But you're saying it's legal for the business to reveal information on Steve's health? I'm pretty sure that's covered by the same law. As far as I can tell, Steve doesn't even have to reveal anything his condition to the company if he doesn't want to. If he's legally required by the SEC to report that he's going for surgery, then it's an almost completely unenforced requirement, at least, I've never heard of it being enforced.
Share holders can ask questions, but if that's all they are doing, then they aren't going as far as their rights are to demand it if they aren't pushing a petition for a vote on the subject.