Site HIPAA.
After dealing professionally with HIPAA for 17 years and my rough understanding of the situation, they can legally ask you, you can site medical privacy as a reason not to disclose. Their HIPAA responsibilities start once you tell them one way or the other. Anyone outside of the person/dept. that asks the question finds out your medical status and they are in violation of HIPAA. If they treat you different they are letting everyone know what your status is. As I see it, an enterprising and vicious lawyer could make themselves, and their clients very rich off this.
Cite the HIPAA site on the Internet, too.