45 C.F.R. § 164.524

Section 164.524(c)(4) permits only reasonable, cost-based fees for patient access to records, limited to copying, postage, and preparation of a requested summary; retrieval and handling charges are not permissible.

(2003) · filed 2003-12-18(c)(4)

HIPAA sets some limits on the fees that an individual may be charged for access to the individual's own health records. It allows covered entities to impose a reasonable, cost-based fee, provided that the fee includes only the cost of copying, postage, and preparation of any summary (if a summary is requested by the patient). 45 C.F.R. § 164.524 (c)(4). HHS has indicated that the cost of retrieving or handling information in response to a patient request for records was deliberately excluded from the list of permissible charges. See 65 Fed. Reg. 82461, 82557 (December 28, 2000). It thus appears that there is a conflict between the Maryland law and HIPAA with respect to the charges that may be assessed against a patient who requests a copy of the patient's own records. The Maryland law allows a provider to charge an adjusted retrieval and handling charge of $15 or more; HIPAA, as clarified by the HHS commentary, does not. The Maryland provision is preempted by the HIPAA regulations, insofar as it applies to patient requests.

Section 164.524(c)(4) requires health care providers responding to a patient's request for medical records to impose reasonable copying costs.

In re: Thom. Barrett v. · filed 2007-06-08(c)(4)

see also 45 C.F.R. § 164.524(c)(4) (requiring health care providers to impose “reasonable” copying costs in response to patient’s request for medical records). We agree with ECMC that the copying costs of medical records are reasonable costs that a debtor may bear in order to substantiate his claim of undue hardship.

Section 164.524(c)(4) requires a covered entity's fee for patient-record copies to be reasonable and cost-based, with copying charges limited to supplies and labor.

Colorado Consumer Health Initiative v. Colorado Board of Health · filed 2010-06-10(c)(4)

As stated, HIPAA regulations mandate that covered health care entities may only charge a "reasonable, cost-based fee" for providing copies of patient health records, and the fee may only include the cost of "copying, including the cost of supplies for and labor of copying." 45 CER. § 164.524(c)(4).

Section 164.524(c)(4) limits a covered entity to a reasonable, cost-based fee for an individual's copy of protected health information, and the fee-based protection does not apply when the request is made by the individual's law firm rather than the individual.

Bugarin v. ChartOne, Inc. · filed 2006-01-27(c)(4)

The law firm of Mann ... is not an “individual” who is the subject of protected health information. Thus, Mann ... is not entitled to the cost-based fees required by 45 Code of Federal Regulations part 164.524(c)(4) (2005) and, for this reason, the demurrer to appellant’s complaint was properly sustained.

Section 164.524(a) governs an individual’s access to protected health information about that individual and limits that access in certain circumstances.

Larry L. Findley, Jr. v. Findley · filed 2006-08-16(a)

The basis of Sister Depwe’s objection to producing the subpoenaed records is 45 C.F.R. § 164.524. This provision governs an individual’s access to “protected health information about the individual.” 45 C.F.R. § 164.524(a) (emphasis added). By its clear terms, § 164.524 cannot serve as the basis for Sister Depwe’s refusal to produce anyone’s records other than Billie’s.

Section 164.524(a) requires covered health care providers to let individuals inspect and obtain copies of their health records, subject to narrow exceptions; HIPAA does not regulate fees for records provided to third parties.

Espinoza v. GOLD CROSS SERVICES, INC. · filed 2010-06-10(a)

With a few narrowly defined exceptions, HIPAA mandates that individuals be allowed to view and obtain copies of their health care records from their health care provider. ... HIPAA does not regulate the fee a health care provider may charge for providing medical records to a third party.

Section 164.524(c)(4) is one of the regulation’s four actual numbered subparts and does not include the additional fifth portal-related cost language attributed to it.

Cofield v. Va. State Bar Ex Rel. Second Dist. Comm. · filed 2019-05-30(c)(4)

The panel explained in a memorandum order that it unanimously found under the clear and convincing evidentiary standard that the manner Respondent presented the language from the HHS website in her pleadings was intentional and constituted knowingly false statements of the content of 45 C.F.R. § 164.524(c)(4), in that she presented that language as a sequentially numbered subpart of the C.F.R. along with the four actual numbered subparts of the C.F.R. and cited to the C.F.R. but made no citation or reference to the HHS website—all with knowledge that the C.F.R. did not contain that language or a fifth subpart and that the HHS website was the source of that language—in violation of [Rule 3.3(a)(1)]. ... We agree with the memorandum order of the three-judge panel and affirm.

Section 164.524 gives an individual a right to inspect and obtain a copy of their protected health information in a designated record set while it is maintained there.

Klein v. Aicher · filed 2020-07-21

HIPAA gives “an individual . . . a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set[.]” 45 C.F.R. § 164.524.

Section 164.524 protects an individual's ability to inspect and obtain copies of their own protected health information.

Ganaway v. Goidman · filed 2020-09-01

The HIPAA Qualified Protective Order does not prohibit Ganaway’s ability to inspect and obtain copies of his own protected health information, see 45 C.F.R. § 164.524 and 740 ILCS 110/4(a)(2), or limit his ability to share his own protected health information.

Section 164.524(a)(1)(i) gives an individual access to protected health information in a designated record set but excludes psychotherapy notes, so a court may not require disclosure of records that could include those notes.

Doe v. Walsh · filed 2023-01-05(a)(1)(i)

Although not expressly incorporated into section 1711-B, section 164.524 of the CFR includes several exceptions to an individual’s general right of access. Relevant here is section 164.524(a)(1)(i), which provides that “an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set . . . except for . . . [p]sychotherapy notes.” ... It could be interpreted to include information that meets the definition of psychotherapy notes, which, as discussed, Walsh does not have an absolute right to access under federal law. ... The order must do so, however, without requiring Walsh to produce all his mental health records.

The reduced, reasonable, cost-based fee applies only when the patient or a qualifying personal representative requests the records; an attorney acting under the patient's authorization is not the “individual.”

Webb v. Smart Document Solutions, LLC · filed 2007-08-27(c)(4), (a)(1)

Although nothing in the regulations prevents a law firm from drafting or mailing the request for records on behalf of its clients, or from directing that the records be sent to its office, we hold nonetheless that the HIPAA regulations require the reduced rate only when the individual himself requests the records.

Section 164.524 gives patients a right to access their health information from providers, but that access right is distinct from court-mediated discovery and generally does not determine what data is discoverable.

Burnette v. Nockels · filed 2025-12-18(a)

The HIPAA right of access serves purposes having nothing to do with resolving litigation. Its goal is to make sure that patients have “easy access to their health information,” which “empowers them to be more in control of decisions regarding their health and well-being.” ... The regulation does not anticipate that the right of access will be enforced through court-mediated discovery procedures. ... Whether the right of access encompasses a particular data set has no bearing on whether it is within the general scope of discovery. ... At most, the existence of a right of access might inform the court’s assessment of the burden a particular discovery request would impose on a party. Otherwise, the right of access generally has no impact on discovery, and discovery disputes involving medical records and audit data should be resolved by reference to the ordinary rules governing pretrial discovery, not the HIPAA right of access.

Section 164.524(a) gives patients a right to access their own protected health information.

Collins · filed 2026-04-20(a)

HIPAA also provides a right of access for patients. See 45 C.F.R. §164.524(a).

Section 164.524(a)(1) excludes psychotherapy notes from an individual's own right of access, but it does not bar their production in litigation under a court order or subpoena when the request is made by someone other than the patient.

Evenson v. Hartford Life & Annuity Insurance · filed 2007-09-28(a)(1)

Interpretation of the plain meaning of section 164.524 hinges on who is an “individual.” ... Under the plain meaning of the statute, section 164.524 does not support the psychotherapist’s argument because the request for her notes is not being made by the person who is the subject of the protected health information.

Section 164.524(a)(1)(i) gives an individual access to protected health information but excludes psychotherapy notes, so a parent generally has no HIPAA access right to an unemancipated child’s psychotherapy notes.

Loyning v. Neisha Potter and Fern Ridge Counseling · filed 2024-08-01(a)(1)(i)

Thus, a parent does not, under the above-cited HIPAA regulations, have a right to access his or her child’s psychotherapy notes.

Section 164.524(a)(1) gives an individual access to protected health information but excludes information compiled in reasonable anticipation of litigation; the court held that this provision does not displace more stringent state-law standards governing that exception.

Merryfield v. Kansas Social & Rehabilitation Services · filed 2010-07-30(a)(1)

Further, K.S.A. 2009 Supp. 60-226(b)(4), which is part of our Kansas Code of Civil Procedure, provides standards for evaluating the discoverability of documents purportedly prepared in anticipation of litigation. HIPAA, more particularly 45 C.F.R. § 164.524(a)(1), provides no such standard. Under these circumstances, HIPAA, which provides no standards or implementation protocol for evaluating claims that records were prepared in anticipation of litigation, does not control over state law on the issue of access to documents claimed to have been prepared in anticipation of litigation.

Section 164.524(c)'s access rights to medical records do not give the individual a superior right of possession in those records, either before or after requesting copies.

Nick N.Feizy v. State · filed 2015-04-30(c)

Further still, as set forth above, the rights of disclosure and access in HIPPA do not serve to create a superior right of possession in Appellant to the medical records either before or after he requested copies of the documents.

Section 164.524 gives an individual the right to inspect and obtain a copy of the individual's medical records.

(PC) O'Brien v. Said · filed 2020-08-07

Plaintiff has the legal right to inspect and obtain a copy of his medical records. 45 C.F.R. § 164.524; Cal. Health & Safety Code § 1231.10.

Section 164.524(b)(2)(i) requires a covered entity to grant or deny an individual's medical-record access request within 30 days, while (b)(2)(ii) permits one 30-day extension only with written reasons and an estimated production date.

Montanez v. 178 Lowell St. Operating Co. · filed 2019-07-31(b)(2)(i), (b)(2)(ii)

Title 45 C.F.R. § 164.524(b)(2)(i) (2014) requires a covered entity -– and the defendant does not suggest the nursing home is not covered -– to grant, or deny with written reasons, a request by any individual for access to medical records it maintains about the individual "no later than 30 days after receipt of the request." In failing to provide complete records during that time, and in providing them only after the plaintiff filed a lawsuit several months after the deadline expired, the defendant did neither. Title 45 C.F.R. § 164.524(b)(2)(ii) (2014) allows a covered entity to get a single thirty-day extension, but only if it gives the patient a written statement containing the reason for the delay and an estimated production date, which was not done here. Even if the defendant here had provided the plaintiff with the requisite statement for the delay, its response still would have been about two months late.

Section 164.524(c)(4) limits fees for copies of protected health information to reasonable, cost-based charges when the request is made directly by the individual or the individual's personal representative, not merely by the individual's attorney.

Stewart v. Moncla Marine Operations L L C · filed 2019-08-28(c)(4)

Thus, in order for the regulation’s fee restrictions to apply, the individual, or an individual’s personal representative – not merely the individual’s attorney – must directly request the protected health information. ... Because the medical records at issue were subpoenaed from the provider by Plaintiff's attorney, the provider is not restricted by the provisions of 45 CFR 164.524 (c)(4) and may charge a reasonable copying charge and handling charge in accordance with Federal Rule of Civil Procedure 45(d)(1) and La. R.S. 40:1165.1.

Section 164.524 requires covered entities to provide PHI in the form or format requested and to honor an individual's direction to send it to a designated third party, but its reasonable, cost-based Patient Rate applies only to PHI requested by and for the individual, not PHI directed to a third party; the copying-labor component excludes pre-copying search, retrieval, collection, and preparation work.

Ciox Health, LLC v. Hargan · filed 2020-01-27(c)(2)(i), (c)(3)(ii), (c)(4), (c)(4)(i)

The regulation merely states that “[i]f the individual requests a copy of the [PHI] . . . the covered entity may impose a reasonable, cost-based fee.” 45 C.F.R. § 164.524(c)(4). The regulation is silent as to whether the reasonable, cost-based fee applies only when providing PHI to the individual requestor or includes requests to send PHI to third parties. ... Thus, when HHS adopted the Patient Rate, it expressly limited it to PHI requested by, and for, the individual requester; the Rate did not apply to PHI destined for third parties. ... The Rule itself is vague as to the specifics, providing only that the Patient Rate includes “[l]abor for copying the protected health information requested by the individual, whether in paper or electronic form.” 45 C.F.R. § 164.524(c)(4)(i). ... But the agency’s word soup does not alter what the Privacy Rule allows, which is recovery of the costs of “[l]abor for copying [PHI],” as distinct from the costs incurred from pre-copying activities. 45 C.F.R. § 164.524(c)(4)(i).

Section 164.524(b)(2)(i) requires a covered entity to provide requested access to PHI or a written denial within 30 days, regardless of payment; subsection (c)(4) separately governs fees for copies.

Cross v. Ciox Health, LLC · filed 2020-02-03(b)(2)(i), (c)(4)

Moreover, plaintiffs’ assertion that they were “required” to pay the full amount charged in defendant’s bills in order to obtain their medical records is a conclusion of law that is contrary to HIPAA regulations, which indeed requires a covered entity, such as defendant, to act on an individual’s request for access to PHI within 30 days without regard to payment. See 45 C.F.R. § 164.524(b)(2); see also 45 C.F.R. § 164.524(c)(4) (providing separate rules for imposition of fees for copies of PHI). Specifically, under the timely action rule, the covered entity must “provide the access requested,” or “provide the individual with a written denial” within 30 days of receipt of the request. 45 C.F.R. § 164.524(b)(2)(i). Here, there is no factual allegation permitting an inference that defendant did not or would not comply with this provision.

Section 164.524(c)(2)(ii) provides for access to records in electronic form when they are maintained electronically, but it does not expressly give a patient a right to metadata associated with the records.

Tree Top v. United States · filed 2021-09-15(c)(2)(ii)

The cited regulation does not explicitly provide that a patient has a right to the metadata associated with her medical records, although there is provision for accessing the records in electronic form if that is how they are kept. 45 C.F.R. § 164.524(c)(2)(ii).

Section 164.524(a)(1) gives an individual a right to inspect and obtain a copy of protected health information about the individual in a designated record set, requiring the covered entity to provide the records in response to a proper request.

Hudson-Swoope v. MRO Corporation · filed 2025-03-25(a)(1)

Under federal law, MRO must provide medical records in response to a proper request. Indeed, MRO is legally obligated to do so because Plaintiff has “a right of access to inspect and obtain a copy of protected health information” from it. 45 C.F.R. § 164.524(a)(1).

Section 164.524(b)(2) generally requires access to medical records within 30 days, unless the information is not maintained or accessible on site.

Association of American Physicians & Surgeons, Inc. v. United States Department of Health & Human Services · filed 2002-06-17(b)(2)

Moreover, as defendants point out, the Privacy Rule generally guarantees patient access to medical records and imposes a deadline of 30 days by which access must be provided, unless the information is not maintained or accessible on site.

Section 164.524(c)(3)(i) does not authorize a covered entity to limit an individual's access to one hour to review medical records.

Espinosa v. Filson · filed 2020-04-17(c)(3)(i)

Further, nothing in 45 C.F.R. § 164.524(c)(3)(i) authorizes a “covered ... entity” to limit an individual’s access to one hour to review their medical records.

Section 164.524(a) gives patients a right to access and disclose their own medical records to third parties.

Mannon v. Arbor · filed 2025-05-16(a)

In fact, HIPAA grants patients the right to access and disclose their records to third parties. 45 C.F.R. § 164.524(a), (c)(3). Thus, HIPAA does not justify a protective order precluding Mannon from disclosing his own medical records to Congress or some other entity.

A claim based on Section 164.524 cannot be privately enforced through 42 U.S.C. § 1983.

Burton v. Chambers-Smith · filed 2021-09-30

In his Amended Complaint, Plaintiff alleges two Section 1983 claims. First, Plaintiff asserts Defendants violated his right to have a full and complete copy of his medical records granted to him by the Health Insurance Portability & Accountability Act (“HIPAA”), 45 C.F.R. § 164.524. ... First, Defendant correctly asserts Plaintiff’s HIPAA claim must be dismissed because no such cause of action exists. “Federal ‘[c]ourts have repeatedly held that HIPAA does not create a private right’ and ‘cannot be privately enforced ... via § 1983.’” ... Therefore, Plaintiff’s first claim must be dismissed.

Section 164.524(a)(1)'s individual right to access protected health information is not privately enforceable through 42 U.S.C. § 1983.

Greenwood Leflore Hospital and Nita McClain v. Clover J. Boykin · filed 2025-01-23(a)(1)

Boykin cannot use § 1983 to enforce 45 C.F.R. § 164.524, a provision of HIPAA, because HIPAA does not provide Boykin with private enforceable rights.

Section 164.524(a)(1) gives individuals a right to inspect and obtain copies of their protected health information in a designated record set, but that right cannot be enforced through 42 U.S.C. § 1983.

Ayarzagoitia v. Tahir · filed 2025-03-18(a)(1)

Under HIPAA, “an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set.” 45 C.F.R. § 164.524(a)(1). However, “HIPAA itself provides no private right of action.” Webb v. Smart Document Solutions, LLC, 499 F.3d 1079, 1081 (9th Cir. 2007), and the right to access health records under 45 C.F.R. § 164.524 is not enforceable through section 1983, see Kittel v. City of Oxnard, No. CV 17-6709-MWF (GJSx), 2019 WL 1578369, at *3 (C.D. Cal. Feb. 5, 2019), aff’d sub nom. Kittel v. Advantage Physical Therapy, 843 F. App’x 53 (9th Cir. 2021). Plaintiff therefore fails to state a claim in the Second Amended Complaint, and it will be dismissed.

The exclusion of psychotherapy notes from an individual's general right to access protected health information does not make those notes immune from production in a court proceeding when a court order and patient authorization permit disclosure.

Kalinoski v. Evans · filed 2005-07-12(a)(1)(i)

However, it does not follow from the fact that a patient is not allowed to inspect her own notes under section 164.524(a)(l)(i) that a court order plus a ... patient authorization are insufficient to permit the production of notes in a court proceeding.