The Health Insurance Portability and Accountability Act (aka HIPAA) only applies to what Dept. of Human Health Services refers to as "covered entities", this means:
- healthcare providers
- healthcare clearinghouses
- health plans
"healthcare providers" is quite broad and includes:
- nonprofit organizations (that provide healthcare services)
- government agencies (that provide healthcare services)
If an employer is engaged in running a health plan for employees they may be required to comply with HIPAA as what is called a "hybrid entity", which has some limitations as to the extent of the HIPAA restrictions but to all intents and purposes they are required to abide by the same rules.
Additionally any entity who is considered a "Business Associate" of a covered entity is also required to abide by HIPAA - and for purposes of this a business associate is an entity that "uses or creates protected health information on behalf of a covered entity while performing certain functions or activities" so for example an IT provider who maintained the databases for a healthcare provider would be covered under HIPAA as well.
So in your example an non-medical employer would not be violating HIPAA unless they were privvy to that health information as a result of operating a company health plan or similar.