Yes, it is legal for healthcare providers to charge you a fee when you request copies of your medical records. But the fee has limits. Federal law requires that charges be “reasonable and cost-based,” meaning providers can only recover the actual cost of producing your copies, not profit from the request. What you’ll pay depends on the format you request, your state’s laws, and the method your provider uses to calculate the fee.
What Federal Law Allows Providers to Charge
Under the HIPAA Privacy Rule, providers can charge a reasonable, cost-based fee when you (or someone you designate) request a copy of your health information. The key word is “cost-based.” Providers are allowed to recoup certain direct costs: the labor involved in copying the records, the supplies used (paper, USB drives, postage), and any costs to prepare a summary if you specifically request one instead of raw records.
What providers cannot fold into the fee is more telling. They cannot charge you for the time staff spends searching for and retrieving your records. They cannot charge you for maintaining their health information systems. And they cannot mark up the fee to generate revenue. The charge is strictly meant to cover the cost of fulfilling your specific request, nothing more.
The $6.50 Flat Fee Option
HHS offers providers a shortcut: instead of calculating their actual per-request costs, they can charge a flat fee of up to $6.50 for electronic copies of records that are already stored electronically. This option exists so smaller practices don’t have to build out an accounting process just to figure out what copying costs them.
A common misconception is that $6.50 is the legal maximum for all medical record requests. It isn’t. HHS has explicitly clarified that “$6.50 is not the maximum amount that can be charged for all individual requests.” Providers who calculate their actual or average costs may charge more than $6.50 if those costs legitimately exceed that amount. This is most likely with paper records, large files, or requests that involve mailing physical copies. Providers can choose whichever fee calculation method fits their circumstances, as long as it stays within HIPAA’s cost-based boundaries.
Electronic Records vs. Paper Records
The format matters. If your records are stored electronically and you request an electronic copy (sent by email, downloaded through a portal, or saved to a USB drive), the cost to the provider is minimal. That’s the scenario the $6.50 flat fee was designed for. The actual cost of emailing a PDF is close to zero, so many providers charge very little or nothing for electronic copies.
Paper records cost more to produce. Printing hundreds of pages, paying staff to operate the copier, and mailing a physical package all add real expenses. If your records exist only on paper, expect a higher per-page charge. Many states set specific per-page rates for paper copies, often in the range of $0.50 to $1.00 per page, though this varies widely.
State Laws Can Set Stricter Limits
HIPAA sets the federal floor for your rights, but many states have their own medical records fee schedules that may be more protective. Some states cap per-page charges at specific dollar amounts. Others set maximum totals for an entire records request. A few require the first copy to be free in certain circumstances, such as when you need records to apply for disability benefits.
When state law gives you more protection than HIPAA (lower fees, faster turnaround, broader access), the state law generally applies. This means two people requesting identical records in different states might pay very different amounts, and both charges could be legal. If you’ve been quoted a fee that seems high, checking your state’s health information laws is worth the effort. Your state attorney general’s office or health department typically publishes these limits online.
Sending Records to a Third Party
You have the right to direct your provider to send your records to a third party, like an attorney, another doctor, or an insurance company. When you make this request yourself, the same cost-based fee rules apply. The provider cannot charge you more just because the records are going to a lawyer’s office instead of your home.
However, when a third party requests your records independently (with proper authorization), some states allow providers to charge higher rates. This is why attorneys and insurance companies sometimes pay significantly more per page than individual patients do. If you’re working with a lawyer who needs your records, it may be cheaper to request the records yourself and then share them.
Providers Cannot Withhold Records Over Unpaid Bills
This is one of the most important protections and one of the most frequently violated. A provider cannot refuse to give you copies of your medical records because you owe money for treatment. HHS has stated this directly: even if you have an outstanding balance for healthcare services, that balance has no bearing on your right to access your records.
Providers also cannot apply your records fee payment to your outstanding medical bill and then claim you haven’t paid for the copies. If you pay the allowable copying fee, they must provide the records regardless of any other debt. If a provider refuses to release your records because of an unpaid bill, that’s a HIPAA violation you can report to the HHS Office for Civil Rights.
How Long Providers Have to Respond
Once you submit a request, federal law gives the provider 30 calendar days to act on it. If they can’t meet that deadline, they can take an additional 30 days, but only if they notify you in writing within the first 30 days explaining the reason for the delay and providing a specific completion date. The maximum total wait, then, is 60 days.
In practice, electronic records from a patient portal are often available immediately or within a few business days. Paper requests or records that need to be pulled from archives take longer. If your provider hasn’t responded after 30 days and hasn’t sent you a written explanation for the delay, they’re out of compliance.
Free Access Through Patient Portals
The 21st Century Cures Act added another layer of protection by targeting “information blocking,” which is any practice that interferes with your ability to access your electronic health information. Under these rules, providers using certified electronic health record systems must give you access to your records through a patient portal at no charge. This includes visit notes, lab results, medication lists, and other standard health data.
This free portal access is different from requesting a formal copy of your complete medical record. If you just need to review your recent lab work or check what your doctor noted at your last visit, the portal is your fastest and cheapest option. Formal records requests, with the associated fees, are typically necessary when you need a comprehensive file, imaging on disc, or records in a specific format for legal or insurance purposes.
What to Do If You’re Overcharged
If a provider quotes you a fee that seems excessive, you have a few practical options. First, ask for an itemized breakdown of the charge. Providers should be able to explain what costs they’re recovering. If the breakdown includes line items for “search and retrieval” or administrative overhead, those charges likely violate HIPAA’s cost-based standard.
Second, request your records in electronic format. Even if a provider initially quotes you a per-page paper rate, you can ask for an electronic copy instead, which should cost significantly less. Third, if a provider refuses to lower an unreasonable fee or won’t release your records at all, you can file a complaint with the HHS Office for Civil Rights. HHS has actively enforced patients’ right of access in recent years, settling multiple cases against providers who overcharged or delayed records requests.