Looking at the question Why are toxicology reports made public? and the answer provided, I have to wonder why aren't such records (autopsy results, toxicology reports, etc.) covered by HIPAA?
Looking at HHS.Gov it reads:
The HIPAA Privacy Rule protects the individually identifiable health information about a decedent for 50 years following the date of death of the individual.
and yet autopsy and toxicology reports are treated as 'public record'.
HIPAA applies only to specified entities(see https://www.cms.gov/Regulations-and-Guidance/Administrative-Simplification/HIPAA-ACA/AreYouaCoveredEntity.html); including Health Plans, Health Care Providers, Clearinghouses, and "Business Associates".
Autopsy and toxicology records are the output not of a medical practice but of the coroner's office. The coroner is not* a health care professional; rather they are a law-enforcement official, and law enforcement are not constrained by HIPAA. Law enforcement records are often part of the public record, especially when they are attached to a court case.
The office of a coroner is empowered and charged with recording deaths in their jurisdictions, and determining cause of death for violent or suspicious deaths. In some jurisdictions, they have the power to instigate investigations. They often do this by overseeing (or, generally, in smaller jurisdictions, acting as) medical examiners and/or forensic pathologists.
*It is more proper to say that the coroner is not inherently a health care professional. Often, coroners may hold medical degrees. In some small (and often poor) counties, a/the local doctor does double duty. In others, the office of the coroner is combined into the office of the sheriff, and the positions are sometimes even merged into one person. In larger (and often wealthy) counties, the coroner may be a purely organizational and administrative position.
Sharur's answer is the correct one, but I wanted to chime in to note that even when records are covered by HIPAA, they may still be public records nonetheless, because HIPAA includes an exception (45 C.F.R. § 164.512) for uses "required by law":
A covered entity may use or disclose protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law.
I don't know how many times this has come up, but the Ohio Supreme Court decided some time ago that this meant that HIPAA-protected records still needed to be released in response to otherwise-appropriate requests for public records under R.C. 149.43:
Our research reveals that at the time of implementing these regulations, the Department of Health and Human Services, Office of the Secretary, promulgated Standards ... stating, “we intend 160.512(a) to preserve access to information considered important enough by state or federal authorities to require its disclosure by law.” ...
Similarly, in reviewing federal Freedom of Information Act requests, the secretary explains that federal FOIA requests “come within § 164.512(a) of the privacy regulation that permits uses or disclosures required by law if the uses or disclosures meet the relevant requirements of the law.” ... By analogy, an entity like the Cincinnati Health Department, faced with an Ohio Public Records Act request, need determine only whether the requested disclosure is required by Ohio law to avoid violating HIPAA's privacy rule.
State ex rel. Cincinnati Enquirer v. Daniels, 108 Ohio St. 3d 518, ¶¶ 27-28 (2006).
