The basic problem, IMNHO, is that once someone says "I have a medical condition" I think the law is on their side that they don't have to provide information with what that condition is.
Umbran did a pretty good job of covering your points of inquiry. I may be able to shed a bit more light.
1. I don't know that the laws in question require disclosure. The one in PA (where I live) was a governor's decree, definitely doesn't include provisions for it. People are required to disclose things like abuse and gun shot wounds, but there is no language in the mask mandates about disclosure of conditions. I don't know what laws would apply on a boat in NY.
It’s not going to be in the mask mandate- it’s already in the overarching federal & state statutes and even case law. Public health laws have been interpreted as being pretty firm. Mary Mallon- a.k.a. Typhoid Mary- was institutionalized
for the last 30 years of her life in a medical facility on an island off of NYC, essentially because she repeatedly ignored public health orders designed to keep her from spreading her disease. Many of the people she infected didn’t know her background, but SHE did. And kept ignoring the orders anyway.
2. 4. 5. and 7. To the best of my knowledge these are exceptions that deal with a health care provider turning over information to law enforcement. In this case, there was no care provider being questioned, so they wouldn't be applicable. Now, if the people had said "I have a condition, I'm being treated at XYZ Doctor's office for it", this would allow the cops to check with the doctor. But there's nothing requiring the people to give this information.
As Umbran pointed out, if you’re asserting a legal claim, you have to provide proof. That’s basic stuff. For example, if you’re being age carded when purchasing alcohol or requesting admissions to a concert at a bar, you don’t HAVE to provide proof, but if you don’t, you can legally be turned away. They don’t have to take your word for it, and if they do, they face fines and license forfeiture...even if you’re being truthful. (Those penalties are not dependent on your truthfulness, but on their requirements of due diligence.)
And if you bring suit agains the bar or liquor store for denying your service despite your being of legal age, the very first question YOU will be asked is “Did you provide proof of your age. If the answer is “No.”, the gavel will bang and you’ve just lost your case.
7. and 10. Are the ones that would really apply in this case. The problematic part is that everything I have read about this (IANAL) uses the term "imminent threat". E.g, the medical issue must be imminent threatening others. If the people who refuse to mask are asymptomatic, I don't know if they could legally be considered an imminent threat (again, my personal opinion differing from the law). Also, statements from certain high profile government officials might lend credence to the threat not being so imminent.
In a pandemic where a significant disease vector is asymptomatic transmission- such as it is with C19- asymptomatic transmission will rise to the legal requirement of “immanence” in almost any court of initial jurisdiction. Any court that doesn’t follow the science on that will likely get their findings overruled by a higher court.
Relying on the opinion statements of government officials is of little to no value. If you try that with a tax case, for example, even relying on a written opinion by an IRS agent will be insufficient to protect you in a tax case if the opinion is found to be erroneous as a matter of law.
Furthermore, in PA there are actually laws that protect you from requiring disclose your medical conditions. The cases that I know of are are probably based on ADA requirements rather than HIPAA, but I know that establishments are specifically not allowed to ask people about medical conditions with regards to service dogs or wheelchairs. Basically, an establishment cannot bar you from using medically required aids and is extremely limited in what questions they can ask about them; they can ask what service or needs you have, but are expressly barred from asking you what the underlying medical condition is. I don't know if the same laws that protect people who are using medical aids could protect people who refuse to use medical aids.
Besides the caveat Umbran pointed out, In most cases, federal law trumps state law. Someone relying on a state law to override federal disclosure requirements is playing Russian roulette with only one bullet removed from the revolver.
Not only that, but even the ADA has provisions regarding legal involuntary disclosure of a patient’s conditions (though most of the defining thereof is in case law).
http://www.adagreatlakes.org/Public...entiality_Requirements_Under_the_ADA_2018.pdf
At the end of the day, I'm really curious because I don't know of any case law yet that actually upholds these mask laws. In every case that I've seen locally, the real charge is for trespassing or disturbing the peace, or something similar. I really want to see a case about mask laws make it through the legal system to see how it plays out.
The base charge is almost always going to be trespassing or disturbing the peace because the person making the claim is doing so in a place of business- a.k.a. someone else’s private property- and those are the most common grounds for ejection. They break down like this:
Trespass: refusing to leave the premises after not complying with the property owner’s (or legal representatives) lawful request that you obey the store’s terms of service or leave
DTP: making a big verbal and/or physical ruckus about wearing the mask and/or being asked to leave
Part of the reason you haven’t seen any cases based in a HIPPA assertion or similar defense is that lawyers are burdened with a mandate that their pleadings in a case not be frivolous. If their pleadings don’t pass the court’s sniff test, that could definitely get them rebukes, less leeway on their next appearance before that judge (IOW, the next client’s representation- regardless of identity, may be affected), fines, and, if bad enough, official censure from the bar.
So if a client wants to try a HIPAA defense in one of these cases, and can’t convince their lawyer, that lawyer is not going to plead it. If the client insists, the lawyer will probably not take the case. Or if already engaged, will try to resign.
Because of this, you’re extremely unlikely to EVER see a HIPPA defense in any of these anti-mask cases.
And the case law support? Well, there’s over 115 years of SCOTUS-level precedent on the power of public health orders. Masking laws aren’t even mid-tier problematic- some of those were challenged during the Spanish Flu. They failed.
*****
EDIT:
Jacobsen v. Massachusetts in 1905 dealt with the much more physically invasive- and thus, legally, requiring greater justification- matter of mandatory vaccination and
revaccination orders. The court ruled that the smallpox epidemic played a huge factor in the decision, saying the widespread smallpox outbreak justified a general rule for vaccination, saying the state was working to protect public health and safety.
If the state can order you to get an injection, forcing you to wear a mask is kid stuff.
And private businesses can likewise insist on masks as a condition of entry. Those “No shirt, no shoes, no service” signs are perfectly legal and enforceable...and originally based in state & federal public health regs, Heck, even non-health related dress codes are enfoceav as long as they’re not discriminatory in nature or enforcement.