AhaBulbStuff Everyone Should Know
AhaBulb: Stuff Everyone Should Know · ahabulb.com/hipaa-phi-50-years

For how long after a person dies must a covered entity keep protecting that person's health information?

50 years after death.

Start playing free

  1. 6 years
  2. Until the estate is settled
  3. 50 years ✔

Why: The Privacy Rule keeps protecting a deceased person's PHI for 50 years after death. After that, the information no longer counts as PHI.

Huh, didn't know that: HIPAA's 6-year number is for keeping compliance paperwork, not for how long a patient's information stays protected.

The dad joke
Why did the man get fired from the calendar factory? He took a couple of days off.
Like this card?
Play the game

References

Answer: 50 years. The Privacy Rule keeps protecting a deceased person's PHI for 50 years after death. After that, the information no longer counts as PHI.

  1. 45 CFR 164.502 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
    with respect to the protected health information of a deceased individual for a period of 50 years following the death of the individual
    Checked 2026-10-10.
  2. 45 CFR 164.530 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.530
    six years from the date of its creation or the date when it last was in effect, whichever is later
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Healthcare Privacy (HIPAA)Does HIPAA protect patient information that is spoken out loud, or only paper and computer records?Healthcare Privacy (HIPAA)A hospital's HR office keeps Dana's pre-hire physical in Dana's personnel file, as the employer. Is that file PHI?Healthcare Privacy (HIPAA)When a business associate contract ends, what must happen to the PHI the business associate still holds, if feasible?

That's stuff everyone should know.