To put it another way, clearly the outcome in this story was unacceptable, but what was the correct outcome?
HIPAA does specifically allow for the sharing of PHI with family and friends of a with substantial leeway given to medical professionals to document their reasoning for sharing information if it is "in the patient's best interest". In the hypothetical scenario where concerned family/friends are inquiring about a discharge, it would be perfectly acceptable to share certain details of the discharge if the healthcare provider is willing to document and possibly defend their decision.
In this case, not reporting to next of kin was certainly not in the patient's best interest and a prima facie case of misconduct. As someone who sat at the intersection of health and law for several years, I can't see any possible legal justification or loophole for the hospital to avoid a hefty settlement. As some of the other comments on this thread suggest, this shocking oversight may not be an isolated case, so a hefty monetary penalty is the only realistic way to force the other for-profit health systems of America to implement better processes for this.
So, after the patient died, what is the mechanism by which the family should have been contacted?
Later, if that failed and the family came to ask the hospital, the correct answer was "they're dead", not "we can't tell you" (and especially not "they were discharged against medical advice"!). How does the hospital authenticate and authorize the inquiry party?
Edit: also, is being dead PHI?
You can't just truck the body off to storage and then forget about it.
Obviously the death certificate here was quite delayed, but this shows that generally the fact of death is something that can be shared with those suing.