"HIPAA specifically excludes from PHI information held by the employer in its employment records. An employer who sponsors a group health plan generally wears two separate hats -- it has different responsibilities when acting as an employer and when acting as a covered entity, i.e. the health plan.... While state laws may not be less restrictive than HIPAA requirements, they can provide additional restrictions."