Under HIPAA, the fee limits on medical records copies restrict a provider to charging only its actual cost of producing the copy: the labor of duplicating the records, the supplies used, and postage if you want them mailed. For electronic copies of records that already live in a digital system, the provider can skip the math and charge a flat fee of up to $6.50 covering all three. Anything beyond those categories, including search time, chart review, or system overhead, is not something you can be billed for.
What a Provider Can Charge For
Federal regulation at 45 CFR 164.524(c)(4) allows four specific charges when you request copies of your own records:1U.S. Department of Health and Human Services. May a Covered Entity Charge Individuals a Fee for Providing the Individuals With a Copy of Their PHI
- Labor for copying. This is the hands-on time staff spend scanning pages, printing files, burning a disc, or exporting an electronic file. The clock starts only after the responsive records have already been pulled together and are ready to duplicate.
- Supplies. Paper and toner for printed copies, or a CD or USB drive if you asked for your electronic copy on portable media.
- Postage. The actual mailing cost, only if you asked the provider to deliver the copies.
- Summary preparation labor. If you agreed in advance to accept a summary or explanation in place of the full record, the provider can bill for the time to prepare it, but only if you also agreed to the fee up front.
The labor category is where most billing fights start. Copying labor means physical duplication, nothing else. It does not cover the time it took anyone to find your chart or decide what belonged in the response.
What a Provider Cannot Charge For
The prohibited list is longer than the permitted one, and the Office for Civil Rights treats overcharging as an enforcement priority. Costs that cannot appear on your bill include:1U.S. Department of Health and Human Services. May a Covered Entity Charge Individuals a Fee for Providing the Individuals With a Copy of Their PHI
- Search and retrieval. Locating your chart, reviewing it to identify responsive information, and pulling files from on-site or off-site storage are costs the provider absorbs.
- Verification and compliance labor. Time spent confirming your identity, making sure the records belong to the right patient, and checking that the release complies with HIPAA is not billable to you.
- System and infrastructure. Hardware depreciation, software licenses, data storage, and system maintenance cannot be factored into your fee.
- Per-page charges on electronic copies. When you request digital records that are already stored electronically, a per-page fee has no connection to actual duplication cost and is not permitted.
State law does not override this. Even if your state authorizes higher fees or additional charge categories, the federal cost-based limit controls for a patient’s own access request.
The $6.50 Flat Fee and What It Actually Covers
Providers have three ways to set a fee. They can track the actual labor minutes, supplies, and postage for your individual request. They can develop a standard schedule based on the average cost of typical requests, adjusted downward when a request is simpler than average. Or, for electronic copies of records already maintained in electronic form, they can charge a flat fee of no more than $6.50 that covers all labor, supplies, and postage together.2U.S. Department of Health and Human Services. Is $6.50 the Maximum Amount That Can Be Charged to Provide Individuals With a Copy of Their PHI
The flat fee is a safe harbor for smaller practices that do not want to build cost-tracking systems for routine digital requests. It is not a universal cap on all medical records charges. A provider fulfilling a large paper-to-paper copying request can legitimately charge more than $6.50 using the actual or average cost method, as long as every dollar traces back to permissible expenses.3U.S. Department of Health and Human Services. Clarification of Permissible Fees for HIPAA Right of Access – Flat Rate Option of Up to $6.50 is Not a Cap on All Fees for Copies of PHI The reverse is also true: a provider that chooses the flat-fee route cannot then tack on postage, supply, or labor line items on top of the $6.50.
Under the average cost method, the fee schedule itself must be reasonable and cannot bake in prohibited costs like retrieval labor or overhead. If you ask for the schedule before you request the records, the provider should be able to share it.
Inspecting Records for Free
Fees only apply to copies. If you ask to look at your records in person, the provider has to arrange a convenient time and place at no cost.4U.S. Department of Health and Human Services. Can an Individual Be Charged a Fee if the Individual Requests Only to Inspect Her PHI at the Covered Entity While inspecting, you can take notes or photograph pages with your phone. Because you are doing the copying yourself with your own resources, the provider cannot charge for the visit. If you only need a few specific lab results or a current medication list, this route sidesteps the copying fee entirely.
Unpaid Medical Bills Do Not Block Access
A provider cannot withhold your records because you owe money for the underlying care. An unpaid hospital bill or outstanding copay is not a valid reason to deny a records request.5U.S. Department of Health and Human Services. Is a Health Care Provider Permitted to Deny an Individuals Request for Access The provider can still charge the reasonable copying fee tied to the request itself, but the outstanding balance for services is a separate matter and cannot be used as leverage.
When the Fee Limits Do Not Apply
The cost-based caps protect you when you request your own records for yourself. They do not necessarily apply when you direct the provider to send your records to a third party, such as an attorney or another healthcare provider. In 2020, a federal court ruling in Ciox Health, LLC v. Azar struck down the portion of HHS guidance that had extended the fee limits to third-party directed requests beyond what the underlying statute authorized.6U.S. Department of Health and Human Services. Important Notice Regarding Individuals Right of Access to Health Records
Practically, when you ask a provider to transmit a copy to someone else, the bill may exceed what HIPAA’s cost-based limits would otherwise allow. Your right to access your own records, and the fee limits on that access, remain fully intact. If you want to avoid a higher charge, one workaround is to request your own copy first at the capped fee, then forward it to the third party yourself.
If You Are Overcharged
If a provider bills you more than the law allows or refuses to release records without a valid reason, you can file a complaint with the Office for Civil Rights at HHS. Complaints must be filed within 180 days of when you became aware of the violation, though OCR can extend that window for good cause.7U.S. Department of Health and Human Services. How to File a Health Information Privacy or Security Complaint You can file online, by mail, or by email. The complaint needs to name the provider, describe what happened, and include your contact information. Retaliation for filing is prohibited.
OCR has run a Right of Access Initiative that has produced dozens of settlements. The federal civil penalty tiers, adjusted annually for inflation, apply to fee overcharges alongside other HIPAA violations:8Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
- No knowledge of the violation: $145 to $73,011 per violation, with a $2,190,294 annual cap.
- Reasonable cause and not willful neglect: $1,461 to $73,011 per violation, same annual cap.
- Willful neglect, corrected within 30 days: $14,602 to $73,011 per violation, same annual cap.
- Willful neglect, not corrected: $71,162 to $2,190,294 per violation, with the annual cap matching the per-violation maximum.
Most right-of-access settlements have landed in the $15,000 to $160,000 range. The amount depends on the size of the organization, how long the violation persisted, and whether the provider cooperated once OCR got involved. A single patient’s complaint can be enough to open an investigation.