Does HIPAA protect a deceased patient's records?
Yes, HIPAA protects a deceased patient's records for 50 years after death under 45 CFR 164.502(f), and a personal representative acts for the patient.
Yes, for 50 years after death. Under 45 CFR 164.502(f), the Privacy Rule keeps applying to a deceased patient's protected health information for 50 years following the death. After that period, 45 CFR 160.103 no longer counts the information as protected health information.
How long does HIPAA protect a deceased patient's records?
HIPAA protects a deceased patient's records for 50 years after death, under 45 CFR 164.502(f). A covered entity must comply with the Privacy Rule's requirements for a deceased individual's protected health information for that period, counted from the death of the individual. The date of death therefore sets when the period ends. You can read the text of 45 CFR 164.502 on law.cornell.edu.
Which section of 45 CFR covers a deceased patient's records?
45 CFR 164.502 covers a deceased patient's records, and paragraph (f) sets the 50-year period. The definition of protected health information in 45 CFR 160.103 excludes individually identifiable health information about a person who has been deceased for more than 50 years, under paragraph (2)(iv) of that definition. Paragraph (g) covers personal representatives, who stand in for the patient.
What does the rule require for a deceased patient's records?
A practice that holds a deceased patient's records must meet the requirements below, all set by 45 CFR 164.502 and 160.103.
| Requirement | Citation | What a small practice does |
|---|---|---|
| Protection period | 45 CFR 164.502(f) | A practice applies the Privacy Rule's requirements to the records for 50 years after death. |
| End of protection | 45 CFR 160.103 | A practice does not treat information about a person deceased for more than 50 years as protected health information. |
| Personal representative | 45 CFR 164.502(g)(1) | A practice treats the personal representative as the individual, except as paragraphs (g)(3) and (g)(5) provide. |
Who stands in for the patient under HIPAA?
A personal representative stands in for the patient under HIPAA, and 45 CFR 164.502(g)(1) requires a covered entity to treat a personal representative as the individual, except as provided in paragraphs (g)(3) and (g)(5).
Does the rule apply to a small practice?
The 50-year period in 45 CFR 164.502(f) is the same for a small practice as for a large one, because the paragraph sets no different period by practice size. The personal representative rule in 164.502(g)(1) states its duty for a covered entity.
What happens to the records after 50 years?
After the 50-year period ends, the records are no longer protected health information under 45 CFR 160.103, because the definition excludes information about a person who has been deceased for more than 50 years. The 50 years count from the date of death.
How does the 50-year rule apply to faxing a deceased patient's records?
A fax of a deceased patient's records falls under the Privacy Rule for 50 years after death, under 45 CFR 164.502(f). A fax of information about a person deceased for more than 50 years falls outside the definition of protected health information in 45 CFR 160.103. The date of death decides which side of the 50-year line a fax falls on.
For how long a practice keeps faxed records, read how long to keep fax records under HIPAA. For the steps to answer a records request by fax, read how to respond to a medical records request by fax. For what happens to a practice's fax number when the practice closes, read what to do with a fax number when a practice closes.
* The regulation text was read at law.cornell.edu on October 13, 2026.
Frequently asked questions
- Does HIPAA protect a deceased patient's records?
- Yes, HIPAA protects a deceased patient's records for 50 years after death under 45 CFR 164.502(f). A covered entity must apply the Privacy Rule's requirements to the records during that period. After 50 years, 45 CFR 160.103 excludes the information from the definition of protected health information.
- Which section of 45 CFR covers a deceased patient's records?
- 45 CFR 164.502 covers a deceased patient's records, and paragraph (f) sets the 50-year period. The definition of protected health information in 45 CFR 160.103 excludes information about a person deceased for more than 50 years. Personal representatives are covered in paragraph (g)(1).
- Does the 50-year HIPAA rule apply to a small practice?
- The 50-year period in 45 CFR 164.502(f) is the same for a small practice as for a large one, because the paragraph sets no different period by practice size. The personal representative rule in 164.502(g)(1) states its duty for a covered entity. The period runs 50 years from the date of death.
- How does HIPAA apply to faxing a deceased patient's records?
- A fax of a deceased patient's records falls under the Privacy Rule for 50 years after death, under 45 CFR 164.502(f). A fax of information about a person deceased for more than 50 years falls outside the definition of protected health information in 45 CFR 160.103. The date of death decides which side of the 50-year line a fax falls on.
- Who stands in for the patient under HIPAA?
- A personal representative stands in for a patient under HIPAA. Under 45 CFR 164.502(g)(1), a covered entity must treat a personal representative as the individual for HIPAA purposes, except as provided in paragraphs (g)(3) and (g)(5). The 50-year period in 45 CFR 164.502(f) applies to the records of a deceased patient.
Fax Pigeon
HIPAA-compliant fax with a signed BAA on every plan
Plans start at $4.99 a month, billed annually, for 200 pages, with your own number and unlimited people. Your first fax is free.
- Free porting of your local number
- Fax from your email
- AI summary of every inbound fax
- E-signatures
- Contact management
- Delivery proof
Know a practice that still faxes? Refer it through the referral program and earn 20% of its plan, every month it stays.