A friend confided in me that his employer is disclosing personal medical information about him to other employees. Is this even legal?