Why this report
Personal injury cases run on medical records. The patient's attorney needs them to build the demand, the insurer needs them to evaluate it, and the other side may subpoena them if the case goes to court. For a practice, each request raises the same three questions: how fast do we have to respond, what can we charge, and what do we need on file before anything leaves the chart?
The answers come from two layers that don't always match: the federal HIPAA rules, and each state's own statutes and board rules. This report sets them side by side for the federal rules and 10 states.
Method
- Coverage. The federal rules (HIPAA and related laws) plus California, Texas, Florida, New York, Georgia, Illinois, Pennsylvania, Arizona, Nevada and New Jersey.
- Same questions everywhere. Response deadlines, copy fees, requests from the patient's attorney, subpoenas, records that need extra consent, billing records, retention and recent changes.
- Sources. Statutes, regulations, board rules, court opinions and official agency pages, checked in November 2026. Secondary sources were used only to find primary ones.
- Only confirmed points are published. Anything we could not confirm in a primary source was left out.
- Cross-check. The figures most likely to change or be misread were checked a second time: Arizona's 2026 deadlines, New Jersey's fee cap, the 2026 fee schedules in Georgia, Illinois and Pennsylvania, and the latest federal enforcement actions.
Seven findings
1. HIPAA sets the outer limit, but many states are faster
Under HIPAA a practice has 30 days to give patients their records, with one 30-day extension if it tells the patient in writing (federal rules). Several states require much less time:
| Deadline | States |
|---|---|
| Under 10 working days to let the patient inspect | California (5 working days), New York and Nevada (10 days) |
| About two to three weeks for copies | California (15 days), Texas (15 business days), Arizona (10 or 15 business days when the records are needed for upcoming treatment) |
| 30 days | Georgia, Illinois (extendable to 60), New Jersey (15 days for physical therapists), Arizona for litigation and other purposes |
| No fixed state count, so HIPAA's 30 days applies | Florida ("timely"), Pennsylvania |
The practical point: set your clock by the strictest rule that applies, and record the date each request arrives. In Arizona, also record the purpose, because the deadline depends on it.
2. Copy fees vary more than most practices expect
For a 100-page record, the allowed charge ranges from about $25 in California to well over $100 in states with search or handling fees. Arizona sets no dollar cap at all, only a "reasonable fee."
| State | Fee rule (for the requests each rule covers) |
|---|---|
| California | Up to $0.25 per page for a patient's copies |
| Nevada | Up to 60 cents per page plus postage, no administrative fees |
| New York | Costs only, up to 75 cents per paper page |
| New Jersey | $1 per page or $50 for the whole record, whichever is less, for patients and their attorneys |
| Florida | Board rules: $1.00 per page for the first 25 pages, then $0.25 for patients |
| Texas | $25 for the first 20 pages, then $0.50 per page |
| Georgia | 2026 rates: up to $25.88 retrieval plus a per-page charge starting at $0.97 (not for patients' own requests) |
| Illinois | 2026 rates: $36.68 handling plus $1.38 per page for the first 25 pages, falling to $0.46 |
| Pennsylvania | 2026 rates: $2 per page for the first 20 pages, falling to $0.52, plus a $29.61 search fee (not for a patient's own records) |
| Arizona | A "reasonable fee," with no per-page cap in the statute |
What a 100-page paper record can cost
Georgia, Illinois and Pennsylvania adjust their amounts every year, so a fee schedule set up once will drift out of date.
3. Who is asking changes what you can charge
When patients ask for their own records, HIPAA limits the fee to reasonable, cost-based amounts, with an optional flat fee of up to $6.50 for electronic copies. Since Ciox Health v. Azar (2020), that federal limit does not apply to records sent to a third party, such as an attorney, so the state's rules decide.
- Same cap as the patient: New Jersey (the patient's attorney), Nevada (with the patient's written authorization), Illinois and Texas (same deadlines and fee caps).
- A separate attorney rule: California's Evidence Code § 1158 gives an attorney with the patient's authorization 5 days and caps copies at $0.10 per page before a lawsuit is filed.
- Patient-level access only with a specific power of attorney: New York.
4. A bare attorney subpoena often isn't enough
HIPAA allows release under a subpoena without a court order only with "satisfactory assurance" that the patient was notified or that a qualifying protective order is in place. Several states add their own conditions:
- New York: a practice need not respond to a non-court subpoena for medical records that lacks the patient's written authorization.
- Arizona: the subpoena must come with a patient authorization, a court order or another listed basis. Otherwise the practice may file the records under seal or object.
- California: the patient must be given notice before records are produced under a subpoena.
- Pennsylvania and Nevada: set procedures for sending certified copies with a custodian certification or affidavit.
5. Some records need their own consent
A general authorization does not cover everything. Psychotherapy notes and substance use treatment records covered by 42 CFR Part 2 have their own federal rules, and the updated Part 2 rule has been enforced since February 16, 2026. States add their own categories, most often HIV test results, genetic test results and mental health records. Each state page lists which apply.
6. Retention periods range from 4 to 10 years
HIPAA sets no retention period for medical records. State periods for physicians range from 5 years (Florida, Nevada) to 10 years (Georgia), with 6 or 7 years in most of the others, and longer periods for minors. Rules for chiropractors and physical therapists can differ: Florida chiropractors keep records 4 years, for example.
7. The rules are still changing
- Arizona (2026) tied response deadlines to the purpose of the request.
- Texas (2025) replaced its medical board's records rules, so older fee references are out of date.
- New York (2024) gave patients a right to a paper copy.
- Federal: the updated Part 2 rule took effect for enforcement in February 2026, and OCR's Right of Access initiative reached its 56th enforcement action in October 2026. The 2024 reproductive health privacy rule was vacated by a federal court in 2025, except most of its Notice of Privacy Practices changes.
Federal and 10-state comparison
| Deadline for a patient's request | Copy fees | Requests from the patient's attorney | Key recent change | |
|---|---|---|---|---|
| US | 30 days, one 30-day extension | Cost-based fee; optional $6.50 flat fee for electronic copies | HIPAA fee limit does not apply (Ciox, 2020) | Part 2 compliance and OCR enforcement from Feb 16, 2026 |
| AZ | 10 or 15 business days for upcoming care; 30 calendar days for other purposes | Reasonable fee, no per-page cap in statute | Written patient authorization; 30 calendar days for litigation | HB 2557 (2026) added tiered response deadlines, effective Sept. 12, 2026 |
| CA | Inspection in 5 working days; copies in 15 days | Cost-based, capped at $0.25 per page | Evidence Code 1158: 5 days, $0.10 per page | 7-year physician retention under SB 815, effective Jan. 1, 2024 |
| FL | "Timely," no day count in statute; HIPAA 30 days applies | Board rules: $1.00/page for 25 pages, then $0.25 (patients) | Written patient authorization; up to $1.00/page for other requesters | 2023 law on medical-expense evidence and letters of protection (768.0427) |
| GA | 30 days from receipt of the request | DCH 2026: up to $25.88 retrieval plus $0.97/page (first 20) | Patient-designated recipient; HIPAA and signed authorization; 30 days | SB 68 (2025) made letter-of-protection billing discoverable |
| IL | 30 days, extendable to 60 | 2026: $36.68 handling, $1.38 to $0.46 per page | Same deadline and fee caps as patients | 2026 Comptroller fee update |
| NV | Inspection within 10 working days; copies under HIPAA's 30 days | Up to 60 cents per page plus postage; no admin fees | Same rights and 60-cent cap with patient's written authorization | 2023 amendment requires electronic health records (waiver available) |
| NJ | 30 days (physical therapists: 15 days) | $1 per page or $50 total, whichever is less | Patient's attorney gets the patient-level cap | None found for practices; 2025 hospital rule proposal |
| NY | 10 days to inspect; copies in a reasonable time | Costs, up to 75 cents per paper page | Patient-level access with a § 18 power of attorney | 2024 right to a paper copy (Ch. 347) |
| PA | No state deadline; HIPAA applies | 2026: $2 to $0.52 per page, $29.61 search fee | Access without subpoena; same fee caps | 2026 fee update (55 Pa.B. 8441) |
| TX | 15 business days after written consent | $25 for first 20 pages, then $0.50 per page | Same written consent, deadline and fee caps | SB 922 (2025) 3-day portal hold on sensitive results |
Short summaries only. Each state page has the full rules, exceptions and sources.
What every practice should do
- Log every request on arrival: who asked, the date, the purpose and what authorization came with it. Deadlines and fees depend on all four.
- Check the authorization before releasing anything. A lien agreement or letter of protection is not a records authorization.
- Use one fee schedule per state, and update it every year in states that adjust their amounts.
- Don't charge patients search or retrieval fees for their own records, and keep patient requests within HIPAA's cost-based limits.
- Screen subpoenas for the patient's authorization, notice to the patient or a court order before producing records.
- Flag sensitive records (psychotherapy notes, substance use treatment, HIV and genetic results, mental health) so they are released only with the specific consent they require.
Limitations
- No attorney review. This report was researched and written by Ambula. It has not been reviewed by a licensed attorney. It is general information, not legal advice.
- Who is covered. Some state rules apply to physicians or to specific licensing boards only. Each state page says which providers a rule covers, and where we could not confirm a rule for chiropractors or physical therapists.
- Amounts change. Several states update their fees every year. Each page shows the year of the figures and the date it was last verified.
- Corrections. If you find an error, tell us and we will correct it and note the change.
Disclosure
The author works at Ambula, which makes EMR and practice management software, including an attorney portal for sharing records with law firms. The report describes the law and recommends practices, not products.