want your electronic file on physical media.
- Postage, but only if you ask the provider to mail your copy.
- Preparation of a summary, but only if you specifically ask for a summary instead of the full record and agree to the cost in advance.
That list is exhaustive. Anything outside of it cannot be added to your bill.1eCFR. 45 CFR 164.524 — Access of Individuals to Protected Health Information
The Three Ways Providers Calculate the Fee
HHS lets providers pick from three methods, and the method drives the price.
The actual cost method times how long a staff member spends creating and sending your copy, multiplies by a reasonable hourly wage, and adds any supply or postage costs. The average cost method uses a standard schedule the provider has developed based on typical requests. Under this method, a per-page rate is only allowed when the records exist on paper and you request paper copies, or when you ask for paper records to be scanned. Per-page charges are not permitted for electronic copies of records already stored electronically.
The third option is the flat fee of up to $6.50, and it is available only for electronic copies of records that are already maintained in electronic form. That $6.50 covers labor, supplies, and postage combined.2U.S. Department of Health & Human Services. How Can Covered Entities Calculate the Limited Fee
One point that trips people up: $6.50 is not a universal ceiling. It is a shortcut for providers who do not want to calculate actual or average costs for an electronic copy. A provider who calculates actual costs and lands above $6.50 can charge the higher amount, as long as everything on the bill falls inside the four permitted categories.3HHS.gov. Clarification of Permissible Fees for HIPAA Right of Access – Flat Rate Option of Up to $6.50 Is Not a Cap on All Fees for Copies of PHI
Charges Doctors Are Not Allowed to Add
The biggest prohibited charge is search and retrieval: the time spent locating, pulling, and reviewing your records before copying begins. That work can take longer than the copying itself, but it cannot be billed to you.
System-related costs are also off the table. Maintaining an electronic health record system, storing data, and running the underlying infrastructure are the provider’s cost of doing business. So is the labor for verifying your identity and confirming the right records are being released. Even if state law allows these charges in other contexts, HIPAA prohibits passing them on when you are exercising your right of access.4U.S. Department of Health & Human Services. May a Covered Entity Charge Individuals a Fee for Providing the Individuals With a Copy of Their PHI
How State Laws Change the Price
Almost every state has its own medical records fee statute, and that is where most of the pricing variation shows up. The patterns fall into a few groups.
Many states set a per-page cap for paper copies. Rates across the country run roughly from $0.25 to $2.00 per page. Tiered pricing is common: a state might allow a higher per-page rate for the first 25 or 50 pages and a lower rate after that. Some states also permit a one-time search, retrieval, certification, or handling fee on top of the per-page charge, which can range from a few dollars to more than $30 depending on the state. A smaller group of states has no statutory cap and applies a general “reasonable fee” standard closer to HIPAA’s.
When federal and state rules both apply, the provider has to follow whichever one gives you greater access. In practice that usually means the lower price. If your state guarantees one free copy, HIPAA does not override that; you still get the free copy.5HHS. A State Law Requires That a Health Care Provider Give Individuals One Free Copy of Their Medical Records
How Format Changes the Cost
The format you request has more effect on your bill than any other single factor.
Paper Copies
Paper is the most expensive route. Providers can charge for the labor to photocopy every page and for the paper and toner, and state per-page caps set the ceiling. For a large file — years of visit notes, labs, and imaging reports for a chronic condition — the totals climb quickly. A 200-page file in a state that allows $1.00 per page can hit $200 before postage.
Electronic Copies
Digital copies cost less because there is little in the way of supplies. If your provider uses the flat-fee method, the entire charge tops out at $6.50. If they calculate actual costs, the bill can include the labor to prepare and send the file plus the cost of any physical media you ask for, like a CD or USB drive. Per-page fees are not allowed for electronic copies of records stored electronically.2U.S. Department of Health & Human Services. How Can Covered Entities Calculate the Limited Fee
Patient Portal Access
If your provider uses a certified electronic health record system with a patient portal, you can view, download, and save records through the portal at no charge. HHS has taken the position that when a patient uses the portal’s built-in access features, there are no labor or supply costs to justify a fee, so the provider cannot charge one.6U.S. Department of Health & Human Services. Individuals’ Right Under HIPAA to Access Their Health Information
Third-Party Requests Are Priced Differently
The HIPAA fee limits apply when you request your own records. They also apply when you direct the provider to send your records to someone else on your behalf, like a new doctor or your attorney. In both cases, the provider has to stay within the four permitted cost categories.6U.S. Department of Health & Human Services. Individuals’ Right Under HIPAA to Access Their Health Information
The rules change when a third party requests your records on its own behalf, such as an insurance company or opposing counsel sending an authorization form directly to your provider. Because that request is not coming through you, the HIPAA fee limits do not apply, and the provider and requester can agree to fees governed by state law or contract instead. Those fees can be significantly higher.7U.S. Department of Health & Human Services. When Do the HIPAA Privacy Rule Limitations on Fees Apply
If you are working with an attorney and need records sent to their office, have the request written so that it comes from you directing your provider to send copies to a third party. That preserves the HIPAA fee protections. A request the attorney sends on its own puts you outside those protections.
Ask for the Fee Before Records Are Made
A provider has to tell you the approximate fee before fulfilling your request. When you get that number, it is fair to ask which calculation method they are using and to request an itemized breakdown. For an electronic copy of records already stored electronically, expect either the $6.50 flat fee or an itemized actual-cost figure. For paper, expect a per-page rate that matches your state’s cap and, in some states, a modest handling or retrieval fee.
What to Do If You Are Overcharged
Overcharging is one of the most common HIPAA access problems, and providers are not always aware they are doing it. Many offices use fee schedules built for third-party requests and mistakenly apply those rates when a patient asks for their own records.
Start by calling the billing or compliance office and asking for an itemized invoice. Compare each line to the four permitted categories: copying labor, supplies, postage, and summary preparation. Charges for search and retrieval, “processing,” system access, or per-page rates on electronic records are red flags. Point out that HIPAA limits fees to direct copying costs and ask the office to recalculate.
If the provider will not adjust the bill, you can file a complaint with the HHS Office for Civil Rights, which enforces HIPAA. The complaint has to be filed within 180 days of when you knew or should have known about the violation, though the Secretary of HHS can waive that deadline for good cause.8eCFR. 45 CFR 160.306 – Complaints to the Secretary
Complaints go through the OCR complaint portal on the HHS website. Include the provider’s name and contact information, the fee you were charged, and an explanation of why the charge exceeds HIPAA’s cost-based standard. Attach copies of any invoices or correspondence.9HHS.gov. Filing a Health Information Privacy Complaint
OCR can require corrective action, including refunds. Its Right of Access Initiative has produced dozens of enforcement actions, with penalties running from $15,000 settlements against smaller practices up to a $200,000 penalty against a major university health system.10HHS.gov. Resolution Agreements