Go to homepage
Legal FAQs
Medical Records
Can a physician withhold a patient’s record for a past due balance (for services rendered)?

No. The Office of the Indiana Attorney General filed a Complaint with the Indiana Medical Licensing Board against Shashi Puttaswamy, MD, in June 2006 alleging that withholding patient records for a past due balance violates physician standards of practice. The Complaint cited the Indiana law that states, “On written request and reasonable notice, a provider shall supply to a patient the health records possessed by the provider concerning the patient.”  Ind. Code § 16-39-1-1(c). On April 24, 2008, the parties stipulated that physicians are responsible for having knowledge of the legal standards of conduct and practice and that the doctor knowingly violated that law.  On May 5, 2008, the Medical Licensing Board approved the stipulation and ordered the physician to pay the costs of transcribing the action.  (The physician would have also had to pay for her own legal fees and appeared before the Board multiple times before this matter was resolved.)   

Similarly, AMA Ethical Opinion 7.02 states medical records should not be withheld for an unpaid balance.

Can a physician charge for copies of a patient’s record? How much?

Yes, generally physicians may charge for copies of a patient’s medical records.  The permissible charges differ based on who is requesting the records.  When a patient requests his/her own medical records, HIPAA overrides Indiana law. Under HIPAA, a patient can request a copy of his/her own medical records and can request that the medical records be sent to a third party.  If a patient makes the request, an authorization is not necessary, but the patient’s request for the records must be in writing, signed by the patient and if the patient wants the records sent to a third party, the patient must clearly identify the designated person and where to send the PHI.  On the other hand, if a third party requests records and submits a patient authorization for release of the records, the HIPAA law will not apply, but the Indiana law on permissible charges will apply.

Note: Medicaid does not allow charges to copy medical records. IHCP Banner Page BR200634, August 22, 2006.

Below is a summary of permissible charges for copying and sending medical records (for patients not covered under Medicaid):

If Patient Requests His/Her Medical Records:

Three options for fees:

  • Actual Costs: 
    Reasonable labor costs: only include certain labor costs*
    + Supplies: paper or electronic media (e.g., CD or USB drive)
    + Postage


  • Average Costs:
    Reasonable labor costs based on average labor costs
    + Supplies
    + Postage


  • For requests for an electronic copy of PHI maintained electronically: Flat Fee $6.50 (all costs included)

If 3rd Party Requests Medical Records:

  • Labor costs:  $20 (If collected cannot charge for first 10 pages)


  • $1 per page for first 10 pages (If collected cannot charge for labor)

    + $.50 for pages 11 through 50 
    + $.25 for pages 51 and higher
    + Actual postage costs
    + Expedite fee:  Additional $10 if requests are to be mailed within 2 working days
    + Certifying fee: $20 if certified

*Under HIPAA labor charges cannot include searching for, retrieving, or reviewing medical records. Labor charges are limited to the time to: photocopy paper PHI; scan PHI into electronic format; convert electronic format into the format requested by the patient; transfer (upload, download, burn) electronic PHI from EHR to electronic media; and create and execute mailing with the PHI.

Also note, if a patient requests or agrees to access PHI from the “view, download, and transmit” function of a CEHRT, the provider cannot charge for the records. 

For more detailed HIPAA guidance on charging for medical records and a patient’s right to access his/her PHI, click here

Updated June 27, 2016

Can a physician withhold a patient’s record until the patient pays for copies of the records?

Indiana law does not expressly address this issue. It provides that patients have a right to a copy of their records and also provides that physicians have a right to charge for those copies. However, it does not specify whether those charges can be collected up front before providing the records or whether they must be billed and collected afterwards. Physicians should be familiar with and consider the Attorney General complaint and Medical Licensing Board order in the Puttaswamy case (see above answer to "Can a physician withhold a patient’s record for a past due balance (for services rendered)?"). Ethically, physicians should consider patient abandonment and continuity of care issues.

How quickly must a physician release requested medical records?

Indiana law does not provide a specific timeframe within which a physician must release a patient’s medical records, except that a physician must provide copies of the records within two (2) days if the physician charges a rush fee. 760 IAC 1-71-3.  However, federal HIPAA laws require a covered entity to act on a request for access to medical records within thirty (30) days.  Thus, a physician must either grant access to medical records or give a justified denial of access within thirty (30) days of receipt of the request for release.  45 CFR § 164.524(b)(2).

How long must a physician retain medical records?

According to Indiana law, physicians must maintain medical records for at least seven (7) years.
IC 16-39-7-1. However, for various legal and risk management reasons, medical malpractice insurance carriers often want physicians to retain records for longer periods of time. Call your malpractice carrier for advice.  Also check any contracts you signed with insurance companies – some of those agreements include medical and business record retention obligations that exceed state law requirements.  (The ISMA has seen multiple payor contracts that require 10 years, including from Medicare Advantage plans.) Call your accountant about advice on retaining business and financial records.

Can a physician release records produced by another provider?

Although Indiana law is silent on this specific issue, it allows patients to request and receive records “possessed” or “maintained” by a physician, which presumably includes records produced by another provider. IC 16-39-1-1 & IC 16-18-2-168 (see also 844 IAC 5-2-4 “custody,” “possession,” or “control”). HIPAA also allows such a practice.

If a patient requests a copy of their claim information, do I have to provide it?

Yes.  When a patient requests their claim information, Indiana law requires health care providers to routinely provide the patient with a copy of the claim information the health care provider submits to the patient's insurance company, Medicare, or other third party payors.  This does not apply to patients with Medicaid.  Providers are not required to provide more than (1) copy of a patient's claim information.  IC 27-8-22-4.

Copyright: Information written and displayed on www.ismanet.org is the property of ISMA and may not be reproduced without expressed written permission of the Indiana State Medical Association.

For a more detailed sitemap click here.