A number of laws, including the Americans with Disabilities Act, the Genetic Information Nondiscrimination Act, and the Health Insurance Portability and Accountability Act, require employers to maintain the confidentiality of employee medical records. These records must be kept in separate, secure files, with access strictly limited. For more information, see Nolo's article Keeping Personnel Files and Medical Records Confidential.
For legal advice, you'll need to talk to a lawyer.