Are they a hospital or a covered entity. I don't think HIPAA would apply to a federal lockup. Also death certificates are not covered by HIPAA and can't prevent the release of them. Even if this isn't a death certificate. If anything shady happened it wasn't a hipaa violation. It can still be shady, but not a hipaa violation.