Both the Americans With Disabilities Act (ADA) of 1990 and the Rehabilitation Act of 1974 contain privacy protection for employees and their company-retained medical records, but a narrow exception in these acts allows for the release of such information if requested by a court order.
However, the Equal Employment Opportunity Commission (EEOC) in a recent case has further narrowed that exemption to just federal courts, arguing that the wording of the exemption permitting disclosure "pursuant to the order of a court of competent jurisdiction" rules out state courts. In this reasoning, businesses that receive court requests for personnel files from state courts need not include any medical or health information. (Caveat: check with your attorney.)
This recent EEOC interpretation came about after an employee of the United States Postal Service (USPS) filed a lawsuit against Union Carbide, and attorneys for that firm then obtained a subpoena for the plaintiff's personnel files. The USPS did indeed turn over the plaintiff's medical files, which revealed that he had suffered a back injury at work and further suffered from sinus problems.
The plaintiff filed a complaint with the EEOC, which then issued its opinion that the ADA and Rehabilitation Act do offer privacy protection except in cases originating in federal courts.
The interpretation is too new to have been challenged yet in court.