Talk to your HR department and make it clear you want to know the exact company policy on federal HIPPA laws and why the company / person that sent that email seems intent on violating both the law and the medical privacy of company employees. Do not give in, they cannot force you, and if they try to fire you over this you can sue them into oblivion.
Government or private sector? (not that there is much of a distinction)
Kind of a combo
Talk to your HR department and make it clear you want to know the exact company policy on federal HIPPA laws and why the company / person that sent that email seems intent on violating both the law and the medical privacy of company employees. Do not give in, they cannot force you, and if they try to fire you over this you can sue them into oblivion.