Healthcare providers in Arizona can charge a reasonable fee to reproduce your medical records, but state law requires free copies in five specific situations, and HIPAA puts a separate ceiling on what you can be charged for your own records. Medical records fees in Arizona are governed by A.R.S. 12-2295 on the state side and 45 CFR 164.524 on the federal side, and when the two rules conflict, the one that gives you more access wins.
What a Provider Can Charge in Arizona
A.R.S. 12-2295 lets any healthcare provider or contractor charge a reasonable fee for reproducing medical records or payment records. The statute does not set a specific dollar cap, so providers have some discretion, but the fee must be tied to the actual cost of reproduction rather than an arbitrary markup.1Arizona Legislature. Arizona Revised Statutes Title 12 Section 12-2295 – Charges
A provider can require payment up front before releasing the copies. The one exception is a transfer of records to another provider for continuity of care; in that case the provider cannot hold the records hostage over a billing dispute.1Arizona Legislature. Arizona Revised Statutes Title 12 Section 12-2295 – Charges
When Arizona Requires Records to Be Free
A.R.S. 12-2295(B) identifies five situations where a provider cannot charge for the pertinent information in your records.1Arizona Legislature. Arizona Revised Statutes Title 12 Section 12-2295 – Charges
- Records sent from one provider to another for your continuing care.
- Records you request for the purpose of obtaining further health care. You need to show that purpose when you make the request.
- Records requested by someone legally authorized to make healthcare decisions for you, when the request is tied to arranging that care.
- Records requested by the Arizona Medical Board, the Arizona Board of Osteopathic Examiners in Medicine and Surgery, or officers of the Department of Health Services or local health departments under A.R.S. 36-662.
- Records needed for an appeal of a denial of Social Security benefits. A legal representative requesting the records on your behalf must present a completed Appointment of Representative form (SSA-1696) before the provider has to waive the fee.
The Social Security exemption has a limit worth knowing. Additional requests in the same calendar year, or requests for records that were already provided free earlier that year, can be billed at the standard reasonable rate. However, a provider cannot charge you anything if the search turns up no records.
What HIPAA Lets a Provider Charge for Your Own Records
When you request your own records, HIPAA applies on top of state law. Under 45 CFR 164.524(c)(4), the fee must be reasonable and cost-based, and it can only cover four things:
- Labor for copying the records, starting from the point where the responsive records have already been identified and collected.
- Supplies such as paper, toner, or portable media like a CD or USB drive if you request one. A provider cannot force you to accept a USB drive; you have the right to receive records by email or mail instead.
- Postage, if you ask for the records to be mailed.
- Preparation of a summary or explanation, if you specifically ask for one and agree to the fee in advance.
Those four categories are the whole list. HHS has been clear that providers cannot charge you for searching, retrieving, locating, or reviewing the records, or for verifying your identity or maintaining their systems, even in states where the law would otherwise allow it.2U.S. Department of Health and Human Services. Individuals’ Right under HIPAA to Access their Health Information
The $6.50 Flat Fee for Electronic Copies
A provider that doesn’t want to calculate actual costs for an electronic copy of records already maintained electronically can charge a flat fee of up to $6.50 that covers all labor, supplies, and postage. This isn’t a universal cap, since a provider using the standard cost-based method may charge less, but it is a useful benchmark. If you are quoted significantly more than $6.50 for an electronic copy of your own records, ask how the fee was calculated.3U.S. Department of Health and Human Services. Is $6.50 the Maximum Amount That Can Be Charged to Provide Individuals With a Copy of Their PHI?
The flat-fee option is only available when you request your own records. Attorneys, record retrieval companies, and other third parties are not entitled to this pricing and will typically pay more.
Workers’ Compensation Records Have Their Own Caps
Workers’ compensation requests are the one Arizona context with specific per-page and hourly limits rather than the open-ended “reasonable fee” standard. Under Arizona Administrative Code R20-5-128, a provider responding to a request under A.R.S. 23-908(C) cannot charge more than $0.25 per page plus $10.00 per hour for associated clerical costs.4Legal Information Institute. Arizona Administrative Code R20-5-128 – Medical Information Reproduction Cost Limitation; Definition of Medical Information
These caps apply to all providers treating injured workers’ compensation claimants, including providers that outsource copying to third-party services. A provider cannot avoid the limit by routing requests through an outside records company that charges more.4Legal Information Institute. Arizona Administrative Code R20-5-128 – Medical Information Reproduction Cost Limitation; Definition of Medical Information
How State and Federal Rules Fit Together
Arizona providers answer to both sets of rules, and the more patient-friendly one controls. Under 45 CFR 160.203, HIPAA preempts a contrary state law unless the state law is more stringent, meaning it gives individuals greater rights of access.5eCFR. 45 CFR 160.203 – Preemption of State Law
So Arizona’s free-copy exemptions remain in force because they give you broader access than HIPAA alone requires. At the same time, HIPAA’s bar on charging you for search and retrieval applies even though Arizona’s statute does not address those costs. You get whichever rule is more protective in each situation.
If You’re Overcharged or Denied Access
If a provider charges more than the rules allow, refuses to release your records, or ignores your request, you can file a complaint with the Office for Civil Rights at the U.S. Department of Health and Human Services. OCR investigates HIPAA privacy, security, and breach notification complaints.
You have 180 days from the date you became aware of the problem to file, though OCR can extend that for good cause. Complaints can go through the OCR online portal, by email to OCRComplaint@hhs.gov, or by mail. Your complaint has to name the provider, describe what happened, and include your contact information; OCR does not investigate anonymous complaints.6U.S. Department of Health and Human Services. How to File a Health Information Privacy or Security Complaint
Providers cannot retaliate against you for filing. Civil penalties for HIPAA violations start at $145 per violation for unintentional failures and climb when the provider knew or should have known about the problem.