It falls under the HIPAA laws. They can not divulge any medical information to anyone else without your written consent. So be sure to read any documants the company has you sign. If anything mentions releasing medical information to 3rd parties refuse.