The two year limit was a proposal, documented here:
http://www.hipaadvisory.com/regs/standardsprivacyindividid/applicationdecea
sed.htm
But that limit was NOT implemented as the regulation. Follow the link at
the top of the page I provided the link to and you can follow the LONG
regulations for the actual law, Section 164.502(f) - Deceased Individuals
Hope this helps.
Lisa Hawkins
Analyst - Information Policy, Compliance, and Archives
Y-12 National Security Complex
[log in to unmask]
Phone: (865) 241-8166 - Fax: (865) 241-4566
List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance