Charging for Medical Records: When Can Healthcare Providers Charge?

Healthcare providers can charge for some medical record requests, but charging for medical records is not governed by one universal rule. A patient, another provider, an attorney, and a health plan can all request the same records under different fee requirements.

Before applying a fee, look at who requested the records, why they need them, and what law, contract, or program governs the request. Getting that classification wrong can mean charging a fee the request does not permit. It can also mean waiving a fee that could have been collected or invoicing a health plan for records its agreement requires without charge.

HIPAA can authorize the disclosure, while another rule, contract, or state law determines whether and how much you can charge.

What Should You Check Before Charging for Medical Records?

When charging for medical records, three questions should drive the decision.

1. Who Requested the Records?

Determine whether the request came from the patient, another healthcare provider, an attorney, an insurance company or health plan, or another third party.

2. Why Do They Need the Records?

Purpose can change the analysis. A provider requesting records for treatment is different from a health plan requesting records for risk adjustment.

3. What Governs the Request?

HIPAA, state medical record fee laws, provider agreements, health plan contracts, or program-specific requirements may control the fee.

Can You Charge for Medical Records by Request Type?

Request	Fee Starting Point	Check Before Charging
Patient accessing their own records	HIPAA allows a limited, reasonable cost-based fee	State law may further restrict the fee
Patient asks the provider to send records to a third party	The federal HIPAA patient access fee limit does not apply to that third-party transmission under current HHS guidance following Ciox	This does not itself create a right to charge. Check the request pathway and applicable state law
Provider requesting records for treatment	Do not assume the standard third-party fee applies	Purpose, applicable exchange rules, contracts, and state law
Attorney or law firm	The request may be billable	Request pathway and applicable state law
Insurance company or health plan	No single fee rule applies	Purpose, provider agreement, program requirements, and applicable law
Audit request	No single fee rule applies	Provider agreement, audit program, and applicable law

Classify the request before applying a fee schedule.

Can You Charge a Patient for Their Medical Records?

Yes. When a patient exercises the HIPAA right of access, a covered entity may charge a reasonable, cost-based fee under 45 CFR §164.524.

What Can a HIPAA Patient Access Fee Include?

HHS says the fee may include:

• Labor for copying the requested PHI
• Supplies used to create the copy or requested portable electronic media
• Postage when the patient requests mailing
• The cost of preparing a summary or explanation when the patient agrees to it in advance

A state copying maximum does not override HIPAA’s patient access calculation. HHS also confirms that more protective state law can require a lower fee or free copy.

What Cannot Be Included in a HIPAA Patient Access Fee?

HHS guidance on the right of access excludes costs such as searching for and retrieving PHI from the allowable patient access fee.

The fee covers permitted copying and delivery costs. When charging for medical records through the HIPAA right of access, a standard retrieval charge or state copying maximum should not be applied automatically.

How Can Providers Calculate a HIPAA Patient Access Fee?

A covered entity can calculate the actual allowable costs for a request. It can also use a schedule based on average allowable labor costs for standard requests.

For an electronic copy of PHI maintained electronically, a covered entity may instead use a flat fee of no more than $6.50. That amount includes applicable labor, supplies, and postage. The $6.50 amount is optional, not a universal maximum.

HHS also says per-page fees cannot be used for copies of PHI maintained electronically under this framework.

When Can Providers Not Charge a Patient for Medical Records?

Providers cannot charge an access fee when a patient only inspects the record. HHS also says patients can use their own resources to take notes or photographs during inspection without an access fee.

HHS has also said no fee may be charged when a provider fulfills a HIPAA access request through applicable certified EHR View, Download, and Transmit functionality. HHS explains that this method creates no allowable copying labor or supply cost.

More protective state laws may require free copies in other circumstances.

Does the HIPAA Patient Fee Limit Apply When Records Go to a Third Party?

Not always.

If a patient requests a copy for themselves, the HIPAA patient access fee limitation applies.

If the patient asks a covered entity to transmit the records to someone else, HHS says the §164.524(c)(4) fee limitation does not apply following Ciox Health v. Azar. See the HHS notice addressing the Ciox court order.

Ciox answers only whether the HIPAA patient access fee cap applies. State law, the request pathway, contracts, or other requirements may still determine whether a fee is permitted and how much can be charged.

A third party submitting its own request under an authorization or other authority may follow a different fee framework.

Can You Charge Another Healthcare Provider for Records Needed for Treatment?

A treatment-related request from another provider should not automatically follow the same fee rules as a commercial third-party request.

HIPAA defines treatment in 45 CFR §164.501 to include consultation between healthcare providers and referrals from one provider to another. 45 CFR §164.506 also permits disclosures for another provider’s treatment activities.

Fee treatment can still depend on exchange requirements, contracts, and state law. Federal information blocking rules can also affect fees involving access, exchange, or use of electronic health information for covered actors.

See our guide to information blocking in healthcare for the deeper requirements.

Can You Charge Attorneys and Law Firms for Medical Records?

Potentially. Legal requests can arrive through an authorization, subpoena, court process, or another pathway. Establish the basis for the request before applying a fee.

When charging for medical records requested by an attorney, state law often affects the allowable charge and may differ from the HIPAA patient access limitation. A permissible charge does not tell you whether the authorization, subpoena, or other legal process is sufficient for release.

Can You Charge Insurance Companies for Medical Records?

A health plan request can be billable, but the purpose and provider agreement matter.

HIPAA defines activities such as claims adjudication, risk adjustment, medical necessity review, utilization review, medical review, and some auditing as payment or healthcare operations.

Those rules can support disclosure. The fee may still depend on the provider agreement, program requirements, and applicable law.

Before invoicing, check why the plan requested the records and what obligation governs that request.

Can You Charge Insurance Companies for Medical Records Requested for Audits?

Sometimes. Charging for medical records requested for an audit starts with the provider agreement and the requirements of that specific audit.

In June 2026, Blue Cross Blue Shield of North Dakota told providers responding to its RADV and HHS medical records request that they had to submit the records to its audit vendors without charge.

In July 2026, Premera gave providers a different instruction for its RADV audits. Premera said it would reimburse copy cost fees up to the amount allowed under each provider’s contract.

Both are RADV requests, but their contracts produce different fee outcomes. The fee decision turns on the contract or program obligation governing that audit.

When an audit request arrives:

1. Identify the audit and its purpose.
2. Review the applicable provider or health plan agreement.
3. Check the audit program’s record production requirements.
4. Review applicable state and federal fee rules.
5. If the request is billable, determine the permissible amount.

Without that check, staff can send an invoice for records the contract requires at no charge. They can also miss reimbursement the contract permits.

How Much Can You Charge for Medical Records?

Once you determine that a request is billable, calculate the amount under the rules governing that request. HIPAA’s cost-based framework controls patient access requests.

Other requests may fall under state fee laws, contracts, or program requirements.

For state-specific limits, use our State-by-State Medical Record Copying Fees guide.

Determine billability first, then calculate the allowable amount.

Make Medical Records Request Workflows More Consistent

When staff have to classify and route different request types manually, mistakes create invoice corrections, rework, and repeated fee questions.

We help healthcare organizations route, fulfill, and track release of information requests across requestor types with less manual work.

If your team is sorting through multiple request types and fee workflows internally, schedule a workflow review to learn how ChartRequest can automate the release of information.

Frequently Asked Questions