How Much to Charge for Medical Records Under HIPAA

Under HIPAA, a healthcare provider can charge you only a “reasonable, cost-based” fee for a copy of your own medical records, and that fee can cover just four things: the labor to copy the records, the supplies used, postage if you want them mailed, and the preparation of a summary if you agreed to one instead of the full record. For an electronic copy of records already stored electronically, the provider can skip the math and charge a flat fee of up to $6.50 that covers all of those combined. Anything beyond that narrow list, including search fees, retrieval charges, and identity verification, is not billable to you when you are requesting your own information. So the honest answer to how much providers can charge for medical records under HIPAA is: not much, and often nothing at all if you only want to look.

The Four Costs a Provider Can Pass On

The HIPAA Privacy Rule limits your records fee to the actual, cost-based expense of four items:¹

Labor for copying, meaning the staff time spent photocopying, scanning, or converting the records into the format you asked for.
Supplies, such as paper, toner, a CD, or a USB drive.
Postage, if you want the records mailed.
Preparation of a summary or explanation, but only if you agreed in advance to accept one instead of the full record.

That is the entire list. If a fee reflects anything else, it is not a valid HIPAA access charge, even when state law would otherwise permit it.

The $6.50 Flat Fee, and What It Actually Covers

Instead of calculating exact labor and supply costs, a provider can offer a flat fee of up to $6.50 for an electronic copy. That amount is meant to cover labor, supplies, and postage together, and it applies only when you ask for an electronic copy of records the provider already keeps electronically.¹

One point gets misread constantly: the $6.50 figure is not a universal cap on every records request. It is a shortcut for the electronic-to-electronic case. For paper copies, or when records need to be pulled from paper files or converted between formats, the provider has to calculate the actual reasonable cost, which could land higher or lower depending on volume.²

Charges HIPAA Prohibits

Some providers try to pass along costs that federal law explicitly forbids for patient access requests. These are the ones to watch for:¹

Search and retrieval fees for locating your records in the system.
Identity verification, which the provider must perform but cannot bill for.
System maintenance or infrastructure, meaning the cost of running electronic health record software or storing data.
Capital recoupment, meaning the cost of buying or upgrading the technology that holds your records.

If your invoice includes a line for “records retrieval,” “chart pull,” or “administrative processing” on a request you made for your own records, that charge likely violates federal law. The same fees may be lawful when a third party like an attorney or insurer is doing the asking, but not when the request is yours.

Inspection Is Free

If you only want to look at your records, the provider cannot charge you anything. HIPAA gives you the right to inspect your protected health information in person at no cost.³ If you need only a few pages, you can inspect the file first and then request copies of just what you need.

When State Law Lowers the Fee

HIPAA sets a floor, not a ceiling. Roughly half the states have their own medical records fee schedules, and some are tighter than HIPAA. Certain states set maximum per-page charges ranging from about $0.25 to more than $1.00 per page. Others use a flat fee for a first batch of pages and a lower per-page rate after that. A few allow search and retrieval fees for some requests and ban them for others.

The rule is simple: whichever law gives you the lower fee applies. If a provider quotes a per-page rate that looks steep, check your state’s health records statute; many state health departments and attorneys general publish the applicable schedule online.

Third-Party Requests Are Different

State fee schedules routinely distinguish between records you request for yourself and records an attorney, insurer, or employer requests on your behalf, even with your authorization. Those third-party requests fall outside HIPAA’s individual access provisions, so the cost-based limits above do not apply. Providers can charge higher rates under state law, often including per-page charges, search fees, and certification surcharges. If a lawyer is pulling your file, expect the bill to look nothing like a patient request.

Fee Waivers for Benefits Claims

Some states require providers to furnish one free electronic copy per year when records support a claim under Social Security, veterans’ benefits, or a similar government program. At the federal level, the Social Security Administration does not charge a search fee and waives copy costs under $25 when you request your own records from SSA.⁴ Before you pay, ask the provider whether a waiver applies to your situation.

How Long a Provider Can Take

A provider has to act on your request within 30 calendar days, meaning either deliver the records or send a written denial. One 30-day extension is allowed, but only if the provider tells you in writing about the delay and when to expect the records.³ Sixty days is the outer limit. Silence past that point is a federal violation.

If You Think You Were Overcharged

Start with the provider. A short written letter that cites the HIPAA access rule and identifies the specific improper charge often gets the fee reversed once billing staff realize the requester knows the law. If that fails, you can file a complaint with the Office for Civil Rights at the U.S. Department of Health and Human Services, which enforces the access rule and has pursued dozens of actions against providers who delayed, denied, or overcharged for records. The complaint has to be filed within 180 days of when you learned of the violation, though OCR can extend that deadline for good cause. You can file through the OCR Complaint Portal, by email at OCRComplaint@hhs.gov, or by mail.⁵

1
U.S. Department of Health & Human Services. Individuals’ Right under HIPAA to Access their Health Information
2
U.S. Department of Health & Human Services. $6.50 Flat Rate Option is Not a Cap on Fees
3
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
4
Social Security Administration. Code of Federal Regulations 401.95 – Fees
5
U.S. Department of Health & Human Services. How to File a Health Information Privacy or Security Complaint