Guide

Copy fees: the federal ceiling and the state schedules under it

Summary

A reasonable, cost-based fee — and often less, because your state's fee schedule can cap it below the federal limit. Under the HIPAA right of access, when a patient requests their own records you may charge only for the labor of copying, the supplies, and postage; you may not bill for search, retrieval, or storage. When a state sets a lower per-page rate or a stricter patient rate, that controls. A third-party request under a subpoena or authorization can follow different rules.

By Gale Editorial · Updated 2026-07-26. Every figure cited to a dated source. How we write.

What can I charge for copies of records?

A reasonable, cost-based fee — with your state's schedule often setting the real, lower ceiling. Under the right of access, a patient asking for their own records may be charged only a reasonable, cost-based fee 1, and the regulation at 45 CFR 164.524 defines what that fee may include 2. This is a state-varies question from the start: where your state caps copy fees lower, the state number controls, so you check both before you quote anything.

Start from the federal rule as the outer limit, then look down to your state, not up. The most expensive mistake here is charging the federal maximum in a state whose schedule is stricter.

The federal ceiling: reasonable and cost-based

The federal fee is cost-based, which sharply limits what goes into it. It may cover the labor of copying — paper or electronic — the cost of supplies such as paper or a USB drive, and postage if the patient asks for mail 1. It may not cover the time to search for or retrieve the record, to review it, or to store it; those are costs of doing business, not of copying 2. A per-page rate is allowed only if it reflects actual cost.

HHS also recognizes a flat fee for electronic copies of records maintained electronically, kept reasonable and cost-based 1. Whichever method you pick, be ready to explain how the number reflects real cost.

The patient rate versus a third-party request

Who is asking changes the ceiling. When the patient requests their own records under the access right, the cost-based patient rate applies. When an attorney, insurer, or court asks instead, that is a third-party disclosure — not a patient access request — and it can follow a state's separate fee schedule or the terms of the subpoena rather than the patient rate 3. A patient's personal representative stands in the patient's shoes and gets the patient rate 4; confirm their authority before releasing or pricing anything.

Watch the disguised access request: a patient sometimes directs you to send their own records to a third party. That is still the access right, and the patient rate still applies.

Your state fee schedule sits under the federal ceiling

Because copy fees are set by both HIPAA and state law, the number you can charge is the lower of the two. Many states publish a per-page schedule, sometimes with a search or certification charge that HIPAA does not allow for a patient's own access request. Where the two conflict for a patient's own records, the more protective rule governs, and a state schedule cannot push you above the federal cost-based ceiling 2. Re-check your state's schedule periodically.

This is the same layering you see across records rules: HIPAA sets a national floor and your state builds on it — the way HIPAA's six years covers policies and documentation while your state sets how long the clinical record itself must live, tied to your retention schedule. State fee numbers change, so treat any figure you learned years ago as stale until you confirm it.

Overcharging is enforced

Fees are not a quiet corner of HIPAA. OCR has run a Right of Access enforcement initiative and settled a long series of cases against practices, including small ones, for charging excessive fees or delaying or denying patients their own records 5. The pattern is ordinary: a flat 'per-page plus retrieval' charge a cost-based analysis would not support, or a request left unanswered. Pricing to the cost-based standard is the cheapest insurance available.

The cases rarely involve bad intent — they involve a default fee nobody revisited. Revisit yours, write down how you calculated it, and the risk mostly evaporates.

Timing, format, and what you cannot do

The fee rules travel with access-right duties that apply regardless of payment. Act on a request within 30 days, with one 30-day extension available, and provide records in the form and format the patient asks for when you can produce them that way 1. Withholding a patient's records because they owe money for past services is not permitted — an unpaid bill is not a lawful reason to deny access 1. Psychotherapy notes are excluded from the access right, though other rules still govern them.

Delay is its own violation, separate from any fee problem. If you need the extension, use it in writing before the first 30 days runs out, with the reason and the new date.

A copy-fee workflow for a practice of one

Set your fee once, to the cost-based standard, and the enforcement risk mostly disappears. Decide a defensible per-page or flat electronic rate, write down how you calculated it, and check it against your state schedule. Route every request by asking one question first — is this the patient exercising access, or a third party — because that answers both the fee and the paperwork. Keep the request, the fee basis, and the delivery date on file 5.

None of this changes how long you keep the record or how you dispose of it later — disposal still means shredding to the unreadable standard, on its own retention timeline. The fee decision and the destruction decision are separate, and both are measured by what you can document.

You generally cannot deny — and the narrow exceptions

The default is that a patient gets their records, so denial is the rare exception, not a tool for a fee dispute. The access right has only narrow grounds for denial, some of them reviewable by another professional, and an unpaid bill is never one of them 1. Guessing wrong here turns a fee question into an access-denial finding.

Psychotherapy notes sit outside the access right, and information compiled for a legal proceeding can be withheld, but these are specific carve-outs, not general discretion. When you do withhold, do it in writing, state the ground, and tell the patient how to seek review where that applies. A second, separate violation stacked on top of a fee problem is the avoidable kind.

Common questions

Only if the per-page amount reflects your actual, cost-based expense, and only up to any lower state cap. A flat 'per page plus retrieval' charge is exactly what OCR has penalized, because retrieval time is not a permitted cost for a patient's own access request. Calculate the rate, document how, and check it against your state schedule.

No. An unpaid balance for past services is not a lawful reason to deny a patient access to their records. The access right and the outstanding bill are separate matters. You may still pursue the balance through normal means, but the records request has to be fulfilled on its own timeline regardless of payment.

Both, and the more protective one wins. HIPAA sets a cost-based ceiling for a patient's own records; many states publish their own, sometimes lower, schedule. Where they differ for a patient access request, you charge the lower amount, and a state schedule can never push you above the federal cost-based limit. Re-check your state's numbers periodically.

That is usually a third-party request rather than a patient access request, so it can follow your state's separate fee schedule or the terms of the subpoena or authorization instead of the cost-based patient rate. Read the request carefully to confirm which lane it is in, because the paperwork and the pricing both turn on that.

Act within 30 days of the request, with one 30-day extension available if you notify the patient of the reason and the new date. Provide the records in the form and format requested when you can produce them that way. Delay is enforced as its own violation, separate from any fee problem.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

  1. 1.HHS Office for Civil Rights (2026). Individuals' Right under HIPAA to Access their Health Information. U.S. Department of Health and Human Services. linkThat under the right of access a patient may be charged only a reasonable, cost-based fee, with the 30-day timeline, form/format duty, and psychotherapy-note exclusion.
  2. 2.Office of the Federal Register (2026). 45 CFR Part 164 — Security and Privacy. eCFR. link ✓The 45 CFR 164.524 rule text defining what a records access fee may include.
  3. 3.HHS Office for Civil Rights (2026). Court Orders and Subpoenas. U.S. Department of Health and Human Services. linkThat a third-party request under a subpoena or authorization is not a patient access request and may follow different fee rules.
  4. 4.HHS Office for Civil Rights (2026). Personal Representatives. U.S. Department of Health and Human Services. linkThat a personal representative requesting records stands in the patient's shoes for the access right.
  5. 5.HHS Office for Civil Rights (2026). HIPAA Compliance and Enforcement. U.S. Department of Health and Human Services. linkThat OCR's Right of Access Initiative has penalized practices for excessive fees and for delaying or denying access.

https://www.gale.care/for-providers/hip-records-copy-fees · 5 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers

Findability, by specialty

How practices like yours get found in local search and AI answers — the honest playbook, per specialty.

SEO for private practices · SEO for AI search / answer engines (all verticals)