If the employee discusses the illness on their own, there are no laws in the US to say they can't. Where you get sticky is if you discuss it without their consent. That's a big-time no-no.
I think you are either mixed up in the details, or have an overly aggressive HR rep.
I know the guy personally. The company has Socialcast and someone posted a fundraiser for a charity that helps people who are fighting cancer. My friend posted saying basically, "I had cancer and this organization helped out my family... try and help if you can." Someone from HR removed the comment and told him he cannot talk about his medical details on the forum.
Agree though... one company, one comment, one HR dept; your milage will vary.
I think you are either mixed up in the details, or have an overly aggressive HR rep.