HIPAA and Your Medical Bill — What It Covers (and What It Doesn't)

What HIPAA Actually Does for a Patient

The HIPAA Privacy Rule (45 CFR Part 164, Subpart E) gives patients three concrete rights that matter for a billing dispute. The first is the right of access: under 45 CFR § 164.524, you have an absolute right to inspect and obtain a copy of your designated record set — the medical and billing records the provider maintains on you. The provider must respond within 30 days, with a single 30-day extension if they can document a reasonable basis for the delay. The provider cannot refuse on the basis of an unpaid bill, a pending dispute, or a refusal to sign a release they would not otherwise be entitled to demand.

The second is the right to amend: under 45 CFR § 164.526, if you believe a record contains an error — for example, a clinical note that misstates a date of service or a procedure — you can request an amendment in writing. The provider has 60 days to respond. If they deny the amendment, they must tell you in writing and tell you how to file a statement of disagreement that becomes part of the record going forward.

The third is the right to an accounting of disclosures — under § 164.528 you can request a list of every entity the provider shared your records with in the prior six years. This matters less for a billing dispute than for a privacy complaint, but it's the right that surfaces the fact that the provider has been sharing your record with billing, collections, and your insurance company all along. HIPAA explicitly permits that sharing under the "treatment, payment, and healthcare operations" provision of 45 CFR § 164.506 — which is exactly the section to cite when you want a billing department to stop pretending the record is sealed from them.

What HIPAA Does Not Do for a Billing Dispute

HIPAA does not, despite what most patients assume, give you a "right to a corrected bill." There is no federal regulation that says a provider must reverse an erroneous charge if you point it out, and HIPAA is not it. The closest federal rule is the No Surprises Act's dispute resolution process for out-of-network emergency and ancillary bills — but that mechanism is administered by the federal IDR portal and applies only to a narrow set of billing situations, not to the typical duplicate-charge or upcoding case.

HIPAA also does not create a private right of action for billing disputes. The Privacy Rule is enforced by the HHS Office for Civil Rights, and a patient can file a complaint there if a covered entity refuses to provide records, but the OCR remedy is compliance — getting you the records — not money damages. To get a bill reduced or removed, you need a different mechanism: a written dispute letter, a complaint to your state insurance commissioner (if the provider is in-network with your insurer), a complaint to the CMS billing hotline (for federal programs like Medicare or Medicaid), or — when all else fails — small claims court.

Finally, HIPAA does not force a provider to apologize, admit fault, or stop collections while a dispute is pending. A billing department can keep sending statements and, depending on state law and the timeline, can refer the account to collections at the same time you're disputing it in writing. That is why the dispute letter itself matters: the letter creates a documented record that any later collector or credit bureau must consider, and it sets the response window that triggers your escalation options.

The Trust Gap That Keeps Patients From Filing

The most common reason a suspect bill goes unchallenged isn't cost or time — it's a wrong assumption about HIPAA. Patients assume HIPAA "protects" their medical information from billing, or that a provider can refuse to share records with the billing department, or that disputing a bill triggers some kind of privacy violation. None of these are true, and all of them produce the same outcome: the patient pays the bill and never learns it was wrong.

The reality is the opposite. 45 CFR § 164.506 explicitly permits a covered entity to use and disclose protected health information for treatment, payment, and healthcare operations — which is exactly why your medical record is sitting in the billing department's system and why an itemized bill arrived in your mailbox. The provider did not need your permission to share the record with billing, did not need your permission to send the bill to your insurance company, and does not need your permission to refer an unpaid balance to collections. The same regulation is the one you cite in the dispute letter to make that point.

The other common assumption — that a provider can refuse to send you your medical record — is also wrong, and the enforcement mechanism is built into HIPAA. If a provider ignores a § 164.524 request, file a complaint with the HHS Office for Civil Rights. OCR resolves most record-access complaints within 90 days, and providers who lose owe you the records plus, in some cases, a public corrective action plan. That enforcement is the backstop that makes the rest of the dispute work.

What HIPAA Gives You That Actually Helps a Dispute

Three HIPAA rights do the heavy lifting in a billing dispute, and each one corresponds to a specific artifact you cite in the letter.

1. The itemized bill. § 164.524 entitles you to a full itemized bill — every CPT code, every date of service, every supply, every charge. A summary bill is not enough, and the provider cannot refuse to send one. The itemized bill is the artifact you audit line-by-line against the categories in our billing-errors guide (duplicate charges, upcoding, unbundling, balance billing for in-network care, and pharmacy/observation-status errors).

2. The medical record. § 164.524 also entitles you to the underlying medical record. This matters because most billing disputes come down to "the bill says one thing, the chart says another." A duplicate venipuncture charge disappears when the chart shows one draw. An upcoded level-4 visit becomes a level-3 when the chart shows a brief follow-up. The No Surprises Act and the Affordable Care Act both give you supplemental dispute rights, but the medical record — the chart note, the operative report, the lab requisition — is the artifact you cite against the bill.

3. The amendment right. § 164.526 lets you request that a wrong record entry be corrected. This is slower and more procedural than disputing a charge, but it's the right tool when the dispute is fundamentally about whether the encounter happened, what was done, or who was present — facts the chart should reflect and might not. If the chart misstates the date of service or omits a procedure, the amendment right is the one to cite.

4. The 30-day clock. § 164.524 imposes a 30-day response window on a record request (extendable once for a documented reason). The clock gives you a deadline to put in the letter — "I expect a response within 30 days as required by 45 CFR § 164.524" — and it gives you standing to escalate if the provider misses it. The 30-day clock is what turns the letter from a request into a documented dispute on a timeline.

How to Use HIPAA in a Dispute Letter

HIPAA citations in a dispute letter do two jobs. The first is procedural: they tell the billing department that you know the relevant regulations and that your letter is a documented demand, not a request that can be deferred. The second is substantive: each cited section corresponds to a right the letter is exercising.

A typical paragraph cites § 164.524 to demand the itemized bill: "Under 45 CFR § 164.524, you are required to provide a complete itemized bill within 30 days of this request. I am enclosing the summary bill I received on [date]; please issue the corresponding itemized bill on or before [date + 30 days]." That paragraph does three things at once: it names the regulation, attaches the artifact that triggered the dispute, and sets a deadline the billing department is already legally required to meet.

A second paragraph can cite § 164.506 to preempt the common "we can't share your records with billing" deflection: "HIPAA at 45 CFR § 164.506 expressly permits covered entities to use and disclose protected health information for payment and healthcare operations. The medical record underlying this dispute is therefore available to the billing department, and the line items on the bill must be reconcilable against that record." This paragraph short-circuits a deflection the billing department sometimes offers when the patient requests the record as part of the dispute.

A third paragraph — used only when the dispute is about an incorrect chart entry rather than a wrong code — cites § 164.526 to request an amendment: "Under 45 CFR § 164.526, I am requesting an amendment to the [date] encounter note, which incorrectly states [specific error]. Please respond within 60 days as required." The 60-day response window in § 164.526 is longer than the 30-day clock in § 164.524, so use this citation only when the chart entry is genuinely the issue.

What BillFight Is (and Isn't) Under HIPAA

BillFight is a document preparation service, not a covered entity or business associate under HIPAA. The intake data you submit — name, provider, diagnosis summary, bill totals, email — is used only to generate the dispute letter and is never sold, shared with insurers or providers or third parties, or used for advertising. The letter itself does not transmit protected health information beyond what you choose to include in your account of the situation.

The records you receive from the provider are governed by HIPAA. The interaction with BillFight is governed by our privacy policy, which gives the same restrictions but does not arise from HIPAA. If a service claims to be "HIPAA-compliant" without being a covered entity or business associate, treat that claim as marketing language.

What to Do Today

HIPAA gives you the records and the timeline. The dispute letter uses them. Here is the order of operations that produces the highest win rate.

Step 1: Request the itemized bill. Cite 45 CFR § 164.524 and give the provider 30 days. Most providers comply within 14 to 21 days once they see the citation. A summary bill is not auditable — line items without CPT codes cannot be checked against NCCI edits or duplicate-billing rules.

Step 2: Audit the itemized bill. Walk the bill line-by-line against the five error categories. Duplicate charges (same CPT, same date, two prices), upcoding (a level-4 visit for a level-3 encounter), unbundling (charges for components of a procedure that should be billed as one), balance billing for in-network care (a separate bill from an out-of-network provider at an in-network facility), and pharmacy or observation-status errors (drug charges at inpatient rates for outpatient care, or observation-status billing that should have been inpatient).

Step 3: Pull the medical record. Cite 45 CFR § 164.524 again. The chart is the artifact that determines whether the bill is correct — a duplicate charge can't survive comparison with a chart that shows one procedure.

Step 4: Write and send the dispute letter. One page, business-formatted, names the disputed line item, the correct amount, the regulation that makes the charge improper, and a 30-day response deadline. Mail USPS Certified Mail with Return Receipt. Keep the receipt. If you use a free template, the structure is the same; if you'd rather have someone write the regulation-specific language for your particular error, BillFight generates the letter for $50 with attachments curated to the dispute.

Take the Next Step

HIPAA gives you the rights. BillFight turns them into a letter billing departments respond to.

Frequently Asked Questions