Agreed. In a few situations, the employer cannot legally keep quiet. A child care provider with a pedophile former employee for example.
Also, I would not assume that all medical information is with certainty confidential. If (for example) you are a hosptial and the employee in question is a surgeon with a medical condition that causes serious hand tremors which has killed patients, I am far from sure that HIPAA is sifficent to gag the former employer. HIPAA is mostly directed at health care providers, not employers. I am not saying that the employer should be running off their mouth about current or former employee's meidical condition but HIPAA (or ADA for that matter) does not always gag the employer.
The prior statement that the employer can say what is true or what they think is true is almost always legally correct, and what exceptions tend to have very good reasons. Even if the employer makes what turns out to be a false statement, the defamation rules in the US are such that you have to also prove both malice in the statement and actually damages as a result fo the statement. There is a decent movie called Absence of Malice that covers this.