Clarification of Permissible Fees for HIPAA Right of Access – Flat Rate Option of Up to $6.50 is Not a Cap on All Fees for Copies of PHI

Earlier this year, OCR released a fact sheet and two sets of Frequently Asked Questions (FAQs) to clarify aspects of individuals’ core right under HIPAA to access and obtain a copy of their health information.

Today, in response to questions received after release of the guidance, OCR provides further clarification about the amount that an individual may be charged for a copy of their protected health information (PHI).  Specifically, we clarify in a new FAQ that $6.50 is not the maximum amount that can be charged for all individual requests for a copy of PHI under the right of access. Rather, charging a flat fee not to exceed $6.50 is an option available to those entities that do not want to go through the process of calculating actual or average costs for requests for electronic copies of PHI maintained electronically as permitted by the Privacy Rule.  Entities may choose the fee calculation method that is most appropriate for their circumstances, within the boundaries of what is permissible under the Privacy Rule.

The new FAQ may be found at: New Clarification – Up to $6.50 Flat Rate Option. Additional information regarding permissible fees and other aspects of the individual right of access may be found at: