Last time I checked, HIPAA data protection only applies to the living, and not to the deceased. The photo probably was not taken at a hospital, but at the NYC Medical Examiner’s office.
Actually, HIPPA does still apply after a person’s death.