"The HIPAA Privacy Rule does not apply to employment records and generally does not regulate what information can be requested by an employer from employees as part of the terms and conditions of employment that an employer may impose on its workforce.... The HIPAA Privacy Rule does prohibit covered entities and their business associates from using or disclosing a person's protected health information (PHI)."