Medical records fees in Arizona are governed by A.R.S. 12-2295, which lets a healthcare provider charge a reasonable fee for reproducing your records but requires free copies in five specific situations. On top of that, HIPAA caps what a provider can bill you when you request your own health information and offers a flat $6.50 option for electronic copies. The rule that gives you more access wins, so knowing both layers matters.
When Records Must Be Free
A.R.S. 12-2295(B) lists five situations where a provider cannot charge anything for the pertinent information in your medical records.1Arizona Legislature. Arizona Revised Statutes Title 12 Section 12-2295 – Charges
- When one provider sends your records to another provider for your continuing care. A provider also cannot require advance payment in this situation, because a billing dispute should never delay a treatment transfer.
- When you request your records for the purpose of obtaining further healthcare. You have to show that purpose when you ask.
- When someone legally authorized to make healthcare decisions on your behalf requests records to arrange your care.
- When the Arizona Medical Board, the Arizona Board of Osteopathic Examiners in Medicine and Surgery, or officers of the Department of Health Services or a local health department request records under A.R.S. 36-662.
- When you are appealing a denial of benefits under the Social Security Act. If a legal representative makes the request for you, they must present a completed Appointment of Representative form (SSA-1696) before the fee waiver applies. Additional requests in the same calendar year, or requests for records already provided free that year, can be billed at the standard rate. But a provider cannot charge you at all if no records are found in response to your request.
What Counts as a Reasonable Fee
When none of the exemptions apply, Arizona law lets providers charge a reasonable fee tied to the actual cost of reproduction. The statute does not set a specific dollar cap, so providers have some discretion, but the charge cannot be an arbitrary markup.1Arizona Legislature. Arizona Revised Statutes Title 12 Section 12-2295 – Charges
Federal rules tighten this further when you request your own records. Under 45 CFR 164.524(c)(4), a provider may only bill you for four categories of expense:
- Copying labor — the actual work of creating and delivering the copy after responsive records have been identified and collected.
- Supplies, such as paper, toner, or portable media like a CD or USB drive if you ask for one. A provider cannot force you to accept records on a USB drive; you can ask for email or mail instead.
- Postage, only when you request that records be mailed.
- Preparing a summary or explanation of your records, but only if you specifically ask for one and agree to the fee in advance.
That list is complete. Providers cannot bill you for searching, retrieving, locating, or reviewing records. They cannot charge for verifying your identity, segregating what is responsive, or maintaining their record-keeping systems. HHS has been explicit that these costs are excluded even where state law might otherwise allow them.2U.S. Department of Health and Human Services. Individuals’ Right under HIPAA to Access their Health Information
The $6.50 Flat Fee for Electronic Copies
A provider that does not want to calculate its actual costs can charge a flat fee of no more than $6.50 for an electronic copy of records already maintained electronically. The flat fee covers all labor, supplies, and postage combined. It is not a ceiling on the cost-based method, so a provider using actual costs might charge less. But it gives you a benchmark. If you are quoted much more than $6.50 for an electronic copy of your own records, ask how the fee was calculated.3U.S. Department of Health and Human Services. Is $6.50 the Maximum Amount That Can Be Charged to Provide Individuals With a Copy of Their PHI?
The flat-fee option only applies when you request your own records. Third parties such as attorneys and record retrieval companies are not entitled to it and typically pay more.
Workers’ Compensation Records Have Hard Caps
Arizona sets specific per-page and hourly rates for workers’ compensation records instead of the open-ended reasonable-fee standard. Under Arizona Administrative Code R20-5-128, a provider cannot charge more than $0.25 per page plus $10.00 per hour in clerical costs when a party, authorized representative, or entity makes a request under A.R.S. 23-908(C).4Legal Information Institute. Arizona Administrative Code R20-5-128 – Medical Information Reproduction Cost Limitation; Definition of Medical Information
These caps apply to every provider treating an injured worker, including those that outsource copying to a third-party service. A provider cannot escape the cap by hiring a records company that charges more; the regulation treats outside fees the same as fees charged directly.4Legal Information Institute. Arizona Administrative Code R20-5-128 – Medical Information Reproduction Cost Limitation; Definition of Medical Information
When State and Federal Rules Disagree
Arizona providers must comply with both sets of rules, and the more patient-friendly one wins. Under 45 CFR 160.203, HIPAA preempts a contrary state law unless the state law is more stringent, meaning it gives individuals greater access rights.5eCFR. 45 CFR 160.203 – Preemption of State Law
In practice, Arizona’s free-records exemptions stay in force because they go beyond what HIPAA requires. HIPAA’s ban on search-and-retrieval charges applies too, even though Arizona’s statute does not address those costs directly. You get the benefit of whichever rule protects you more in a given situation.
What to Do If You’re Overcharged
If a provider charges more than allowed, refuses to release your records, or ignores your request, you can file a complaint with the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services. OCR investigates HIPAA privacy, security, and breach notification complaints.
You have 180 days from when you became aware of the problem to file, though OCR can extend that deadline for good cause. Complaints can go through the OCR online portal, by email to OCRComplaint@hhs.gov, or by mail. Your complaint must name the provider, describe what happened, and include your contact information. OCR does not investigate anonymous complaints.6U.S. Department of Health and Human Services. How to File a Health Information Privacy or Security Complaint
Providers cannot retaliate against you for filing. If retaliation happens, report it to OCR right away. Civil penalties for HIPAA violations start at $145 per violation for unintentional failures and rise sharply when the provider knew or should have known about the problem.