How Much Are Health Records Worth? Costs, Privacy Risks, and Your Rights

Meta description: Learn what medical records may cost to obtain, why stolen health data can be valuable to criminals, and how U.S. privacy rules protect your access.

“What is the price for your health records?” can mean two very different things: what a patient pays to get a copy, or what stolen medical data may be worth to criminals. There is no single national price for a medical-record copy, and claims that every health record has a fixed black-market value are misleading. In the United States, the cost to request records depends on the provider, format, and state law. The risks of unauthorized disclosure, meanwhile, can extend well beyond a single transaction.

What Does It Cost to Get a Copy of Your Health Records?

Under the federal Health Insurance Portability and Accountability Act (HIPAA), most people have a right to inspect or obtain a copy of health information held by a covered health care provider or health plan. A provider may generally charge a reasonable, cost-based fee for making a copy. The fee can include permitted labor, supplies, and postage, but it cannot be a profit-making charge for granting access.

HIPAA does not set one nationwide dollar amount for every request. The total may depend on whether records are paper or electronic, how much copying is needed, and whether the patient requests a summary instead of the underlying records. State laws may impose additional limits or give patients broader access rights, so the amount can vary by location and provider.

Fees HIPAA Generally Allows

When a patient asks for a copy, HIPAA generally permits a fee based on the labor required to make the requested copy, the cost of paper or other supplies, and postage if the records are mailed. If the patient agrees in advance, a provider may also charge for preparing an explanation or summary. The provider should explain the fee before fulfilling the request.

For electronic records, the U.S. Department of Health and Human Services Office for Civil Rights (OCR) allows covered entities to use certain methods for calculating a reasonable, cost-based fee. One option is a flat fee of no more than $6.50 for an electronic copy, including applicable labor, supplies, and postage. This is an optional calculation method, not a universal maximum price or a standard fee that every provider must charge. Other reasonable calculation methods may be available.

Charges That May Not Be Permitted

HIPAA does not allow a covered entity to charge for costs such as searching for and retrieving records, verifying a request, maintaining systems, or general administration. A provider also cannot charge a patient a fee simply for inspecting records in person. These rules apply to covered entities subject to HIPAA; they do not automatically govern every organization that holds health-related information.

Requests can be subject to separate rules if they are made by someone other than the patient, such as an attorney, insurer, or company seeking records for its own purposes. A patient’s request to have records sent to another person or organization is treated differently from a third party’s independent request. Patients can ask the provider to identify the legal basis for a fee and to explain how it was calculated.

How to Request Records and Check the Cost

A request usually goes through a provider’s medical records department, patient portal, or health information management office. Some organizations require a signed form; others accept a secure portal request. The provider generally must act on an individual’s access request within 30 days, with one 30-day extension permitted when the individual is notified of the reason and expected completion date.

Before submitting a request, it can help to decide what information is needed and how it should be delivered. A request for a specific date range, test result, or visit may be easier and less costly to fulfill than a request for an entire record, though the provider’s fee policy and state law still matter.

• Ask for an estimate: Request the fee in writing and ask which services or copying costs it covers.
• Choose a format: Ask whether the records are available through a secure portal or as a downloadable electronic file.
• Limit the scope when appropriate: Identify the dates, facility, or record types needed.
• Ask about state protections: State law may set lower fees, limit charges, or provide other rights.
• Keep the response: Save the request, fee estimate, and any messages about delays or denials.

If a covered provider refuses access or charges a fee that seems inconsistent with HIPAA, the patient can first contact the provider’s privacy officer or records department. A complaint can also be submitted to OCR. The agency’s complaint process and filing requirements are available through the HHS HIPAA complaint page.

What Are Health Records Worth on the Black Market?

There is no dependable, fixed price for a person’s health record on an illicit market. Any quoted amount depends on what the data includes, how complete and current it is, whether it can be linked to an identifiable person, and whether it has already been exposed. Listings on criminal forums are difficult to verify, may be scams, and do not establish what a buyer actually paid or how many records were usable.

Health information can be attractive to criminals because it may contain names, birth dates, addresses, insurance details, diagnoses, prescriptions, and billing information in one place. Some of these details are difficult or impossible to change. Unlike a compromised payment card, a diagnosis or medical history cannot simply be replaced. However, that does not mean every record is worth a particular amount or that medical data is always more valuable than financial information.

Stolen records may be used in identity theft, insurance fraud, targeted phishing, fraudulent billing, or attempts to obtain prescription drugs. Criminals may also combine health information with data from other breaches. The value to an attacker can therefore come from the potential for misuse—not from a reliable per-record sale price.

It is important to distinguish the alleged sale price of stolen data from the financial cost of a breach. IBM’s Cost of a Data Breach Report estimated that the average cost of a health care data breach was $9.77 million in its 2026 report. That figure covers organizational consequences such as investigation, response, disruption, and recovery; it is not the price of an individual’s record or an estimate of what a criminal pays for one.

Why Medical Data Can Create Long-Term Risks

Health records can reveal sensitive facts about a person’s physical or mental health, treatment, and family circumstances. Exposure may cause embarrassment or distress, and it can make people more vulnerable to scams that appear to come from a clinic, pharmacy, insurer, or medical professional. Fraudulent claims can also create paperwork and make it harder to identify legitimate charges.

Some medical information can be especially difficult to correct after a breach. A person can replace a payment card or reset a password, but cannot change a past diagnosis or treatment history. That persistence is one reason health data warrants careful protection. It does not mean that every disclosure leads to fraud; the risk depends on what was exposed, who obtained it, and how the information is used.

HIPAA requires covered entities and business associates to protect protected health information, subject to the law’s rules and exceptions. It also requires covered entities to notify affected individuals after certain breaches of unsecured protected health information. Not every organization that collects health-related information is covered by HIPAA, however. Consumer health apps, wearable-device services, and other technology companies may be governed by different laws or regulatory requirements.

What to Do If Health Information Is Exposed

If a provider or health plan sends a breach notice, read it carefully. It should explain what information was involved, what the organization is doing, and steps individuals can take. The notice may offer credit monitoring, but monitoring does not prevent every type of medical identity theft. Patients should use the contact information in the notice, while independently verifying it through the organization’s official website or a known phone number if they are unsure it is genuine.

• Review medical bills and insurance statements: Contact the provider or insurer about unfamiliar appointments, services, or claims.
• Protect online accounts: Use unique passwords and multifactor authentication where available, especially for patient portals and email.
• Be cautious with unexpected messages: Do not share account credentials, Social Security numbers, or payment details in response to an unsolicited call, text, or email.
• Keep relevant records: Save breach notices, disputed bills, and communications with providers or insurers.
• Report suspected fraud: Contact the health plan or provider, and consider reporting identity theft through the Federal Trade Commission’s IdentityTheft.gov.

If incorrect information appears in a medical record, patients can ask the provider to amend it under HIPAA. The provider must respond to an amendment request, but it may deny the request in certain circumstances—for example, if it determines the record is accurate and complete. If the request is denied, the patient has rights to receive the explanation and, in many cases, submit a statement of disagreement.

Key Differences at a Glance

Reliable Sources for Patient Rights and Privacy

For current federal access rules, the primary sources are HHS OCR’s guidance on accessing medical records and the HIPAA Privacy Rule at 45 C.F.R. § 164.524. State health departments or consumer-protection agencies can provide information about state-specific medical-record fees. Reviewing these official sources is more reliable than assuming that a fee or black-market valuation quoted online applies to every record.