It is not illegal to charge for medical records, but federal law tightly limits what a provider can put on the bill. Under HIPAA, the fee has to be cost-based and can only cover a narrow list of actual copying expenses. Retrieval charges, search fees, and administrative processing fees are not allowed, and many states cap the permitted costs even lower than HIPAA does.
What HIPAA Lets Providers Charge For
Under 45 CFR 164.524(c)(4), a provider can bill you a reasonable, cost-based fee that covers only four things:
- Labor for copying the records, whether printing pages or burning files to a disc, once the records have already been pulled together and are ready to duplicate.
- Supplies like paper, toner, or portable media such as a CD or USB drive if you asked for the electronic copy on physical media.
- Actual postage if you want the copy mailed.
- Labor to prepare a summary, but only if you asked for a summary instead of full records and agreed to the charge ahead of time.
That list is the whole list. Anything else on the invoice does not belong there.1eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
What Providers Cannot Charge For
HHS guidance is explicit about the costs that must stay off your bill. A provider cannot charge you for verifying your identity, searching for the records in the system, retrieving them from storage, reviewing your request, maintaining the electronic health record system, or recouping money spent on data infrastructure. Those charges are prohibited even if a state law would otherwise permit them.2U.S. Department of Health and Human Services. Individuals’ Right under HIPAA to Access their Health Information
So if you see line items labeled “retrieval fee,” “search fee,” or “administrative processing fee,” those charges likely violate federal rules. The only labor a provider can bill you for is the work done after your records have already been located and compiled.
The $6.50 Electronic Copy Benchmark
Instead of calculating actual costs for every request, providers can charge a flat fee of no more than $6.50 for an electronic copy of records that are maintained electronically. HHS created this shortcut so smaller practices do not have to track labor minutes and supplies on each request.3U.S. Department of Health and Human Services. $6.50 Flat Rate Option is Not a Cap on Fees
One important nuance: $6.50 is an optional calculation method, not a hard ceiling. A provider with genuinely high copying costs could charge more if the actual expenses are documented. In practice, though, few individual electronic requests should cost more than this, so the figure is a useful benchmark. If a provider quotes you significantly more and cannot explain the math, something is off.
State Laws That Cap Fees Further
Many states have their own medical records fee schedules that layer on top of the federal rules. State caps commonly set a per-page rate for paper copies, typically ranging from about $0.25 to $1.00 a page, and some limit the total bill or add a small handling charge. A few states waive fees entirely when the records support a Social Security disability claim or a public assistance application.
When state law and HIPAA conflict, the federal rule wins unless the state law gives patients more privacy protection or broader access rights. A state can set a lower fee cap than HIPAA, but it cannot authorize charges HIPAA prohibits, like billing for search and retrieval.4U.S. Department of Health and Human Services. Does the HIPAA Privacy Rule Preempt State Laws
Because these rules vary, check your state’s health department or attorney general website for the specific fee schedule where you live.
When Records Should Cost Nothing
HHS has stated that providers should provide records free of charge, and that waiving fees is “particularly vital” when a patient’s financial situation would make paying difficult or impossible. That is not a mandate to waive every fee, but it is a clear expectation, and a provider who refuses a low-income patient’s request solely over an unpaid fee may attract regulatory scrutiny.5U.S. Department of Health and Human Services. May a Covered Entity Charge Individuals a Fee for Providing the Individuals With a Copy of Their PHI
There is also a practical free path worth knowing. The 21st Century Cures Act requires that patients have electronic access to their health information at no cost through apps and patient portals. Health IT developers and health information networks that block this access can face civil penalties of up to $1 million per violation. Providers in certain Medicare and Medicaid programs face separate disincentives for information blocking.6Office of Inspector General. Information Blocking
What to Do If a Provider Overcharges
Start by asking for an itemized breakdown of the fee. Many billing disputes dissolve once the provider realizes you know what charges HIPAA actually permits. If the invoice includes line items for retrieval, search time, or system maintenance, point out that those costs are excluded under federal rules.
If the provider will not budge, file a complaint with the Office for Civil Rights at HHS. OCR accepts complaints about any HIPAA violation, including overcharging and late responses, and you can submit yours online, by mail, by fax, or by email.7U.S. Department of Health and Human Services. Filing a Health Information Privacy Complaint For violations of state-specific fee caps, your state’s health department, medical board, or attorney general’s office handles enforcement.
Penalties Providers Face
OCR launched its HIPAA Right of Access Initiative in 2019 and has since resolved dozens of enforcement actions against providers who failed to give patients timely, affordable access to their records. Settlements have ranged from $15,000 with small practices to a $200,000 penalty imposed on Oregon Health & Science University in early 2025 for failing to provide records on time.8U.S. Department of Health and Human Services. Resolution Agreements
The broader HIPAA penalty structure scales with culpability. For 2026, penalties start at $145 per violation when a provider genuinely did not know about the problem and climb to a maximum of $2,190,294 per violation for willful neglect that goes uncorrected. OCR has used every tier, and records access remains one of the agency’s active enforcement priorities. That leverage is what usually gets a padded bill corrected once you push back.