When your lawyer asks a hospital or clinic for your records, the bill is set by state law, not by HIPAA’s patient-friendly fee cap. An attorney request for medical records fees under HIPAA falls into the third-party category, which means the provider can charge per-page copying, a retrieval fee, certification, and postage under whatever schedule the state where the provider sits allows. Most firms advance those costs and take them back out of any settlement.
Why an Attorney Request Costs More Than a Patient Request
The same file can carry two very different price tags depending on whose name is on the request. If you ask for your own records, HIPAA’s Privacy Rule limits the provider to a “reasonable, cost-based fee” covering only the labor to copy, the supplies (paper, a USB drive), and postage. Search and retrieval time cannot be folded in.1HHS.gov. Individuals’ Right Under HIPAA to Access Their Health Information For electronic copies of records already stored electronically, the provider can instead charge a flat fee of no more than $6.50 per request.2HHS.gov. Is $6.50 the Maximum Amount That Can Be Charged
When your attorney sends the request on your behalf using your signed authorization, HIPAA treats it as a third-party request. The patient caps drop away, and the provider bills under the state fee schedule, which is almost always higher.1HHS.gov. Individuals’ Right Under HIPAA to Access Their Health Information A 2020 federal court decision, CIOX Health, LLC v. Azar, struck down an HHS rule that had tried to extend the lower patient rate to records sent at a patient’s direction to a third party. The old boundary was restored: the fee cap covers only records going to the patient.3Health Information Privacy. Important Notice Regarding Individuals’ Right of Access to Health Records
That closes a workaround some firms used to try. Having the client sign the request and asking the provider to send the file to the law firm no longer triggers the HIPAA cap. The provider can charge state-law rates regardless of whose signature is on the form.
What the Invoice Looks Like
State fee schedules differ, but the line items are consistent. Knowing what belongs on the invoice is how you catch an overcharge.
- Per-page copying fees are the largest charge on most invoices. Many states use a tiered structure, with a higher rate for the first batch of pages and lower rates as the page count grows. Rates across states run roughly $0.25 to $2.00 per page depending on the tier.
- Retrieval or search fees are a flat administrative charge for pulling the file. State caps run from about $1.00 to $25.00.
- Certification fees apply if the records need to be authenticated for court use, typically capped somewhere between $2.00 and $20.00.
- Postage and physical media (a CD or USB drive) are passed through at cost.
A short set of office visit notes, maybe 30 pages, tends to run $30 to $75. A full hospital chart from a serious injury, several hundred pages with imaging reports, can top $300. The controlling schedule is the one for the state where the provider is located, not where your attorney practices.
How the Records Get Requested
Before a lawsuit is filed, the usual route is a HIPAA authorization. You sign the form, the attorney sends it to the provider with a request letter, and the provider releases the records once the authorization checks out and the invoice is paid. An incomplete authorization is a common source of delay because the provider is entitled to refuse until it gets a valid one.
Once litigation is underway, the attorney can also use a subpoena. That route does not need your signature, but the provider has to receive either proof you were notified and did not object or a qualified protective order limiting how the records can be used. Subpoenas are common when the records belong to an opposing party or when a provider has ignored an authorization. Fees still follow the same state schedules.
One boundary worth flagging: psychotherapy notes are not covered by a standard medical records authorization. These are the therapist’s private session notes, separate from the treatment plan, diagnoses, and appointment dates in the regular chart. HIPAA requires a distinct authorization aimed specifically at psychotherapy notes.4HHS.gov. Does HIPAA Provide Extra Protections for Mental Health Information Compared With Other Health Information If your case touches mental health treatment, that second form should go out with the first, not after the provider flags the omission.
How Long the Provider Can Take
HIPAA gives the provider 30 calendar days from receipt of the request. One 30-day extension is allowed, but only if the provider notifies the requester in writing before the first 30 days run out, explaining the reason and giving a firm completion date.5HHS.gov. How Timely Must a Covered Entity Be in Responding to Individuals’ Requests for Access to Their PHI Sixty days is the outer limit.
In practice, many providers invoice up front and release the records after payment. Others send the invoice and the records together and expect payment on receipt. Either sequence is normal and reflects the provider’s internal billing policy.
When the Fee Looks Too High
Overcharges happen, sometimes from clerical error and sometimes because the billing department applied the wrong schedule. Start with a letter to the provider citing the state statute and its caps and asking for a corrected invoice. Most disputes end there, because no provider wants a regulatory complaint over a records bill.
If the provider will not adjust, the formal remedy is a complaint to the U.S. Department of Health and Human Services’ Office for Civil Rights through its online portal.6HHS.gov. Filing a Health Information Privacy Complaint OCR investigates access-related complaints, including excessive fees, and can require corrective action or impose civil monetary penalties. OCR has been active on access enforcement recently, with a $200,000 penalty against Oregon Health & Science University in March 2025 for failing to provide timely access to patient records.7HHS.gov. Resolution Agreements Most of those cases involved outright denial rather than fee disputes, but a provider that has heard of OCR tends to recalculate quickly.
Who Actually Pays
The firm writes the check, but the money is yours in the end. Medical record fees are case expenses, the same category as expert witness fees, court reporter charges, and filing fees. Under the professional conduct rules in most states, an attorney handling a contingency case can advance these costs and tie repayment to the outcome.8American Bar Association. Rule 1.8 Current Clients Specific Rules
How the costs get deducted from a settlement matters more than most clients expect. Two structures show up in fee agreements. In one, the attorney’s percentage comes off the gross settlement and costs are subtracted from what remains. In the other, costs come out first and the percentage is calculated on the smaller net figure. On a $12,000 settlement with $2,100 in costs and a one-third contingency, the two methods differ by about $700 in your pocket. The fee agreement should say which order applies, and the ordering is often negotiable before you sign.
The other clause to read closely is what happens if the case produces no recovery. A typical contingency agreement means no attorney fee if you lose. Advanced case expenses are a separate question. Some firms absorb them on a loss; others bill the client. The difference between “firm advances costs, repayment contingent on recovery” and “firm advances costs, client repays regardless of outcome” is one of the more consequential lines in the document, and it is the one to find before you sign.