HITECH-Compliant Fee Limits: Cost-Based Charges for Medical Record Copies

HITECH Act Fee Limitations

Under the HIPAA Privacy Rule, you may charge only a reasonable, cost-based fee when an individual (or personal representative) requests copies of their records. This cost-based fee structure is limited to labor costs for copying, allowable copying supplies, and postage charges if mailing, plus an optional summary if the individual agrees in advance. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2024/may-a-covered-entity-charge-individuals-a-fee/index.html?utm_source=openai))

HITECH adds that when providing electronic copies, fees must be constrained to labor costs for responding to the request. At the same time, after the January 23, 2020 Ciox decision, HIPAA’s Right of Access fee caps apply only to an individual’s own request—not when the individual asks you to transmit records to a third party. Treat third‑party transmissions separately from direct patient access for fee purposes. ([law.cornell.edu](https://www.law.cornell.edu/uscode/text/42/17935?utm_source=openai))

Permissible Charges Breakdown

What you may include

• Labor costs for copying the requested PHI (paper or electronic) after the records are identified and ready to copy (for example, creating PDFs, exporting ePHI, and sending). ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2025/what-labor-costs-may-a-covered-entity-include/index.html?utm_source=openai))
• Copying supplies, such as paper and toner, or electronic media fees like a CD or USB drive if the individual specifically requests receipt on that medium. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2024/may-a-covered-entity-charge-individuals-a-fee/index.html?utm_source=openai))
• Postage charges when the individual asks for mailed copies. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2024/may-a-covered-entity-charge-individuals-a-fee/index.html?utm_source=openai))
• Preparation of an explanation or summary, but only if the individual agrees in advance to receive it and to the fee. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2024/may-a-covered-entity-charge-individuals-a-fee/index.html?utm_source=openai))

Boundaries to observe

Only include costs directly tied to copying and delivering the requested format. Do not fold in overhead or general administrative expenses; limit “labor” strictly to the actions necessary to generate and send the copy. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2025/what-labor-costs-may-a-covered-entity-include/index.html?utm_source=openai))

Electronic Records Fee Policies

No per‑page pricing for ePHI

Per‑page fees are not reasonable for electronic copies of PHI maintained electronically. Use actual cost, an average‑cost schedule, or the optional flat fee described below—never a per‑page rate for ePHI. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2029/how-can-covered-entities-calculate-the-limited-fee/index.html?utm_source=openai))

Three lawful ways to calculate

• Actual cost: calculate labor, plus supplies and postage (if any), for each request.
• Average cost: publish a schedule based on average allowable labor for standard request types.
• Flat fee option: for electronic copies of PHI maintained electronically, you may charge a flat fee up to $6.50 inclusive of all labor, supplies, and postage; this is optional—not a universal cap. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2030/is-650-the-maximum-amount-that-can-be-charged/index.html?utm_source=openai))

Portal and API access

If you fulfill access using certified EHR “view, download, and transmit” functionality, you may not charge a fee, because there are no allowable labor or supply costs for enabling that mode of access. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2026/may-a-covered-health-care-provider-charge-a-fee-under-hipaa/index.html?utm_source=openai))

Transmissions to third parties

Post‑Ciox, HIPAA’s Right of Access fee limits do not apply when an individual asks you to transmit records to a third party. Price those requests under other applicable law or policy; do not assume the patient‑rate caps apply. ([hhs.gov](https://www.hhs.gov/hipaa/court-order-right-of-access/index.html?utm_source=openai))

State-Specific Fee Regulations

State fee mandates (for example, per‑page charges or search fees) cannot override HIPAA for an individual’s own access request. You must follow HIPAA’s permitted cost types and ensure the total is reasonable, even if state law authorizes higher or different fees. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2031/are-costs-authorized-by-state-fee-schedules-permitted/index.html?utm_source=openai))

However, state laws that are more protective of individuals—such as requiring a free first copy or capping fees below HIPAA’s allowance—are not preempted; you must honor the more favorable state requirement. For non‑access disclosures (e.g., requests under authorization to third parties), state fee schedules may still govern. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html?utm_source=openai))

Prohibited Charges Under HITECH

• Search and retrieval restrictions: you may not charge for searching, retrieving, or otherwise locating PHI—even if state law permits those fees. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2031/are-costs-authorized-by-state-fee-schedules-permitted/index.html?utm_source=openai))
• Verification, documentation, or record‑management overhead (system maintenance, data storage, infrastructure recoupment) cannot be included. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html?utm_source=openai))
• Per‑page fees for electronic copies of PHI maintained electronically are not reasonable. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2029/how-can-covered-entities-calculate-the-limited-fee/index.html?utm_source=openai))
• Fees for access provided via certified EHR view/download/transmit functionality are not permitted. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2026/may-a-covered-health-care-provider-charge-a-fee-under-hipaa/index.html?utm_source=openai))

Calculating Reasonable Fees

Step‑by‑step approach

1. Identify the request type and format (paper vs. electronic; delivery method).
2. Select a calculation method: actual cost, average cost schedule, or the flat fee up to $6.50 for electronic copies of ePHI. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2030/is-650-the-maximum-amount-that-can-be-charged/index.html?utm_source=openai))
3. Add only allowable elements: labor for copying, copying supplies, and postage (if mailing). Do not add search/retrieval or overhead. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2024/may-a-covered-entity-charge-individuals-a-fee/index.html?utm_source=openai))
4. Provide advance notice of fees, and on request, itemize labor, supplies, and postage; consider posting an estimated fee schedule to improve transparency. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2028/must-a-covered-entity-inform-individuals-in-advance/index.html?utm_source=openai))

Worked examples

• Electronic PDF via secure email: 7 minutes of copying labor at $24/hour = $2.80; no supplies; no postage. Total = $2.80. Alternatively, you could apply a documented average‑cost rate or the flat fee up to $6.50. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2030/is-650-the-maximum-amount-that-can-be-charged/index.html?utm_source=openai))
• Paper copies mailed: 15 minutes labor at $20/hour = $5.00; paper/toner at $0.12/page × 25 pages = $3.00; postage = $2.00. Total = $10.00. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2024/may-a-covered-entity-charge-individuals-a-fee/index.html?utm_source=openai))

Compliance Best Practices

• Publish and maintain a written fee policy reflecting allowable labor costs, copying supplies, postage charges, and electronic media fees; train staff to apply it consistently. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2028/must-a-covered-entity-inform-individuals-in-advance/index.html?utm_source=openai))
• Use certified EHR portal/API access when possible to provide records at no charge and to streamline fulfillment. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2026/may-a-covered-health-care-provider-charge-a-fee-under-hipaa/index.html?utm_source=openai))
• Avoid per‑page pricing for ePHI; rely on actual or average labor costs or the optional $6.50 flat fee for electronic copies of ePHI. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2029/how-can-covered-entities-calculate-the-limited-fee/index.html?utm_source=openai))
• Separate workflows: apply Right‑of‑Access fee limits to the individual’s own requests, and treat third‑party transmissions under the post‑Ciox framework. ([hhs.gov](https://www.hhs.gov/hipaa/court-order-right-of-access/index.html?utm_source=openai))
• Check state fee mandates and use the rule that gives the individual greater rights; do not charge search and retrieval, even if a state schedule lists it. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2031/are-costs-authorized-by-state-fee-schedules-permitted/index.html?utm_source=openai))

Bottom line: anchor your fees to copying labor, necessary supplies, and postage only; leverage electronic delivery to minimize costs; and align policies with both HIPAA/HITECH and any state rules that further limit what individuals can be charged. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2024/may-a-covered-entity-charge-individuals-a-fee/index.html?utm_source=openai))

FAQs

What fees are allowed under the HITECH Act for medical record copies?

You may charge a reasonable, cost-based fee that includes only labor for copying, copying supplies (e.g., paper, toner, or a CD/USB if requested), postage if mailed, and an optional summary if the individual agrees. Exclude search/retrieval and overhead. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2024/may-a-covered-entity-charge-individuals-a-fee/index.html?utm_source=openai))

How is the flat fee for electronic medical records determined?

If the request is for an electronic copy of PHI maintained electronically, you may choose an optional flat fee up to $6.50 per request, which must include all labor, supplies, and postage. It is an option—not a universal cap; you can instead use actual or average cost methods. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2030/is-650-the-maximum-amount-that-can-be-charged/index.html?utm_source=openai))

Are providers allowed to charge for search and retrieval of medical records?

No. Search and retrieval, verification, documentation, system maintenance, and similar activities are not chargeable to individuals under HIPAA’s Right of Access, even if state law authorizes such fees. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html?utm_source=openai))

How do state regulations affect HITECH fee limits?

For an individual’s access request, HIPAA preempts conflicting state fee mandates; follow HIPAA’s allowable cost types and ensure the fee is reasonable. If a state law gives greater rights (for example, a free first copy or lower caps), you must honor it. For third‑party requests outside the Right of Access, state fee schedules may still apply. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2031/are-costs-authorized-by-state-fee-schedules-permitted/index.html?utm_source=openai))