What Is the Price of a Health Record Under HIPAA?

Under HIPAA, a healthcare provider can charge only a reasonable, cost-based fee for a copy of your medical records. For an electronic copy of records already kept electronically, many providers use a flat $6.50 that covers labor, supplies, and postage combined. Paper copies and larger requests can cost more when the provider calculates actual or average costs, but the fee is limited to a short list of expenses, and search or retrieval time is not on that list.¹

What the Fee Can Cover

When you request your own records, HIPAA lets the provider pass along costs in only four categories:

Labor for copying the records once they’ve already been collected and are ready to reproduce.
Supplies used to make the copy — paper, toner, a CD, a USB drive, or similar media.
Postage, if you asked to have the records mailed.
Preparation of a summary or explanation, but only if you agreed in advance to receive a summary instead of the full records.

Anything outside those four buckets is not a permissible charge under federal law.²

What Providers Cannot Charge For

This is where most billing disputes begin. A provider cannot charge you for the time spent searching for, locating, retrieving, or reviewing your records. They cannot charge for separating responsive records from non-responsive ones, and they cannot charge for reviewing your access request itself. The only labor that counts toward the fee is the physical act of copying after everything has been gathered.²

If your invoice lists a line for “retrieval,” “search,” “processing,” or “record review,” that charge violates HIPAA. You are not required to pay it, and you can challenge it through a complaint to the Office for Civil Rights.

Three Ways the Fee Gets Calculated

HIPAA gives providers three methods for figuring your charge, and the one they choose determines your bill:

Actual costs. The provider adds up the real labor, supplies, and postage for your specific request.
Average cost schedule. The provider uses a pre-calculated average based on past requests instead of itemizing each one. Large hospital systems that handle high volumes of requests often work this way.
$6.50 flat fee. For electronic copies of records that are already stored electronically, a provider can charge a flat $6.50 covering all labor, supplies, and postage together.

The flat fee is the simplest option for both sides and the one most patients encounter for portal downloads and emailed PDFs.¹ It applies only when the records are already in an electronic system and you want them delivered electronically.

$6.50 Is Not a Universal Cap

HHS has specifically clarified that $6.50 is one available calculation method, not a hard ceiling on every request. A provider using the actual-cost or average-cost method could legitimately charge more for a large paper request, as long as the total reflects real copying labor, supplies, and postage.³ What can’t happen is a provider using the actual-cost method to slip prohibited items like retrieval time back into the total.

Records Sent to a Third Party: Fees Can Be Higher

The cost-based fee limit protects you when you request your own records for your own use. It works differently when you direct a provider to send your records to a third party such as an attorney, life insurance company, or disability reviewer. A federal court ruled in Ciox Health, LLC v. Azar that HIPAA’s reasonable cost-based fee limits apply only to personal access, not to third-party directed requests. After that decision, OCR acknowledged that the fee limitation at 45 CFR 164.524(c)(4) does not extend to records a patient directs to someone else.⁴

In practical terms, a provider (or its records-release vendor) can charge substantially more per page when the records go to your lawyer than when they come to you. If cost is a concern in a legal or insurance matter, one workaround is to request the records for yourself under the personal-access rate first, then forward them to the third party on your own.

State Laws Can Set Lower Limits

HIPAA is a federal floor. Many states have their own medical-records fee statutes that specify per-page rates for paper copies, and those rates vary considerably. Some state schedules set fees under $0.50 per page while others allow more than $1.00. Several states also cap retrieval fees or limit charges for reproducing X-rays. Where state law is more protective — that is, where it allows a lower fee — the stricter standard generally applies. If a bill looks high, checking your state’s specific fee schedule is worth the effort before you pay.

Free Access Through the Patient Portal

Providers charge a fee to produce a copy, not to let you look at records you already have access to. If your provider offers a patient portal and your records are viewable and downloadable there, you can typically read, download, and print them at no cost. The $6.50 flat fee, the actual-cost method, and the average-cost schedule all apply to requested copies, not to information you retrieve yourself through electronic access the provider has already made available.

If a Provider Charges You Too Much

Start with the itemized bill. Compare each line to the four permissible categories: copying labor, supplies, postage, and a summary you agreed to in advance. If you see a “retrieval,” “search,” “review,” or “processing” charge, that item is not allowed under HIPAA and you can ask the provider to remove it in writing. Cite 45 CFR 164.524(c)(4) if you want a specific reference.

If the provider won’t correct the charge, you can file a complaint with the Office for Civil Rights at HHS. The complaint must be filed within 180 days of when you became aware of the violation, though OCR can extend that deadline for good cause.⁵ You have three filing options:

Online through the OCR Complaint Portal at ocrportal.hhs.gov.
By mail to Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue S.W., Room 509F HHH Bldg., Washington, D.C. 20201.
By email to OCRComplaint@hhs.gov, keeping in mind that unencrypted email carries some risk of interception.

Your complaint should name the provider or health plan, describe what happened, and include supporting documentation: a copy of your original request, the provider’s response, and the itemized bill showing the disputed charges.⁵

Quick Reference

Electronic copy of electronic records: often $6.50 flat, covering labor, supplies, and postage together.
Paper copy or actual-cost calculation: limited to real copying labor, supplies, and postage; state per-page caps may apply.
Records sent to a third party at your direction: HIPAA’s fee cap does not apply, so charges can be higher.
Search, retrieval, review, and processing fees: not permitted for personal access requests.
Portal download of records already available to you: no fee.

1
U.S. Department of Health and Human Services. Individuals’ Right Under HIPAA to Access Their Health Information
2
HHS.gov. May a Covered Entity Charge Individuals a Fee for Providing the Individuals With a Copy of Their PHI
3
U.S. Department of Health and Human Services. $6.50 Flat Rate Option Is Not a Cap on Fees
4
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
5
U.S. Department of Health and Human Services. How to File a Health Information Privacy or Security Complaint