Health care providers often are unaware of federal laws that regulate the process by which they charge patients for copies of medical records. Many providers incorrectly assume that only the law of the state in which the provider practices is relevant. In an effort to clarify this area, the Office of Civil Rights (OCR), the agency charged with HIPAA enforcement, issued guidance addressing when and how a provider can charge patients for copies of their medical records. HIPAA itself restricts the fees a provider can charge for medical records. As HIPAA is a federal law, it essentially pre-empts state laws on this issue. In practice, this means that HIPAA actually controls the process of charging for medical records in the event it is more restrictive than relevant state law.

An example of where HIPAA is more restrictive can be found in Illinois law. Illinois allows a provider, regardless of its costs, to charge a flat handling fee (currently $27.33 for 2017) plus a per-page fee for copies of medical records. Except as noted below, HIPAA does not allow a provider to charge a flat handling fee. Instead, a provider is permitted to charge just the actual cost of providing the records. These “costs” include only the following:

1. Labor for copying the protected health information (PHI) requested by the individual, whether in paper or electronic form (this does not include labor time to retrieve the record);
2. Supplies for creating the paper copy or electronic media (e.g., CD or USB drive) if the individual requests that the electronic copy be provided on portable media;
3. Postage, when the individual requests that the copy, or the summary or explanation, be mailed; and
4. Preparation of an explanation or summary of the PHI, if agreed to by the individual

Accordingly, to the extent an Illinois-based provider’s policy is to charge a patient $27.33 plus the per-page fee, and the actual costs of providing that record as allowed by HIPAA does not equal that amount, the provider is in violation of HIPAA regardless of the fact that the provider otherwise is in compliance with Illinois law. However, if the provider practiced in a state that required a provider to provide copies of medical records without charge, the law of that state would be deemed more restrictive than HIPAA, and therefore, the provider would be prohibited from charging any fee.

In lieu of calculating the “actual” cost, HIPAA does allow a provider to establish a fee schedule for “average” cost. The OCR has indicated that a state’s per-page fee for medical records may be deemed the average cost for providing records, as long as it generally reflects the reasonable cost to the provider. Accordingly, a provider likely can charge the per-page fee (but not the handling fee) established by Illinois law, as long as the per-page fee reasonably reflects the amount of the HIPAA-allowed costs to the provider. This “average” cost option only is allowed with respect to paper-based documents when the patient requests a paper copy of the record or asks that the paper-based documents be scanned into an electronic format. The OCR has said that a state’s per-page fee is not generally acceptable when providing copies of electronic-based records, because such fees likely do not take into account the reasonable cost of records in that format.

For electronic-based records, a provider has the option to charge for the actual cost of providing the record (based on the costs allowed by HIPAA) or charging a flat-fee of $6.50 in lieu of calculating the actual cost. This does not mean that a provider only can charge $6.50. If a provider wants to charge more, they must document that the cost of providing the record exceeded $6.50. For example, if the reasonable actual cost of providing electronic records to the patient is $13.50, the provider can charge that amount, but would need to document how they calculated the $13.50. If the provider does not want to go to the effort to make these calculations, then they should not charge more than $6.50 for electronic-based records.

Apart from what providers can charge for medical records, there are other factors a provider must consider when implementing a medical records policy to be compliant with state and federal laws, including: written authorizations, time period to respond to requests, and types of records that must be disclosed.