Medical Record Fees and Response Timelines

When you request your medical records, you have a legal right to receive them — but providers are permitted to charge a fee for fulfilling certain types of requests. Understanding exactly what fees are allowed, when records must be provided at no charge, and what response timelines the law requires helps you navigate the process and pushes back appropriately if a provider’s charges or delays seem out of line.

The HIPAA cost-based fee standard

HIPAA’s Privacy Rule establishes that a covered entity can charge a fee for medical records — but only a reasonable, cost-based fee. The cost-based standard means fees can include only specific, permitted cost categories. Providers cannot simply charge whatever they like or use records fees as a revenue source.

The permitted categories under HHS guidance are:

• Labor costs for copying records in the requested format (scanning paper records to electronic format, printing, copying physical media)
• Supplies directly required for the requested format (paper, CD, USB drive, envelopes)
• Postage when records are mailed
• Preparing an explanation or summary of the records — only if the patient has requested a summary rather than the records themselves

The following cost categories are explicitly not permitted under the cost-based standard:

• Searching for and retrieving records
• Maintaining systems to store records
• Overhead and infrastructure
• Staff time spent reviewing records for what to include
• Any fee connected to an outstanding unpaid medical bill

If a provider quotes you a fee that includes retrieving records or overhead charges, you can ask for an itemized breakdown and challenge any prohibited line items.

When electronic records must be provided at no charge

HHS OCR has clarified that when a patient requests records in electronic format and those records are maintained electronically by the provider, the provider should charge no fee or only a minimal fee for electronic delivery. This guidance reinforces a key practical point: if your medical records exist in an electronic health records (EHR) system and you request an electronic copy, the provider should not charge you a significant fee for producing it.

Scenario	Fee permitted?
Download records directly from patient portal	Generally no charge (portal-based access)
Request electronic records be emailed or sent via health information exchange	Minimal or no charge per HHS OCR 2023 guidance
Request records on a CD or USB drive	Permitted to charge cost of media
Request paper copies	Permitted to charge per-page copy cost and labor
Request records be mailed (any format)	Permitted to charge postage
Request a medical records summary	Permitted to charge for summary preparation only

If your records are in a patient portal, logging in and downloading them yourself is the most direct path and should incur no charge. This is often faster than a formal records request as well.

Documents and terms you’ll see

When navigating fees and timelines for your medical records request, these terms appear in provider correspondence and HHS guidance:

• Right of access — the HIPAA provision establishing your right to your records; the fee standard applies within this framework; a provider cannot charge fees that effectively block your access
• Cost-based fee — the fee standard under HIPAA, limiting providers to only direct costs of fulfilling the request, not overhead or retrieval
• Designated record set — the scope of records subject to your right of access; understanding this helps you know whether a provider’s claim that certain records are excluded is legitimate
• Business associate — if records are held by a third party such as a billing company or health information exchange acting on behalf of your provider, HIPAA extends to that entity and the same fee and timeline rules apply

Response timelines in detail

The HIPAA timeline for responding to a records request is:

• Day 1: Your request is received by the provider
• Within 30 calendar days: Provider must provide access or send you a written denial with the reason and your appeal rights
• Extension: If the provider needs more time, they must send written notice before Day 30 explaining the reason and the expected completion date. Only one 30-day extension is allowed.
• Maximum timeline: 60 calendar days from receipt of request

These are calendar days, not business days. Weekends and holidays count. If a provider claims that a holiday or weekend is the reason for missing the 30-day mark, that reasoning does not hold under HIPAA.

The 30-day clock starts when the provider receives your request — not when you sent it. If you submitted by mail and there is no acknowledgment, follow up by phone or in person to confirm receipt and the start date.

State law and how it interacts with HIPAA

HIPAA establishes a federal floor — a minimum standard that applies everywhere. States can exceed this floor with laws that provide greater patient protections. Many do:

• Fee caps: Some states cap medical record fees at a specific per-page rate or set a maximum total charge, regardless of what the cost-based HIPAA standard would otherwise permit. If your state’s cap is lower than what HIPAA’s cost-based standard would allow, the state cap governs.
• Timeframe requirements: A small number of states impose shorter response timelines than HIPAA’s 30 days.
• Electronic records: Several states specify that electronic records sent electronically must be provided at no charge.
• Sensitive record categories: Many states provide additional restrictions on release of mental health records, substance use treatment records, reproductive health records, and HIV-related records. These restrictions limit how records are disclosed even within the normal access framework.

To find your state’s specific rules, contact your state health department, state medical board, or state attorney general’s consumer health division.

What to do if fees seem excessive or timelines are missed

If a provider charges a fee that seems higher than the cost-based standard permits, take these steps:

1. Request an itemized breakdown of the fee in writing.
2. Compare the line items against HIPAA’s permitted cost categories.
3. Dispute any prohibited items (retrieval fees, overhead, etc.) in writing.
4. If the provider refuses to reduce the fee, file a complaint with the HHS Office for Civil Rights (OCR).

If the provider has missed the 30-day deadline without sending a written extension notice:

1. Send a written follow-up to the records department noting the original submission date and the HIPAA deadline.
2. Escalate to the provider’s patient advocate, ombudsman, or administrative office.
3. If unresolved, file a complaint with HHS OCR. The agency has pursued enforcement actions specifically for Right of Access violations in recent years and treats missed deadlines seriously.

OCR complaints can be filed at hhs.gov/hipaa/filing-a-complaint. Complaints must be filed within 180 days of when you knew or should have known of the violation.

The HIPAA and your medical records guide covers the broader scope of your rights under HIPAA, including what records are covered, how to file a complaint, and what HIPAA does not cover.