GAO Reports Patients Still Pay Excessive Fees for Copies of Their Medical Records

The Government Accountability Office (GAO) recently conducted an audit which showed that patients still face a lot of challenges when it comes to getting copies of their health information. Healthcare providers and insurers are also not able to meet HIPAA requirements resulting to a breach of HIPAA rules in some cases.

The audit was a requirement by a 21st Century Cures Act in an effort to learn about patient access to medical records. Stakeholders, provider organizations, vendors, patient advocates, HHS and state officials from four states participated in the audit interviews. Kentucky, Ohio, Wisconsin and Rhode Island were chosen perhaps due to the range of fees that patients pay to get copies of their medical records.

The HIPAA protects the patients’ rights to get copies of their medical records. Patients may request for paper or digital health records, which must be processed in 30 days. In exchange for the requested copies, HIPAA-covered entities can charge the patients a reasonable fee.

There a number of reasons why patients want copies of their medical records:

  • to be more active in their self-care
  • to inform their new providers
  • to resolve disputes on insurance claims
  • to inform a third party such as a lawyer
  • for disability claims
  • for doctors to give a copy of their patient’s health records to another physician for second opinion

According to the result of the GAO audit, providers from state to state charged significantly different fees for different types of request. Some have established fees, formulas and limits.  Three states have per-page fees, and different rates for medical images like X-ray copies.

  • Ohio – has a per-page fee for third party requests
  • Rhode Island – has a maximum fee for providers  that utilize an EHR for patient requests
  • Kentucky – gives patients one free copy of their medical records and charges $1 per page for extra copies

The HIPAA requires providers to charge only a reasonable, cost-based fee for patient requests or patient-directed requests of their health records. This stipulation does not cover third party requests of health records copies. Providers could charge higher fees for such requests.


Simple Guidelines
Immediate PDF Download

Immediate Access

Privacy Policy

Unfortunately, many providers do not adhere to this particular HIPAA Rules. There are lots of examples in the report of GAO concerning the excessive fees charged to patients for the copies of their health records.

  • One patient paid $148 for one PDF of his medical records
  • Two patients paid over $500 for one copy of their medical records
  • One patient paid a retrieval fee to a release-of-information (ROI) vendor for a copy of her medical records, even if the HIPAA forbids it
  • Some paid annual subscription fees to get access to medical records
  • Some patients who visited their doctors a lot have accumulated many pages of medical records, which is prohibitively expensive when requesting a copy

As a result of the excessive fees associated with getting copies of health records, many patients have cancelled their requests. The GAO report showed that though the HIPAA has clear rules, many patients are still not able to exercise their rights on getting their health records copies.

About Liam Johnson
Liam Johnson has produced articles about HIPAA for several years. He has extensive experience in healthcare privacy and security. With a deep understanding of the complex legal and regulatory landscape surrounding patient data protection, Liam has dedicated his career to helping organizations navigate the intricacies of HIPAA compliance. Liam focusses on the challenges faced by healthcare providers, insurance companies, and business associates in complying with HIPAA regulations. Liam has been published in leading healthcare publications, including The HIPAA Journal. Liam was appointed Editor-in-Chief of The HIPAA Guide in 2023. Contact Liam via LinkedIn: