You are right that it's none of their business, but there is no law protecting that information from being divulged. Your employer is not your healthcare provider, so it does not fall under HIPAA.
Just to look at this from a slightly different angle, are saying that YOU believe you have no right whatsoever to be warned about the fact that a coworker you may have to interact with every day is a drug-user?
The REASON that it IS their business is because if a drug-addled employee does something that causes another employee to get injured, SOMEONE is going to get sued!
If you are doing drugs it probably won't come as a surprise to coworkers anyway. Not very professional but no law against it. It's only against the law for a medical professional to release the information without your consent to do so. I'm just surprised they haven't fired you.
Yes he is allowed
In fact back when I owned a business I would have told everyone to watch you for suspicious behavior until your termination package was completed