This question has multiple parts. As a general rule, and in accordance with HIPPA requirements, no medical information regarding a patient may be released without the patients consent. There may be exceptions to this rule but the question does not raise any of the potential exemptions as issues. A patient owns the medical information in his/her records and only the patient has a right to release that information.
The medical director in this question violated the patient's HIPPA rights.
Only a portion of the question could be responded to. The issue as to the interaction between the employer and medical director and treating physicians is unclear.
A roundup of the best tips and legal advice.