Advice needed:

Daughter is a pureblood. She works for non-profit. She's travelling to Chicago for a business trip. She was told that she can't volunteer due to her being a pureblood. She's fine with that and offered to participate/work in another capacity. Fine.

Supervisor tells her that they are having a business dinner and will be discussing the volunteer effort (that she can't participate in) and says that it may be awkward. Supe tells her that she'd like to tell her co-workers the reason why she wasn't at the volunteer event. Daughter says that the company likes to gossip.

I told her to NOT give permission to share her confidential medical information. The supe had a 'need to know' but her co-workers do not. Employees shouldn't be asked to disclose why they are or aren't vaccinated, because such reasons might reveal disability-related information. She is not hiding her status, as she's thankful that she didn't get jabbed. It's just not her co-workers' business.

Anyone out there with a similar situation or a legal perspective?