HR can and will disclose it from my experience, but not by law. Everything has to be proven in the court of law. It can be very hard to prove who and how information gets leaked.

I had/have a back injury. Happened years ago, but still affects me every day. The shitbags I worked for convinced me not to file worker's comp. and instead, go to a dr. myself. When I got back to work from dr. visit, HR had a meeting with me. The dr. had already called them and disclosed my diagnosis. After work, I went back to the dr. and went off in the office because the basterd would not come discuss it with me. I told his staff that I would own them all if I lost the job over it. I should have sued their pants off. Unfortunately, I was raised in church and raised not to do things like that. Now look, it cost me jobs and income. The very reason I went to retail to get away from repetitive lifting. And, I'm not a people person at all. I tried to do it for 15 years, until this mental stuff finally got the best of me.

That's why I absolutely do not trust doctors, hr depts., and coworkers. My siblings are the only ones on earth that I trust.

In reality though, if the dr. had come out, I would have beaten that sob dead right then and there. I would have gotten more pleasure from that than a lawsuit.