Attorney Request for Medical Records Fees: What’s Allowed Under HIPAA and State Law

HIPAA Fee Limitations for Patient Requests

What counts as a Cost-Based Fee

• Reasonable Labor Charges limited to copying and creating the deliverable (e.g., downloading, compiling, and transmitting records to the patient).
• Postage and Supplies Fees for paper, envelopes, and removable media (such as a CD or USB) when used to fulfill the request.
• Preparation of a summary or explanation only if the patient agrees in advance.

Charges you cannot include

• No search, retrieval, or verification fees; locating records and reviewing for responsiveness are not billable under Patient Access Rights.
• No general overhead (system maintenance, licensing, storage subscriptions) beyond the incremental costs of making the copy.
• No per-page charges for electronic copies of electronic information; per-page pricing is reserved for actual paper reproduction.

How to calculate and document

You may calculate the cost-based fee using actual costs for the specific request, a documented average-cost schedule, or a reasonable flat fee for electronic copies when it reflects your true costs. Provide an itemized estimate on request, keep written methodologies on file, and never condition access on payment of unrelated balances.

State Law Overrides HIPAA for Patient Requests

When state law controls

State law “overrides” HIPAA only when it is more protective of the individual. If a state prohibits charging patients for certain copies, sets lower caps than your internal schedule, or mandates free records for specific purposes, you must follow that stricter standard.

When HIPAA preempts

If a state allows search-and-retrieval fees, certification charges, or higher per-page rates for patient copies, those provisions are displaced for Patient Access Rights. In direct patient requests, HIPAA’s cost-based ceiling is the controlling rule, and any less stringent state fee schedule cannot expand what you may charge.

Practical steps

• Compare HIPAA’s cost-based rule with your state’s requirements and adopt the stricter rule for patients.
• Publish a concise fee notice that references both HIPAA and applicable State Fee Schedules to show Legal Compliance for Medical Records.
• Train staff to flag patient requests so state-only add-ons are not mistakenly applied.

Fees for Third-Party Requests Initiated by Attorneys

Attorney direct requests with patient authorization

When an attorney (or records vendor) sends a request directly to the provider using a valid HIPAA authorization, it is a Third-Party Medical Record Request—not a patient access request. In this pathway, HIPAA’s patient cost-based limits generally do not apply; you may follow state law rules for fees.

Billable elements under state law

• Permissible per-page amounts for paper copies, image sets, or film, if your state allows.
• Reasonable Labor Charges for searching, retrieval, and certification when authorized by statute or regulation.
• Postage and Supplies Fees and optional rush handling if expressly allowed by state law.

Common pitfalls to avoid

• Misclassifying an attorney’s direct request as a patient request and undercharging—or the reverse and overcharging.
• Using per-page charges for purely electronic exports where state rules require cost-based pricing.
• Failing to provide an estimate and itemization; most states expect transparent calculations under their State Fee Schedules.

State-Specific Fee Schedules

How schedules work

Many states publish maximum charges for medical record copies. Schedules often distinguish patients from third parties, paper from electronic formats, and set separate amounts for certification or retrieval. These caps typically apply to providers, hospitals, and sometimes business associates that handle copying.

Staying current

State Fee Schedules can be updated annually or by regulation. Monitor updates from your legislature or health department, and memorialize the effective date you are applying. When a schedule conflicts with HIPAA for patient requests, use the stricter rule to maintain Legal Compliance for Medical Records.

Documentation and workflow

• Maintain the current schedule in your policy manual with a clear effective date and citation.
• Create a calculator that applies the schedule and displays the specific line items—labor, per-page, postage, and media.
• Audit invoices quarterly to confirm that actual costs do not exceed state caps or HIPAA’s cost-based standard where it governs.

HIPAA Fee Limitations for Third-Party Requests

Patient-directed third-party copies

If the individual exercises Patient Access Rights and directs you to send the copy to a designated person (for example, an attorney), treat the request as a patient access request. In that situation, apply HIPAA’s Cost-Based Fee rules to the copy you transmit to the designee.

Format and delivery considerations

• Provide records in the form and format requested if readily producible; otherwise offer a readable alternative the individual accepts.
• Postage and Supplies Fees apply only when you mail or use physical media; avoid tacking on administrative charges unrelated to making the copy.
• Use secure electronic delivery when feasible to reduce costs and turnaround time.

Clear estimates and invoicing

Label the invoice “patient access request” when applicable, itemize only allowable components, and separate any optional services (such as notarized affidavits) that fall outside HIPAA’s fee limits. This clarity reduces disputes on Third-Party Medical Record Requests.

Clarification on Attorney Requests

Quick decision path

• Was the request made by the patient (or their personal representative) to you? Apply HIPAA’s patient Cost-Based Fee limits.
• Did the patient direct you to send the copy to an attorney as part of that access request? Continue using the patient cost-based limits for that transmission.
• Did an attorney request records directly with a HIPAA authorization? Follow state law; state schedules and any authorized retrieval or certification fees may apply.

Best practices

• Use standardized intake forms that clearly label the pathway (patient access vs. third-party authorization).
• Provide pre-billing estimates with a plain-English breakdown of labor, supplies, and postage.
• Document your fee methodology and retain proof of compliance for audits and disputes.
• When in doubt, apply the stricter standard and seek clarification from counsel on nuanced state requirements.

Key takeaways

• Patient Access Rights trigger HIPAA’s cost-based ceiling; no search-and-retrieval fees.
• Attorney-initiated, third-party requests are generally governed by State Fee Schedules, not HIPAA’s patient cap.
• State law can be stricter than HIPAA; the stricter rule controls for patient requests.
• Clear classification, itemization, and documentation are essential for Legal Compliance for Medical Records.

FAQs.

What fees can attorneys be charged for medical record requests?

When an attorney makes a direct, third-party request supported by a valid authorization, you may charge the amounts permitted by your state—often including per-page, retrieval, certification, and Postage and Supplies Fees where authorized. If the patient instead invokes their access right and directs you to send the copy to the attorney, apply HIPAA’s Cost-Based Fee limits to that copy.

Does HIPAA limit fees for attorney-initiated record requests?

Generally, no. HIPAA’s fee limitations were built for patient access requests. For attorney-initiated requests made directly to the provider, your charges are governed primarily by state law and any applicable State Fee Schedules. Always distinguish whether the request is patient-initiated or attorney-initiated.

How do state laws affect medical record fees for attorneys?

State laws set the ceiling for Third-Party Medical Record Requests, defining allowable per-page rates, retrieval charges, and certification fees. These schedules vary widely and change over time. Apply them to attorney-initiated requests, but remember that stricter state rules also control patient requests when they provide greater protection than HIPAA.

Are attorneys entitled to a free copy of medical records under any law?

Typically, no. Some states require free or reduced-cost copies in narrow contexts (for example, for continuity of care or specific public-benefit claims), but attorneys are generally subject to the applicable state fee schedule. If the patient uses their HIPAA access right, only the Cost-Based Fee components may be charged for that copy.