He cannot legally ask that question. It is a violation of the HIPA Law.
Nonsense. They can ask whatever they want. From the employer's position, HIPAA only applies to information obtained through their group health insurance, not information voluntarily provided by the employee.