Not on how long the file is. Not on what it costs to send. On which box gets ticked on the request form — and the difference can be the whole fee.
Recently I tried to get records for one of my own patients. The hospital told me their records are handled by Datavant. I contacted Datavant and got a clear, polite, and entirely reasonable answer:
As a provider, requesting for treatment — free. They'd fax it; I'd pay my own fax costs, which is nothing.
As a third party — about $60 for roughly forty pages.
Same patient. Same records. Same forty pages, already sitting in an electronic system where sending them costs fractions of a cent. The only variable was which legal category the request fell into.
The records did eventually arrive, by fax. I think they processed it as a provider request — but I'm honestly not certain, and nobody told me. Which is its own small point: I'm a physician, I made the request myself, I was quoted both prices, and I still don't know which one I was charged under. If the person asking can't tell which category he landed in, a patient has no chance at all.
It bothered me enough to go find out why the categories exist, and the answer turns out to be specific and documented rather than vague corporate greed. It's worth knowing, because it tells you exactly how to ask.
This is the one almost nobody uses and it's the strongest right you have. The federal guidance is unusually blunt:
Where an individual requests access through the View, Download, and Transmit functionality of the provider's certified electronic health record technology, there are no labor costs and no costs for supplies, so a provider cannot charge an individual a fee.
Not "should charge less." Cannot charge.
If you ask for a copy outside the portal, a provider may charge a reasonable, cost-based fee — and the permitted components are narrow: labor for copying, supplies, postage if mailed, and labor for preparing a summary if you asked for one.
What they're not allowed to charge for is the part that costs the most:
And the guidance adds a phrase worth remembering: these are prohibited even if state law authorizes them. If you're quoted a "retrieval fee" or a "processing fee" on your own records, that is not a permitted charge.
Here's where the $60 comes from — and it comes from a court case.
This is the part that took me longest to understand, and it's the actual answer. These aren't three prices for one thing. They're three different legal pathways, and the fee rules attach to the pathway rather than to the effort.
Provider to provider, for treatment. HIPAA permits a provider to disclose your records to another provider for treatment without your authorization at all. That isn't your right of access — it's a permitted disclosure between two covered entities. There's no fee cap because there's no fee framework; it's simply one clinician sending another what they need to treat you. It's free by convention, because charging a colleague to help a patient is bad medicine, and because obstructing treatment exchange now carries regulatory risk of its own.
You requesting your own. That's the right of access, and that's the one with the cap.
A third party requesting under your signed authorization. That's a different regulation entirely — disclosure by authorization, not access — and there is no federal fee cap on it. State law may set one. Otherwise it's the market.
And that third category is where an entire industry lives. Release-of-information is a real business, and its customers are requesters with budgets and no alternative: law firms, insurers, disability carriers, life underwriters. The hospital outsources the work; the vendor earns from the people who can pay. The $60 isn't priced against the cost of sending forty pages. It's priced against what a law firm would pay for the same forty pages.
Each of those rules has a defensible reason on its own. The combined effect is that a service acting for a patient, to get that patient's records to that patient's own doctor, is priced as a commercial requester — for a purpose identical to the pathway that's free.
Under the 2013 and 2016 rules, a patient could direct their records to a third party — a lawyer, another doctor, a service acting for them — and the same fee cap applied. Records companies objected, and one of them sued.
In January 2020, a federal court in the District of Columbia agreed with them. It held that the HITECH Act's third-party directive applies to electronic health records, and that HHS had exceeded its statutory authority by extending it to records in any format. It further held that HHS's 2016 expansion of the Patient Rate was a legislative rule issued without the required notice and comment.
The result: the fee cap still applies when you request your own records, and does not apply when you direct them to a third party.
And I want to be fair about this, because the lazy version of this story is wrong. That wasn't a loophole or a trick. It was an administrative-law argument, and the court found the agency had genuinely overstepped — skipping notice and comment is a real defect, and agencies lose those cases because they should. The company was, on the law, probably right.
It's just that the consequence, five years on, is that a patient who asks a service to collect their records on their behalf pays commercial rates for a file that costs cents to transmit — while the identical request, made by that patient directly, is capped or free.
(Ciox was acquired by Datavant in 2021. So the company that quoted me $60 is the successor to the company that won the case setting that price. That is a matter of public record, not an accusation — but it is worth knowing who shaped the rule you're paying under.)
UploMD requests your records on your behalf, as you, with a signed authorization — the pathway that keeps your patient rights intact. Everything lands in one place you control, including your actual MRI and CT images, shareable with any doctor you choose.
Get started free How to request recordsThis article is general information, not legal advice. Records-access rights and permitted fees vary by state and by the legal basis of the request; if a fee seems wrong, raise it with the facility's privacy officer, your state health department, or the HHS Office for Civil Rights.
