Health information is protected under HIPAA for as long as it can be used to identify an individual. This protection applies even after a person has passed away, continuing for 50 years after death.