HIPAA Rules on Medical Records Fees: What You Can Be Charged and Your Rights

HIPAA Fee Structure

What “reasonable, cost-based fees” mean

Under HIPAA’s Right of Access, a provider may charge only reasonable, cost-based fees to give you a copy of your records. Fees can be calculated three ways: (1) actual allowable costs for your request, (2) a schedule based on average allowable labor costs, or (3) a flat fee for electronic copies of electronic records, capped at $6.50 per request. The $6.50 option is voluntary—not a universal cap—when a provider prefers not to calculate actual or average costs. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html))

Per‑page pricing is allowed only when your records are kept on paper and you ask for a paper copy (or for paper records to be scanned). Per‑page fees are not permitted for electronic copies of records maintained electronically. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html))

Permissible Charges

Costs providers may include

• Labor charges strictly for copying your protected health information (PHI)—creating and delivering the copy in the format you requested, once the records are identified and ready to copy. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2024/may-a-covered-entity-charge-individuals-a-fee/index.html))
• Copying supplies, such as paper, toner, or electronic media (e.g., a CD or USB drive) if you specifically ask for that medium. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2024/may-a-covered-entity-charge-individuals-a-fee/index.html))
• Postage fees, but only if you ask for the copy to be mailed. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2024/may-a-covered-entity-charge-individuals-a-fee/index.html))
• Preparing a summary or explanation of your PHI, but only if you agree to receive it and agree to the fee in advance. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2024/may-a-covered-entity-charge-individuals-a-fee/index.html))

These permissible items are the full extent of cost-based fees under HIPAA for individual access requests. Providers cannot pad charges beyond these categories. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2024/may-a-covered-entity-charge-individuals-a-fee/index.html))

Prohibited Charges

Costs providers may not include

• Search, retrieval, and review time (locating, segregating, or verifying records). These are not “copying” labor and cannot be passed to you—even if state law would otherwise allow it. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2024/may-a-covered-entity-charge-individuals-a-fee/index.html))
• System costs such as EHR maintenance, data storage, capital costs, or general compliance activities. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2024/may-a-covered-entity-charge-individuals-a-fee/index.html))
• Per‑page fees for electronic records maintained electronically (regardless of delivery format). ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html))

Electronic Records Fee

Electronic copies and the $6.50 flat-fee option

If your PHI is maintained electronically and you request an electronic copy, your provider may either calculate actual/average allowable costs or use the optional flat fee of up to $6.50 per request (inclusive of all labor, copying supplies, and postage). The $6.50 figure is a safe-harbor option; providers may charge more only if they can document higher actual or average allowable costs. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html))

Online patient portals

Providers cannot charge you to access, view, download, or transmit your information through certified online patient portals (the CEHRT “View, Download, and Transmit” functionality). Because there are no copying supplies or labor to enable portal access, fees are not permitted for this access route. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/right-to-access-and-research/index.html))

State Regulations

How HIPAA interacts with state fee caps

HIPAA sets a federal floor. If a state law authorizes higher or different charges than HIPAA allows, your provider still must follow HIPAA’s tighter limits and charge only reasonable, cost‑based fees. State-authorized fees that include retrieval time or other non‑HIPAA items are not permitted for individual access requests. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2031/are-costs-authorized-by-state-fee-schedules-permitted/index.html?utm_source=openai))

If your state provides stronger protections—such as state fee caps below HIPAA’s allowable amounts or a law granting one free copy—those more protective rules control, and the provider must honor them. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/right-to-access-and-research/index.html))

Third-Party Request Fees

Patient-directed vs. third-party-authorized requests

When you direct your provider in writing to send your PHI to a third party (for example, to a caregiver, app, or attorney), the same HIPAA fee limits for individual access apply—only reasonable, cost‑based fees for copying labor, copying supplies, and postage. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2033/when-do-the-hipaa-privacy-rule-limitations-on-fees/index.html?utm_source=openai))

By contrast, if a third party requests your records using a HIPAA authorization (instead of your HIPAA access request), the “patient rate” limits generally do not apply. In that authorization pathway, HIPAA does not cap what the requester may be charged, and state law or other rules may govern pricing. This difference is why a patient‑directed access request is often the most cost‑effective route. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2041/why-depend-on-the-individuals-right/index.html))

Fee Transparency

Advance notice and itemization

Your provider must tell you the approximate fee in advance and should avoid any surprise charges. HIPAA guidance also encourages posting an approximate fee schedule (for common request types) and, on request, providing an itemized breakdown of labor charges, copying supplies, and postage fees. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html))

Conclusion

In short, HIPAA allows only reasonable, cost‑based fees tied to copying—not retrieval—and bans per‑page pricing for electronic records. Electronic delivery can use the optional $6.50 flat fee, and access via online patient portals must be free. State fee caps that favor you still apply, and using a patient‑directed request ensures you benefit from HIPAA’s fee protections. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html))

FAQs.

What fees are permitted under HIPAA for medical records copies?

Only reasonable, cost‑based fees for: (1) labor to copy your PHI, (2) copying supplies (paper, toner, or requested media like a CD/USB), (3) postage if you ask for mailing, and (4) a summary/explanation if you agree to receive it and agree to the fee in advance. No other add‑ons are allowed. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2024/may-a-covered-entity-charge-individuals-a-fee/index.html))

Can providers charge for retrieving medical records?

No. Providers may not charge for search, retrieval, verification, or other non‑copying work—even if state law would otherwise allow it for other types of requests. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2024/may-a-covered-entity-charge-individuals-a-fee/index.html))

What is the maximum flat fee for electronic medical records?

For electronic copies of PHI maintained electronically, a provider may choose an optional flat fee up to $6.50 per request, which must include all labor, copying supplies, and postage. This is a safe‑harbor option—not a universal cap—so providers may instead calculate actual or average allowable costs. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html))

Are fees different for third-party record requests?

Yes. If you submit a HIPAA access request directing your provider to send your PHI to a third party, the same patient‑rate limits apply. But when a third party requests records using a HIPAA authorization, those access‑fee limits generally do not apply, and other laws may govern the charges. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2033/when-do-the-hipaa-privacy-rule-limitations-on-fees/index.html?utm_source=openai))