I would research the HITECH Act... I have a link below that hopefully simplifies HITECH requests .
The attorneys where I work have gotten quite savvy and have a letter "drafted" by the patient, along with an authorization. (to avoid higher costs) In those cases, we follow HITECH. If the request came from the attorney without a patient letter, regular state fees would be charged.