This might sound silly, but technically speaking how does this kind of notification work in relation to HIPAA? Is there some kind of a carve out that allows hospitals to tell your family you've "been discharged against medical advice"? How does next of kin notification work for death?
To put it another way, clearly the outcome in this story was unacceptable, but what was the correct outcome?
You're conflating information privacy guidelines (i.e. HIPAA) with next-of-kin reporting which is usually specified by state law. If you check out the probate process which distributes an estate after death, it can vary considerably from state to state and has a lot more judicial involvement. HIPAA is not an enforced statute or law, it's a set of civil rights guidelines which allow hefty fines to be levied by OCR (Office of Civil Rights) when a violation is reported and investigated.
HIPAA does specifically allow for the sharing of PHI with family and friends of a with substantial leeway given to medical professionals to document their reasoning for sharing information if it is "in the patient's best interest". In the hypothetical scenario where concerned family/friends are inquiring about a discharge, it would be perfectly acceptable to share certain details of the discharge if the healthcare provider is willing to document and possibly defend their decision.
In this case, not reporting to next of kin was certainly not in the patient's best interest and a prima facie case of misconduct. As someone who sat at the intersection of health and law for several years, I can't see any possible legal justification or loophole for the hospital to avoid a hefty settlement. As some of the other comments on this thread suggest, this shocking oversight may not be an isolated case, so a hefty monetary penalty is the only realistic way to force the other for-profit health systems of America to implement better processes for this.
So, after the patient died, what is the mechanism by which the family should have been contacted?
Later, if that failed and the family came to ask the hospital, the correct answer was "they're dead", not "we can't tell you" (and especially not "they were discharged against medical advice"!). How does the hospital authenticate and authorize the inquiry party?
If a hospital becomes aware of a death, they need to let the medical examiner know. In turn, they or the medical examiner issues a death certificate, etc.
You can't just truck the body off to storage and then forget about it.
Death certificates can be shared with parents, siblings, and children of the deceased in every state; and most states they are public records that everyone can access.
Obviously the death certificate here was quite delayed, but this shows that generally the fact of death is something that can be shared with those suing.
To put it another way, clearly the outcome in this story was unacceptable, but what was the correct outcome?