Under HIPAA, all patients must be able to access their PHI. Each CE must have clear procedures in place to facilitate these requests without undue delay. The patient must submit their request in writing, though web-based forms can also be made available. The CE is allowed to charge a “permissible” fee to cover the labor-based costs, postage etc. of facilitating the PHI access request, but the fee should not cover factors such as the verification of the individual requesting the access or cost of maintaining the PHI. These are HIPAA requirements and should not be paid for by the patient.