Improper disclosure of an employee's private medical information (also known as "protected health information") may be deemed a violation of HIPAA in addition to other state and federal laws.

The employee may have consented to a limited disclosure, but not necessarily a blanket announcement to the rest of your staff . . . especially as it sounds like this consent was made verbally, which becomes more difficult to prove.

Consult with an employment attorney who knows this area to plug the leaks, set up better systems and control the damage.