SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/hipaa-phi-50-years

For how long after a person dies must a covered entity keep protecting that person's health information?

50 years after death.

Start playing free

  1. 6 years
  2. Until the estate is settled
  3. 50 years ✔

Why: The Privacy Rule keeps protecting a deceased person's PHI for 50 years after death. After that, the information no longer counts as PHI.

Huh, didn't know that: HIPAA's 6-year number is for keeping compliance paperwork, not for how long a patient's information stays protected.

The dad joke
Why did the man get fired from the calendar factory? He took a couple of days off.
Like this card?
Play the game

References

Answer: 50 years. The Privacy Rule keeps protecting a deceased person's PHI for 50 years after death. After that, the information no longer counts as PHI.

  1. 45 CFR 164.502 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
    with respect to the protected health information of a deceased individual for a period of 50 years following the death of the individual
    Checked 2026-10-10.
  2. 45 CFR 164.530 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.530
    six years from the date of its creation or the date when it last was in effect, whichever is later
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Work SkillsDoes HIPAA protect patient information that is spoken out loud, or only paper and computer records?Work SkillsA hospital's HR office keeps Dana's pre-hire physical in Dana's personnel file, as the employer. Is that file PHI?Work SkillsHow many identifiers must be removed under HIPAA's Safe Harbor method to de-identify health data?

That's stuff everyone should know.