HIPAA covers what information health care professionals can provide. It does not cover what your boss or anyone else can ask you. Some states have their own laws. In California, for example, you would be correct, but that is a state law, not HIPAA.

Requests from your employer

Your employer can ask you for a doctor’s note or other health information if they need the information for sick leave, workers’ compensation, wellness programs, or health insurance.

However, if your employer asks your health care provider directly for information about you, your provider cannot give your employer the information without your authorization unless other laws require them to do so.

Generally, the Privacy Rule applies to the disclosures made by your health care provider, not the questions your employer may ask.

What your employer can do if you refuse to answer or lie to them, I have no idea.