Medical record requests from attorneys, insurance companies, and everyone in between can be challenging to keep up with. You are trying to balance patient care with operations and getting paid for treatment. At HIPAAtrek, we frequently get asked how clinics and hospitals can charge for certain records requests.

HHS issued clarification for permissible fees in May of last year: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/clarification-flat-rate-copy-fee/index.html

There is no maximum charge for copied medical records. The flat rate not to exceed $6.50 option was meant for organizations who did not wish to calculate the actual or average cost for the copies. There are three options for charging patients for copies to their health records:

  1. By calculating actual allowable costs to fulfill each request
  2. By using a schedule of costs based on average allowable labor costs to fulfill standard requests
  3. If patients are requesting electronic records, and the entity wishes not to calculate the actual or average cost, the organization can charge a flat rate of $6.50 Link to the guidance from HHS: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html#maximumflatfee

See link below for everything that can be included in the charge to patient who has requested access to their PHI.

https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html#newlyreleasedfaqs

In addition to federal regulations, most states have regulations regarding charging for medical records. These state regulations can become quite sticky. Theres are provisions in the federal law that supersedes the state laws:

“The fee may not include costs associated with verification; documentation; searching for and retrieving the PHI; maintaining systems; recouping capital for data access, storage, or infrastructure; or other costs not listed above even if such costs are authorized by State law.”

https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/

Here are some great websites that details the state permissible charges:

https://medicopy.net/who-we-are/blog/guide-of-state-statutes-for-copies-of-medical-records

https://nosscr.org/state-medical-records-payment-rates

As with all online resources, it is good practice to double check the guidance with the individual state’s website.

Happy HIPAA trekking!