Can an employer penalize an employee or job applicant for refusing to authorize the disclosure of information beyond the limits of a written authorization?

6 The authorization form at issue in this case permitted the examining physician to disclose to the city only the ultimate results of the drug testing, and did not purport to allow the disclosure of additional information beyond such results. Accordingly, we have no occasion to determine whether an employer would violate section 56.20, subdivision (b), if it penalized an employee or job applicant for refusing to authorize the disclosure of information beyond such limits. (Cf. Pettus v. Cole (1996) 49 Cal.App.4th 402, 431-433, 57 Cal.Rptr.2d 46 [Confidentiality of Medical Information Act precludes health care providers, who conducted employer-requested physical and mental health examinations to verify an employee's claim of disability, from disclosing to the employer, without the employee's written authorization, information beyond that specifically authorized by statute.].)

7 42 United States Code section 12112, provides in relevant part:

"(a) General rule